Allow using urllib3 v2+

[samuelhwilliams]

Expected Behavior

It should be possible to install and use appengine-python-standard with recent versions of urllib3.

Actual Behavior

appengine-python-standard restricts urllib3 to <v2. This limits the ability to install and use it with other libraries/packages.

Specifications

• Version: latest
• Platform: any

urllib3 changelog for v2.0.0 if that helps with checking compatibility and making any required changes.

🙏

[lesteral]

Note these recently reported CVEs for urllib3<2.5.0:

1. CVE-2025-50181 / GHSA-pq67-6m6q-mj2v - urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
2. CVE-2025-50182 / GHSA-48p4-8xcf-vxj5 - urllib3 does not control redirects in browsers and Node.js

[amingheibi]

The security risk is growing.
This is a new CVE for urllib3<2.6.0: CVE-2025-66471

[cnandigama1]

There is one more vulnerability here:
https://www.cve.org/CVERecord?id=CVE-2025-66418.

Is this package being supported actively?