update urllib to 1.26.5 for a CVE found in previous versions

[cdoern]

resolves GHSA-wqvq-5m8c-6g24
https://issues.redhat.com/browse/OCPBUGS-1926

Signed-off-by: Charlie Doern cdoern@redhat.com

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cdoern

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [cdoern]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cdoern]

@TomSweeneyRedHat PTAL I think this is what is needed

[jwhonce]

@cdoern Have you verified that version of the urllib3 library is available on RHEL and the other supported OSes? That has been an issue in the past. Otherwise, you lucked out that the version bump didn't break requests library. That has been an issue in the past.

/cc @lsm5 @jnovy

[openshift-ci]

@jwhonce: GitHub didn't allow me to request PR reviews from the following users: jnovy.

Note that only containers members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

@cdoern Have you verified that version of the urllib3 library is available on RHEL and the other supported OSes? That has been an issue in the past. Otherwise, you lucked out that the version bump didn't break requests library. That has been an issue in the past.

/cc @lsm5 @jnovy

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[lsm5]

@cdoern would be good to mention the full CVE ID in the commit message.

@jwhonce thanks, I'll check with @TomSweeneyRedHat and @jnovy on the package versions in RHEL

[TomSweeneyRedHat]

Yes, please include the full CVE in the commit message. Also, in the description or a comment, please include a link to the BZ that this is fixing. As far as the versions go, Jindrich is the man to check with.

[rhatdan]

@cdoern Please update so we can merge.

[cdoern]

sorry for the delay, I think this is set.

[rhatdan]

/lgtm