From 9b50d0cb7dd67f98dc5ab55921dea6fa5818e022 Mon Sep 17 00:00:00 2001
From: Graham Neubig <neubig@gmail.com>
Date: Thu, 8 Jan 2026 22:05:26 -0500
Subject: [PATCH] chore(deps): update jinja2, tornado, urllib3 (#12330)

Co-authored-by: openhands <openhands@all-hands.dev>
---
 poetry.lock    | 14 +++++++-------
 pyproject.toml |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 4bc9e2786c..072e1e2203 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
 
 [[package]]
 name = "aiofiles"
@@ -15688,21 +15688,21 @@ files = [
 
 [[package]]
 name = "urllib3"
-version = "2.5.0"
+version = "2.6.3"
 description = "HTTP library with thread-safe connection pooling, file post, and more."
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "evaluation", "runtime", "test"]
 files = [
-    {file = "urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc"},
-    {file = "urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760"},
+    {file = "urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4"},
+    {file = "urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"},
 ]
 
 [package.extras]
-brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""]
+brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""]
 h2 = ["h2 (>=4,<5)"]
 socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"]
-zstd = ["zstandard (>=0.18.0)"]
+zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""]
 
 [[package]]
 name = "uuid7"
@@ -16846,4 +16846,4 @@ third-party-runtimes = ["daytona", "e2b-code-interpreter", "modal", "runloop-api
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.12,<3.14"
-content-hash = "9b3589817841a448361c5dd5e030e200627c09cad7f98aa5b080000511794bfc"
+content-hash = "f31445ff42cb790b3fcd2d02b84e807fd2819bade054ae9c293142a8e277c2f0"
diff --git a/pyproject.toml b/pyproject.toml
index c8c07234a3..77259861d9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -44,14 +44,14 @@ playwright = "^1.55.0"
 html2text = "*"
 deprecated = "*"
 pexpect = "*"
-jinja2 = "^3.1.3"
+jinja2 = "^3.1.6"
 python-multipart = "*"
 tenacity = ">=8.5,<10.0"
 zope-interface = "7.2"
 pathspec = "^0.12.1"
 pyjwt = "^2.9.0"
 dirhash = "*"
-tornado = "*"
+tornado = ">=6.5"
 python-dotenv = "*"
 rapidfuzz = "^3.9.0"
 whatthepatch = "^1.0.6"
@@ -86,7 +86,7 @@ bashlex = "^0.18"
 pypdf = "^6.0.0"
 pillow = "^11.3.0"
 starlette = "^0.48.0"
-urllib3 = "^2.5.0"
+urllib3 = "^2.6.3"
 requests = "^2.32.5"
 setuptools = ">=78.1.1"