Patch urllib3 CVEs: bump to 2.7.0

[moshemorad]

Summary

Resolves two HIGH-severity Vanta/Dependabot findings on the krr image, both in urllib3 2.6.3 (fixed in 2.7.0):

• CVE-2026-44431 (5.3): sensitive headers (Authorization/Cookie/Proxy-Authorization) forwarded on cross-origin redirects via the low-level ProxyManager.connection_from_url().urlopen() flow.
• CVE-2026-44432 (7.5): DoS via excessive HTTP response decompression (Brotli read / drain_conn) — CWE-409.

Changes

• Bumps urllib3 ^2.6.3 → ^2.7.0 in pyproject.toml
• 2.6.3 → 2.7.0 in requirements.txt
• Updates poetry.lock accordingly

Verification

• Trivy rescan of requirements.txt reports 0 HIGH/CRITICAL
• Full test suite passes (55 tests)

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6fdcc12d-0ed9-400c-8688-faa3a482152e

📥 Commits

Reviewing files that changed from the base of the PR and between 4465a10 and 4315f04.

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• pyproject.toml
• requirements.txt

---

Walkthrough

Updates urllib3 from version 2.6.3 to 2.7.0 across the project's manifest files. The dependency constraint in pyproject.toml and the pinned version in requirements.txt are both incremented to reflect the new minor release.

Changes

urllib3 Dependency Update

Layer / File(s)	Summary
urllib3 version 2.6.3 → 2.7.0 pyproject.toml, requirements.txt	Updates urllib3 from 2.6.3 to 2.7.0 in both the version constraint (^2.7.0) and the locked requirement for Python 3.10–3.13.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically identifies the main change: patching urllib3 CVEs by bumping to version 2.7.0, which directly aligns with the changeset.
Description check	✅ Passed	The description is directly related to the changeset, providing context about the CVEs being addressed and detailing the version bumps in both pyproject.toml and requirements.txt.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch patch-urllib3-cves

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}