[Task]: Bump httplib2 to a version with resolved CVE-2026-59939

[tpwo]

What needs to happen?

Hello, in our vulnerability tracking system we noticed that Beam Python SDK depends on httplib2<0.32.0 which is reported with CVE-2026-59939:

To resolve it, we need to allow for newer versions of httplib2 here:

beam/sdks/python/setup.py

Line 424 in 668c6a3

'httplib2>=0.8,<0.32.0',

httplib2 0.32.0 was released on Jun 26: https://pypi.org/project/httplib2/0.32.0/

Maybe it makes sense to have looser constraints here and do something like:

-'httplib2>=0.8,<0.32.0',
+'httplib2>=0.8,<1.0.0',

EDIT: I created a PR #39280 with the change proposed above.

I'm marking this issue as P1, as CVE-2026-59939 is marked as High in our system, and it would be good to resolve it before the next release of Beam.

Issue Priority

Priority: 1 (urgent / mostly reserved for critical bugs)

Issue Components

• Component: Python SDK
• Component: Java SDK
• Component: Go SDK
• Component: Typescript SDK
• Component: IO connector
• Component: Beam YAML
• Component: Beam examples
• Component: Beam playground
• Component: Beam katas
• Component: Website
• Component: Infrastructure
• Component: Spark Runner
• Component: Flink Runner
• Component: Prism Runner
• Component: Twister2 Runner
• Component: Hazelcast Jet Runner
• Component: Google Cloud Dataflow Runner

[derrickaw]

Seems reasonable to fix