Update to 2.6.1 (close RHBZ#2419408)

- Fixes CVE-2025-66471 / GHSA-2xpw-w6gg-jr37
- Fixes CVE-2025-66418 / GHSA-gm62-xv2j-4w53

.gitignore

@@ -51,3 +51,5 @@
 /urllib3-2.3.0.tar.gz
 /urllib3-2.4.0.tar.gz
 /urllib3-2.5.0.tar.gz
+/urllib3-2.6.0.tar.gz
+/urllib3-2.6.1.tar.gz

python-urllib3.spec

@@ -5,7 +5,7 @@
 %bcond extradeps %{undefined rhel}
 
 Name:           python-urllib3
-Version:        2.5.0
+Version:        2.6.1
 Release:        %autorelease
 Summary:        HTTP library with thread-safe connection pooling, file post, and more
 
@@ -85,12 +85,6 @@ Recommends:     python3-urllib3+socks
 %autosetup -n urllib3-%{version}
 %setup -q -n urllib3-%{version} -T -D -b 1
 
-# Unpin hatch-vcs version
-# See https://github.com/urllib3/urllib3/issues/3612
-sed -i 's/hatch-vcs==/hatch-vcs>=/' pyproject.toml
-# Allow setuptools_scm 9, https://github.com/urllib3/urllib3/commit/1ce1b59ec6
-sed -i 's/setuptools-scm>=8,<9/setuptools-scm>=8,<10/' pyproject.toml
-
 # Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
 # RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
 # (from test/test_connection.py) would fail. However, it shouldn't be to close to the build time either,

sources

@@ -1,2 +1,2 @@
-SHA512 (urllib3-2.5.0.tar.gz) = 492ebb3e0481ee5433f45bef184ddb01714dedcbe2eb61665c781f3dcd0d9a226204052d64215c02e8972155560bc146395022723f79c076cb59abe1c0ef51ff
+SHA512 (urllib3-2.6.1.tar.gz) = a5935e42cfa843688f68e2c71de3eff4c505907bd155f41a6f3406000cfaa060db0184a18448e269192c3f69861f5630a112fe207874da45bf475bebbdeb2b83
 SHA512 (hypercorn-d1719f8c1570cbd8e6a3719ffdb14a4d72880abb.tar.gz) = 62d6787d88a2e716f0ac04fc49f6cdc586e473a660ee754ff66961922ae78bcc75d1f78b091e78557dd60f006e8e480114738c7b4ff71beac804e4fc9603240b