chore(deps): update urllib3 minimum version with environment markers (getsentry#1312)

miketheman · web-flow · commit b7c0dc412a15 · 2022-08-02T12:15:02.000Z
Uses environment markers according to PEP 508. The current constraint expresses at least urllib3 version 1.10.0, which has at least 5 CVEs open. Projects relying on `sentry-sdk` will get an optimistic version of the latest, so current test suites are already using the latest version which patches these vulnerabilities. Refs: - GHSA-www2-v7xj-xrc6 (critical) - GHSA-mh33-7rrq-662w (high) - GHSA-hmv2-79q8-fv6g (high) - GHSA-wqvq-5m8c-6g24 (moderate) - GHSA-5phf-pp7p-vc2r (moderate)
diff --git a/setup.py b/setup.py
@@ -37,7 +37,12 @@ def get_file_text(file_name):
     package_data={"sentry_sdk": ["py.typed"]},
     zip_safe=False,
     license="BSD",
-    install_requires=["urllib3>=1.10.0", "certifi"],
+    install_requires=[
+        'urllib3>=1.25.7; python_version<="3.4"',
+        'urllib3>=1.26.9; python_version>="3.5"',
+        'urllib3>=1.26.11"; python_version >="3.6"',
+        "certifi",
+    ],
     extras_require={
         "flask": ["flask>=0.11", "blinker>=1.1"],
         "quart": ["quart>=0.16.1", "blinker>=1.1"],
