From 1c1ccc5928da9f091e67e57bdc8f11f9c69e50b3 Mon Sep 17 00:00:00 2001
From: Alex Nimmo Smith <alex@nimmosmith.co.uk>
Date: Tue, 23 Jun 2026 11:59:11 +0100
Subject: [PATCH 1/2] Bump urllib3 and gdown to resolve open Dependabot alerts

Both packages were pinned below their patched versions, so
Dependabot couldn't auto-resolve:
- urllib3<2.0 blocked CVE-2025-50181's fix (2.5.0)
- gdown<5 blocked CVE-2026-40491's fix (5.2.2)

urllib3 is only a transitive dependency (not imported directly).
gdown is used in exactly one place (exampledata.get_classifier_database_from_pysilcam_blob
via download_folder), not the vulnerable extractall() function, and
download_folder's signature is unchanged through 6.1.0.

Verified by running the full test suite and pipeline-holo.ipynb with
urllib3 2.7.0 and gdown 6.1.0 actually installed.
---
 pyopia/__init__.py | 2 +-
 pyproject.toml     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pyopia/__init__.py b/pyopia/__init__.py
index c4ed6cf..b15cdcb 100644
--- a/pyopia/__init__.py
+++ b/pyopia/__init__.py
@@ -1 +1 @@
-__version__ = "2.16.6"
+__version__ = "2.16.7"
diff --git a/pyproject.toml b/pyproject.toml
index 0d781a4..9768d23 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,8 +34,8 @@ dependencies = [
     "myst-nb>=0.17.2,<0.18",
     "jupyter-book>=0.15.1,<0.16",
     "ipykernel>=6.19.4",
-    "urllib3<2.0",
-    "gdown>=4.7.1,<5",
+    "urllib3>=2.5.0,<3",
+    "gdown>=5.2.2,<7",
     "cmocean>=3.0.3,<4",
     "toml>=0.10.2,<0.11",
     "xarray>=2023.12.0,<2024",

From 6c25623d0b5e03fd0949870b4f6b90e3d4b038d0 Mon Sep 17 00:00:00 2001
From: Alex Nimmo Smith <alex@nimmosmith.co.uk>
Date: Tue, 7 Jul 2026 09:46:22 +0100
Subject: [PATCH 2/2] bump version

---
 pyopia/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyopia/__init__.py b/pyopia/__init__.py
index b15cdcb..c72fa46 100644
--- a/pyopia/__init__.py
+++ b/pyopia/__init__.py
@@ -1 +1 @@
-__version__ = "2.16.7"
+__version__ = "2.16.8"