[sgonorov]

Details:

• urllib3 goes from 2.7.0 to 2.8.0 in uv.lock. This fixes CVE-2026-97687 (HIGH), CVE-2026-97688 (MEDIUM) and CVE-2026-97689 (HIGH). It is a minor update, not a major one. The tests passed with it.
• The lock was stale after the 2026.5.1 bump, so re-locking also moved other entries. openvino goes from 2026.5.0.dev20260828 to 2026.5.1.dev20261106 and openvino-tokenizers from 2026.5.0.0 to 2026.5.1.0, as pyproject.toml asks. The Python 3.10-only entries are dropped because requires-python is >=3.11: numpy 2.2.6, matplotlib 3.10.9, contourpy 1.3.2, exceptiongroup and tomli.
• Impact: urllib3 is used only by the tests, indirectly through requests (tests/utils.py, tests/layer_tests.py). No file under python/ uses it. CI does not use the openvino pins. The impact verdict is SAFE.
• Tests run: layer_tests.py and tokenizers_test.py, 13732 passed, no new failures compared with before the bump. The OSV.dev check finds no listed CVE left.

Tickets:

• CVS-196369

AI assistance used: yes
If yes: covbot found the vulnerable package, re-locked uv.lock and wrote this description.
Human validation performed: none yet (automated by covbot: lock file only, no listed CVE left (OSV.dev), impact analysis, pytest layer_tests.py, tokenizers_test.py (13732 passed, no new failures))

Checklist:

• Existing tests pass (layer_tests.py, tokenizers_test.py)

[sgonorov]

Superseded by a complete PR that covers CVS-196369, CVS-197826 and CVS-198502 (urllib3, certifi and filelock); this one only had urllib3.