[py] Loosen dependency specifier for urllib3 in packaging configuration

[cgoldberg]

User description

🔗 Related Issues

see: #15977 (comment)

💥 What does this PR do?

This PR loosens the dependency specifier for urllib3 for Python packaging. Rather than specifying compatibility within a minor version (urllib3[socks]~=2.5.0), we will allow any 2.x version greater then 2.5.0 (urllib3[socks]>=2.5.0,<3.0). This will allow compatibility if urllib3 does another security patch within the 2.x series.

🔄 Types of changes

• Build/Packaging

---

PR Type

Other

---

Description

• Loosen urllib3 dependency from ~=2.5.0 to >=2.5.0,<3.0

• Allow compatibility with future urllib3 2.x security patches

---

Diagram Walkthrough

flowchart LR
  A["urllib3[socks]~=2.5.0"] -- "loosen constraint" --> B["urllib3[socks]>=2.5.0,<3.0"]
  B --> C["Allow 2.x security patches"]

Loading

File Walkthrough

	Relevant files
Dependencies	BUILD.bazel Loosen urllib3 dependency constraint                                          py/BUILD.bazel Updated urllib3 dependency from ~=2.5.0 to >=2.5.0,<3.0 +1/-1      pyproject.toml Loosen urllib3 dependency constraint                                          py/pyproject.toml Updated urllib3 dependency from ~=2.5.0 to >=2.5.0,<3.0 +1/-1

---

[qodo-code-review]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Version Range The new version constraint allows any 2.x version above 2.5.0, which could potentially include breaking changes within the major version. Consider if urllib3 follows semantic versioning strictly and whether this broad range is appropriate for production use. "urllib3[socks]>=2.5.0;<3", "trio~=0.30.0",

[qodo-code-review]

PR Code Suggestions ✨

Latest suggestions up to a98a525

Category	Suggestion	Impact
Possible issue	✅ Fix version constraint separator syntax Suggestion Impact: The suggestion was directly implemented - the semicolon separator in the urllib3 version constraint was changed to a comma separator as suggested code diff: - "urllib3[socks]>=2.5.0;<3.0", + "urllib3[socks]>=2.5.0,<3.0", The version constraint uses a semicolon separator which is not standard for pip dependency specifications. Use comma separator instead for better compatibility across packaging tools. py/BUILD.bazel [330] -"urllib3[socks]>=2.5.0;<3.0", +"urllib3[socks]>=2.5.0,<3.0", [Suggestion processed] Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies an invalid separator in the urllib3 version specifier; using a semicolon instead of a comma would cause dependency resolution to fail.	High
Update

---

Previous suggestions

✅ Suggestions up to commit 94454e7

Category	Suggestion	Impact
General	✅ Use explicit version constraint format Suggestion Impact: The commit implemented the exact suggestion by fixing the invalid dependency specifier, changing the semicolon to a comma and using the explicit version format <3.0 code diff: - "urllib3[socks]>=2.5.0;<3", + "urllib3[socks]>=2.5.0,<3.0", The version constraint should use <3.0 instead of <3 for better clarity and consistency with semantic versioning practices. This makes the upper bound more explicit and follows common Python packaging conventions. py/BUILD.bazel [330] -"urllib3[socks]>=2.5.0;<3", +"urllib3[socks]>=2.5.0,<3.0", Suggestion importance[1-10]: 8 __ Why: The suggestion corrects an invalid dependency specifier by changing the semicolon to a comma, which is crucial for correctness as per PEP 508.	Medium