The Fix
pip install urllib3==1.26.7
Based on closed urllib3/urllib3 issue #2110 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -0,0 +1,9 @@
@@ -0,0 +1,9 @@
+Added ``ssl_minimum_version`` and ``ssl_maximum_version`` options which set
+``SSLContext.minimum_version`` and ``SSLContext.maximum_version``.
+
Option A — Upgrade to fixed release\npip install urllib3==1.26.7\nWhen NOT to use: Do not use this fix if your application requires support for deprecated TLS versions.\n\n
Why This Fix Works in Production
- Trigger: Switch to setting SSLContext.minimum_version
- Mechanism: Introduces `ssl_minimum_version` and `ssl_maximum_version` options to set the corresponding `SSLContext.minimum_version` and `SSLContext.maximum_version` values, addressing the deprecation of `ssl.OP_NO_TLSvX` options.
- Why the fix works: Introduces `ssl_minimum_version` and `ssl_maximum_version` options to set the corresponding `SSLContext.minimum_version` and `SSLContext.maximum_version` values, addressing the deprecation of `ssl.OP_NO_TLSvX` options. (first fixed release: 1.26.7).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.7 in real deployments (not just unit tests).
- Production symptom (often without a traceback): Switch to setting SSLContext.minimum_version
Proof / Evidence
- GitHub issue: #2110
- Fix PR: https://github.com/urllib3/urllib3/pull/2220
- First fixed release: 1.26.7
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.95
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.85
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“The ssl.OP_NO_TLSvX options were deprecated in Python 3.7. These values are available on OpenSSL 1.1.0g+, if we detect they are available with an SSLContext that supports them we should set SSLContext.minumum_version = TLSVersion.TLSv1_2”
Failure Signature (Search String)
- Switch to setting SSLContext.minimum_version
Copy-friendly signature
Failure Signature
-----------------
Switch to setting SSLContext.minimum_version
Error Message
Signature-only (no traceback captured)
Error Message
-------------
Switch to setting SSLContext.minimum_version
Environment
- Python: 3.7
What Broke
Clients experienced connection failures due to unsupported TLS versions.
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==1.26.7
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/2220
First fixed release: 1.26.7
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use this fix if your application requires support for deprecated TLS versions.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 1.26.7 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.