From 9e75f0931a0ee385c007e7950ae5342cfebe5293 Mon Sep 17 00:00:00 2001
From: Tomasz Wojdat <tpwojdat@gmail.com>
Date: Fri, 10 Jul 2026 13:56:03 +0200
Subject: [PATCH] Bump httplib2 upper bound to `<1.0.0`

This allows for httplib2 0.32.0 which includes a fix for CVE-2026-59939.

Resolves #39279.
---
 sdks/python/setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdks/python/setup.py b/sdks/python/setup.py
index e764f935bea6..471f15723e70 100644
--- a/sdks/python/setup.py
+++ b/sdks/python/setup.py
@@ -421,7 +421,7 @@ def get_portability_package_data():
           'fastavro>=0.23.6,<2',
           'fasteners>=0.3,<1.0',
           'grpcio>=1.33.1,<2,!=1.48.0,!=1.59.*,!=1.60.*,!=1.61.*,!=1.62.0,!=1.62.1,!=1.66.*,!=1.67.*,!=1.68.*,!=1.69.*,!=1.70.*',  # pylint: disable=line-too-long
-          'httplib2>=0.8,<0.32.0',
+          'httplib2>=0.8,<1.0.0',
           'jsonpickle>=3.0.4,<5.0.0',
           # numpy can have breaking changes in minor versions.
           # Use a strict upper bound.