urllib3 pinned to <2.4.0 breaks packaging

[jmontleon]

Is there a more permanent solution to the issues with python 2.4.0+ pending?
https://github.com/kubernetes-client/python/blob/master/requirements.txt#L10
https://bodhi.fedoraproject.org/updates/FEDORA-2025-34e5603fe3

Fedora 43+ has moved to urllib3 2.5.0 so in order to continue packaging the python kubernetes-client will mean carrying a patch to revert this change.

[RyanBDB]

urllib3 versions < 2.5.0 have the following known CVEs:

• CVE-2025-50181
• CVE-2025-50182

Pinning urllib3 to < 2.4.0 also prevents users taking a version which addresses these CVEs.

[YevheniiSemendiak]

Is urllib3 >= 2.5.0 support planned?

[lukehsiao]

For reference, these are some of the issues that motivated the original constraint: #2394