Possible fix(deps): urllib3 2.5.0 → 2.6.0 (CVE-2025-66471) in requirements.txt

Spotted what might be an issue in `requirements.txt` around line 12.

CVE‑2025‑66471 is a resource‑exhaustion vulnerability in urllib3's streaming API. When a response is highly compressed, urllib3 can fully decompress a small payload in a single operation, causing massive memory allocation and CPU spikes. This can be leveraged for denial‑of‑service attacks. Because the project pins urllib3 to version 2.5.0, it remains exposed to this issue.

Something like this might fix it:

```diff
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,7 +9,7 @@ # project dependencies
-urllib3==2.5.0
+urllib3==2.6.0
```

For reference: rule `CVE-2025-66471`. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Update the urllib3 pin around line 12 of requirements.txt from 2.5.0 to 2.6.0. Start by checking the dependency entry and then run the project's test suite, since the issue says it has not been tested. Done means the vulnerable pin is replaced and the tests pass.

Written by the indexing model from the issue text.