Bump urllib3 to 2.8.0 to close 3 shipping Dependabot advisories #638

Context

Dependabot reports 56 open alerts on this repo's Security tab. Cross-checked against pyproject.toml/uv.lock on master: only urllib3 is on the actual shipping dependency path (b2sdk's direct deps are annotated_types, certifi, logfury, requests, typing-extensions; requests pulls in urllib3). Everything else flagged — virtualenv, filelock, tornado, starlette, anyio, setuptools, pip — is pulled in only by the nox/lint/test/doc dev dependency-groups, never installed for a consumer via pip install b2sdk.

Ships today:

• urllib3 2.7.0 — three advisories, identical to the set already fixed on B2_Command_Line_Tool (Bump urllib3 and idna to close 4 shipping Dependabot advisories B2_Command_Line_Tool#1199):
  • GHSA-8988-9cw3-xx77 / CVE-2026-97687 (High) — HTTPS proxy TLS configuration may be ignored or overridden
  • GHSA-vxq7-64xx-v4gw / CVE-2026-97689 (High) — HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
  • GHSA-gh4c-6fx4-qh6g / CVE-2026-97688 (Medium) — chunked Deflate streaming can enter an infinite loop
  • Fixed in urllib3 2.8.0. requests's declared range (urllib3<3,>=1.26) allows it — pure lockfile bump, no pyproject.toml change.

Needs verification, not a code fix: alert #61 (certifi, Critical, GHSA-6q48-6c7w-9gw2, the emSign root CA compromise) records version_requirement: "= 2026.1.4", but master's uv.lock already pins certifi 2026.10.19 — above the advisory's fixed version (2026.10.18). This looks like a stale/lagging Dependabot alert, not a real gap (the certifi bump already landed via #632 per the 2026-10-25 fleet audit). Re-check after this PR merges and triggers a re-scan; if it's still open afterward, dismiss it manually with a note, don't chase a code change that already exists.

Acceptance criteria

• uv.lock pins urllib3>=2.8.0.
• Existing unit/integration suite green.
• No change to pyproject.toml direct dependency bounds.
• Do NOT touch certifi — already correct; see note above.

Scope / out of scope

In scope: urllib3 lockfile bump only.
Out of scope: virtualenv, filelock, tornado, starlette, anyio, setuptools, pip (dev-tooling-only, tracked separately at lower priority) and the stale certifi alert (needs a Dependabot re-scan/dismiss, not a code change).

Links

• Same advisory set already fixed in Bump urllib3 and idna to close 4 shipping Dependabot advisories B2_Command_Line_Tool#1199