urllib3 is currently pinned at >= 1.25.3, < 2.1.0 in setup.py and requirements.txt. I was not able to find any reason to forbid using newer versions of urllib3 (unless somebody is using versions of Python that are no longer maintained – 3.7 or 3.8). Just specifying the lower bound (or at least making the upper bound less restrictive, e.g. < 3) should be sufficient.