Bump urllib3 from 1.26.3 to 1.26.4

[cjolowicz]

+==============================================================================+
|                                                                              |
|                               /$$$$$$            /$$                         |
|                              /$$__  $$          | $$                         |
|           /$$$$$$$  /$$$$$$ | $$  \__//$$$$$$  /$$$$$$   /$$   /$$           |
|          /$$_____/ |____  $$| $$$$   /$$__  $$|_  $$_/  | $$  | $$           |
|         |  $$$$$$   /$$$$$$$| $$_/  | $$$$$$$$  | $$    | $$  | $$           |
|          \____  $$ /$$__  $$| $$    | $$_____/  | $$ /$$| $$  | $$           |
|          /$$$$$$$/|  $$$$$$$| $$    |  $$$$$$$  |  $$$$/|  $$$$$$$           |
|         |_______/  \_______/|__/     \_______/   \___/   \____  $$           |
|                                                          /$$  | $$           |
|                                                         |  $$$$$$/           |
|  by pyup.io                                              \______/            |
|                                                                              |
+==============================================================================+
| REPORT                                                                       |
| checked 119 packages, using free DB (updated once a month)                   |
+============================+===========+==========================+==========+
| package                    | installed | affected                 | ID       |
+============================+===========+==========================+==========+
| urllib3                    | 1.26.3    | >=1.26.0,<1.26.4         | 40014    |
+==============================================================================+
| The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate    |
| validation in some cases involving HTTPS to HTTPS proxies. The initial       |
| connection to the HTTPS proxy (if an SSLContext isn't given via              |
| proxy_config) doesn't verify the hostname of the certificate. This means     |
| certificates for different servers that still validate properly with the     |
| default urllib3 SSLContext will be silently accepted. See CVE-2021-28363.    |
+==============================================================================+