urllib3 Deprecate the SecureTransport TLS implementation

The Fix

pip install urllib3==2.0.7

Based on closed urllib3/urllib3 issue #2681 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -0,0 +1 @@
@@ -0,0 +1 @@
+Removed support for the SecureTransport TLS implementation.
diff --git a/docs/reference/contrib/index.rst b/docs/reference/contrib/index.rst
index e233241616..7785541912 100644

repro.py

def inject_into_urllib3() -> None:
    
    warnings.warn(
        "'urllib3.contrib.securetransport.inject_into_urllib3()' is deprecated and will be removed "
        "in a future release of urllib3 2.x. Read more in the doc: "
        "https://urllib3.readthedocs.io/en/stable/reference/contrib/securetransport.html",
        category=DeprecationWarning,
        stacklevel=2,
    )
    .......
    .......
    .......

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install urllib3==2.0.7\nWhen NOT to use: This fix should not be used if projects still rely on SecureTransport for TLS support.\n\n

Why This Fix Works in Production

Trigger: Deprecate the SecureTransport TLS implementation
Mechanism: The SecureTransport implementation is no longer necessary due to improvements in macOS and OpenSSL support
Why the fix works: Removes support for the SecureTransport TLS implementation, addressing the maintenance burden associated with it. (first fixed release: 2.0.7).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

Triggered by an upgrade/regression window: 1.1.1 breaks; 2.0.7 is the first fixed release.
The SecureTransport implementation is no longer necessary due to improvements in macOS and OpenSSL support
Production symptom (often without a traceback): Deprecate the SecureTransport TLS implementation

Proof / Evidence

GitHub issue: #2681
Fix PR: https://github.com/urllib3/urllib3/pull/3146
First fixed release: 2.0.7
Affected versions: 1.1.1
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.95
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.67

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“Hi @sethmlarson i've added the deprecation warning to the inject_into_urllib3() method in the securetransport module”

@fyunusa · 2022-08-14 · source

“Yes, links to the docs are one honking great idea -- let's do more of those!”

@pquentin · 2022-08-19 · source

“OK nice @pquentin I'll try to work on the remaining task.”

@fyunusa · 2022-08-19 · source

Failure Signature (Search String)

Deprecate the SecureTransport TLS implementation
- Make the `inject_into_urllib3` function raise an exception with a URL to the documentation.

Copy-friendly signature

signature.txt

Failure Signature
-----------------
Deprecate the SecureTransport TLS implementation
- Make the `inject_into_urllib3` function raise an exception with a URL to the documentation.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
Deprecate the SecureTransport TLS implementation
- Make the `inject_into_urllib3` function raise an exception with a URL to the documentation.

Minimal Reproduction

repro.py

def inject_into_urllib3() -> None:
    
    warnings.warn(
        "'urllib3.contrib.securetransport.inject_into_urllib3()' is deprecated and will be removed "
        "in a future release of urllib3 2.x. Read more in the doc: "
        "https://urllib3.readthedocs.io/en/stable/reference/contrib/securetransport.html",
        category=DeprecationWarning,
        stacklevel=2,
    )
    .......
    .......
    .......

Environment

urllib3: 2

What Broke

Maintaining SecureTransport incurs unnecessary overhead without significant benefits.

Why It Broke

The SecureTransport implementation is no longer necessary due to improvements in macOS and OpenSSL support

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==2.0.7

When NOT to use: This fix should not be used if projects still rely on SecureTransport for TLS support.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/3146

First fixed release: 2.0.7

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

This fix should not be used if projects still rely on SecureTransport for TLS support.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
1.1.1	Broken
2.0.7	Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

urllib3 Deprecate the SecureTransport TLS implementation (Fix)