Fix urllib3 +security version parsing in check_compatibility (2.27.1+security.3)

HISTORY.md

@@ -6,6 +6,17 @@ dev
 
 - \[Short description of non-trivial change.\]
 
+2.27.1+security.3 (2026-06-12)
+-------------------------------
+
+**Bugfix**
+
+- `check_compatibility()` no longer fails when urllib3 reports a PEP 440
+  local version such as the ActiveState `1.26.20+security.2` build. The
+  `+security.N` segment is now stripped before parsing, so the version no
+  longer splits into `['1', '26', '20+security', '2']` (which broke the
+  major/minor/patch unpack and the `int()` conversion). Python 2 compatible.
+
 2.27.1+security.2 (2026-05-28)
 -------------------------------
 

requests/__init__.py

@@ -55,7 +55,11 @@
     chardet_version = None
 
 def check_compatibility(urllib3_version, chardet_version, charset_normalizer_version):
-    urllib3_version = urllib3_version.split('.')
+    # Drop any PEP 440 local-version segment (e.g. the ActiveState '+security.N'
+    # tag) before parsing: '1.26.20+security.2' would otherwise split into
+    # ['1', '26', '20+security', '2'], breaking the major/minor/patch unpack and
+    # the int(patch) conversion.
+    urllib3_version = urllib3_version.split('+', 1)[0].split('.')
     assert urllib3_version != ['dev']  # Verify urllib3 isn't installed from git.
 
     # Sometimes, urllib3 only reports its version as 16.1.

requests/__version__.py

@@ -5,7 +5,7 @@
 __title__ = 'requests'
 __description__ = 'Python HTTP for Humans.'
 __url__ = 'https://requests.readthedocs.io'
-__version__ = '2.27.1+security.2'
+__version__ = '2.27.1+security.3'
 __build__ = 0x022701
 __author__ = 'Kenneth Reitz'
 __author_email__ = 'me@kennethreitz.org'