CVE-2026-97687 and CVE-2026-97689 are reported against the Debian
apt-installed urllib3 (2.7.0) which cannot be upgraded via pip.
The application Python layer already has urllib3 2.8.0 installed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>