urllib3-lts 🛡️

The Long-Term Support Security Release for urllib3.

This ecosystem backports critical security fixes to legacy Python environments (3.7 & 3.8) that official maintainers have dropped.

🏆 Patch Status (v2025.66471)

This release secures 941M+ downloads against the following vulnerabilities:

🏆 Patch Status (v2026.21441)

This release secures 929M+ downloads against the following vulnerabilities:

📦 Usage

Standard Installation:

pip install urllib3-lts

This meta-package automatically detects your Python version and installs the correct secured backport.

🌐 OmniPKG Security Scanning

This package is maintained as part of the OmniPKG ecosystem — a Python environment manager with built-in CVE scanning. Scanning is performed via pip audit by default, with Safety as an optional upgrade.

pip install omnipkg
omnipkg reset -y
# -> Scans all installed packages for CVEs
# -> urllib3-lts will show 0 issues for all patched CVEs above

Maintained by 1minds3t.

🚧 Coming Soon: omnipkg-runtime

We are building a runtime enforcer that allows configurable WARN or BLOCK policies for unpatched vulnerabilities. Stay tuned.

⚠️ Important: Installation for Python 3.7-3.8

Before installing urllib3-lts, uninstall any existing urllib3:

pip uninstall urllib3 -y
pip install urllib3-lts

This ensures you get the security patches. If you install urllib3-lts without removing urllib3 first, other packages may reinstall the vulnerable version.

Alternative: Pin in requirements.txt

urllib3-lts-py37==2026.21441.1 ; python_version<'3.8'
urllib3-lts-py38==2026.21441 ; python_version>='3.8' and python_version<'3.9'