Feature Request - pls. support the latest version of urllib3

[tammyalexandra]

What is your feature request? Please describe.

Currently this library is locked to a two year-old version of urllib3. urllib3 is now up to 2.2.2 -- it has been on 2.* for more than a year.

Describe the solution you'd like

Can you please update requirements.txt to support the latest version of urllib3?

Describe alternatives you've considered

Unfortunately we cannot downgrade urllib3 in our own codebase bc it leads to a cascade of downgrades that reintroduces a security vulnerability.

Additional context

n/a

[ramicaza]

+1. Also if the dependencies could be loosened in general that would be fantastic. E.g. dotenv is pinned to version ==20.0.0
(IIRC).

A simple unpinning of the dependencies in setup.py as is standard practice in all libraries would suffice

[dfana01]

@ramicaza @tammyalexandra

We loosened the version for both libraries. Please let us know if it works on your end; here are the reference PRs.

#142
#143

[tammyalexandra]

Thanks so much for working on this! Unfortunately I landed here:

Updated pyproject.toml:

pinterest-api-sdk = { git = "https://github.com/pinterest/pinterest-python-sdk.git" }

Ran poetry.lock without success:

> poetry lock
Resolving dependencies... (2.2s)

Because pinterest-api-sdk (0.2.5) @ git+https://github.com/pinterest/pinterest-python-sdk.git@HEAD depends on Pinterest-Generated-Client (0.1.10)
 and pinterest-generated-client (0.1.10) depends on urllib3 (1.26.20), pinterest-api-sdk (0.2.5) @ git+https://github.com/pinterest/pinterest-python-sdk.git@HEAD requires urllib3 (1.26.20).
So, because [app] depends on both pinterest-api-sdk (0.2.5) @ git+https://github.com/pinterest/pinterest-python-sdk.git and urllib3 (2.*), version solving failed.

I saw your username on the most recent commit on pinterest-generated-client as well -- are you able to take care of that one, too? I'm happy to open a new issue on that repo if easier for you.

Thanks for your continued help!

[erovira]

Hi @dfana01 !

I believe this issue is still happening.

Currently I see the https://github.com/pinterest/pinterest-python-sdk/releases/tag/v0.2.6 and the main branch have the Pinterest-Generated-Client==0.1.10 pin, which has the urllib3 == 1.26.20 pin. This is preventing users of the latest version of the sdk to use urllib3 major version 2.

Given that Pinterest-Generated-Client 0.1.11 was released ~6 months ago, do you think it's suitable for use here? I believe that would solve the issue.

• It's worth mentioning that there's no github tag for https://github.com/pinterest/pinterest-python-generated-api-client/releases/tag/0.1.11 as of now, which I'm not sure if is accidental or intentional.

Similarly to @tammyalexandra , I'm here due to vulnerability-related concerns in urllib3 major version 1.

Thank you!