[🐛 Bug]: Inconsistency between the code on github and on pypi

[KanorUbu]

Description

Hello

I noticed that selenium does not accept version 2.5.0 of urllib3 even though the source code allows it
https://github.com/SeleniumHQ/selenium/blob/selenium-4.34.0/py/pyproject.toml#L28

Is this normal?

For your information, version 3.5 sets two cve CVE-2025-50181 & CVE-2025-50182

Reproducible Code

pip install urllib3==2.5.0  selenium==4.34.0

Debugging Logs

Requirement already satisfied: urllib3==2.5.0 in ./virtual_python/lib/python3.11/site-packages (2.5.0)
Requirement already satisfied: selenium==4.34.0 in ./virtual_python/lib/python3.11/site-packages (4.34.0)
INFO: pip is looking at multiple versions of selenium to determine which version is compatible with other requirements. This could take a while.
ERROR: Cannot install selenium==4.34.0 and urllib3==2.5.0 because these package versions have conflicting dependencies.

The conflict is caused by:
    The user requested urllib3==2.5.0
    selenium 4.34.0 depends on urllib3~=2.4.0

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip to attempt to solve the dependency conflict


[notice] A new release of pip is available: 25.0.1 -> 25.1.1
[notice] To update, run: pip install --upgrade pip
ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

[selenium-ci]

@KanorUbu, thank you for creating this issue. We will troubleshoot it as soon as we can.

Selenium Triage Team: remember to follow the Triage Guide

[robberwick]

I am also hitting this.

Note that urllib3 2.5.0 contains the fixes for both https://nvd.nist.gov/vuln/detail/CVE-2025-50181 and https://nvd.nist.gov/vuln/detail/CVE-2025-50182, so pinning to 2.4.0 is not desirable.

[cgoldberg]

This was missed in the 4.34 release, but has been updated and will be in the next release:
#15977

I am not sure if we will do a quick 4.34.1 release to address this or it will wait until 4.35.

[KanorUbu]

Thank you for your quick response

[github-actions]

This issue has been automatically locked since there has not been any recent activity since it was closed. Please open a new issue for related bugs.