chore(deps): update dependency urllib3 to v2.6.3 [security] (#2357)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [urllib3](https://redirect.github.com/urllib3/urllib3)
([changelog](https://redirect.github.com/urllib3/urllib3/blob/main/CHANGES.rst))
| `==2.6.0` → `==2.6.3` |
![age](https://developer.mend.io/api/mc/badges/age/pypi/urllib3/2.6.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/urllib3/2.6.0/2.6.3?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2026-21441](https://redirect.github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99)

### Impact

urllib3's [streaming
API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o)
is designed for the efficient handling of large HTTP responses by
reading the content in chunks, rather than loading the entire response
body into memory at once.

urllib3 can perform decoding or decompression based on the HTTP
`Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`).
When using the streaming API, the library decompresses only the
necessary bytes, enabling partial content consumption.

However, for HTTP redirect responses, the library would read the entire
response body to drain the connection and decompress the content
unnecessarily. This decompression occurred even before any read methods
were called, and configured read limits did not restrict the amount of
decompressed data. As a result, there was no safeguard against
decompression bombs. A malicious server could exploit this to trigger
excessive resource consumption on the client (high CPU usage and large
memory allocations for decompressed data; CWE-409).

### Affected usages

Applications and libraries using urllib3 version 2.6.2 and earlier to
stream content from untrusted sources by setting `preload_content=False`
when they do not disable redirects.

### Remediation

Upgrade to at least urllib3 v2.6.3 in which the library does not decode
content of redirect responses when `preload_content=False`.

If upgrading is not immediately possible, disable
[redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests)
by setting `redirect=False` for requests to untrusted source.

---

### Release Notes

<details>
<summary>urllib3/urllib3 (urllib3)</summary>

###
[`v2.6.3`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#263-2026-01-07)

[Compare
Source](https://redirect.github.com/urllib3/urllib3/compare/2.6.2...2.6.3)

\==================

- Fixed a high-severity security issue where decompression-bomb
safeguards of
  the streaming API were bypassed when HTTP redirects were followed.
(`GHSA-38jv-5279-wg99
<https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>`\_\_)
- Started treating `Retry-After` times greater than 6 hours as 6 hours
by
default. (`#&#8203;3743
<https://github.com/urllib3/urllib3/issues/3743>`\_\_)
- Fixed `urllib3.connection.VerifiedHTTPSConnection` on Emscripten.
  (`#&#8203;3752 <https://github.com/urllib3/urllib3/issues/3752>`\_\_)

###
[`v2.6.2`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#262-2025-12-11)

[Compare
Source](https://redirect.github.com/urllib3/urllib3/compare/2.6.1...2.6.2)

\==================

- Fixed `HTTPResponse.read_chunked()` to properly handle leftover data
in
  the decoder's buffer when reading compressed chunked responses.
  (`#&#8203;3734 <https://github.com/urllib3/urllib3/issues/3734>`\_\_)

###
[`v2.6.1`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#261-2025-12-08)

[Compare
Source](https://redirect.github.com/urllib3/urllib3/compare/2.6.0...2.6.1)

\==================

- Restore previously removed `HTTPResponse.getheaders()` and
  `HTTPResponse.getheader()` methods.
  (`#&#8203;3731 <https://github.com/urllib3/urllib3/issues/3731>`\_\_)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/python-bigquery).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42OS4xIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: Anthonios Partheniou <partheniou@google.com>

Author: renovate-bot

samples/geography/requirements.txt

@@ -41,4 +41,4 @@ Shapely==2.1.2; python_version >= '3.10'
 six==1.17.0
 typing-extensions==4.15.0
 typing-inspect==0.9.0
-urllib3==2.6.0
+urllib3==2.6.3