urllib3 upgrade

[MordaCap]

Could you please upgrade urllib3 to 2.7.0 ASAP?

https://security.snyk.io/package/pip/urllib3

[Newrelic-Boomi]

https://new-relic.atlassian.net/browse/NR-565340

[TimPansino]

Unfortunately the agent needs to support Python 3.9 per our SLAs until November, and urllib3==2.7.0 only supports Python 3.10+.

[TimPansino]

Leaving this issue open until these CVEs have been patched. In the meantime, if you have any input on the security analysis in PR #1736 feel free to leave a comment.

TL;DR: My findings were that the agent should not be vulnerable to CVE-2026-44431, but could be vulnerable to a DoS attack from a compromised HTTPS proxy through CVE-2026-44432. If you have a compromised HTTPS proxy, there are probably many much worse issues to worry about first.

[mlasevich]

It does not matter if it is actually exploitable, it is flagged and blocked by most enterprise pipelines :-/ If we have to wait 4 months to get this patched, the main workaround is to drop NewRelic and move to something else :-/

[TimPansino]

If you're an enterprise customer and have an account manager with New Relic feel free to submit a request through them, and they can escalate it on your behalf.

Unfortunately I don't control the SLAs we have with other enterprise customers. Any changes made to those would need to go through our leadership and not through GitHub. Without external pressure, they're unlikely to approve the decision to impact all customers currently using Python 3.9.