Remove upper bound on urllib in the local_requirements.txt for CVE-2023-43804

[jmahlik]

Describe the bug
It's not possible to install higher versions of urllib3 to upgrade past the vulnerable version. Recommend removing the upper bound entirely since urllib3 2.0+ is out.

Unless removing entirely causes test failures. Then it could be upper bounded to <2.0.0. I'd be willing to work on updating dependencies to support urllib3 2.0+ if needed.

https://www.cve.org/CVERecord?id=CVE-2023-43804

sagemaker-python-sdk/requirements/extras/local_requirements.txt

Line 1 in f631e41

urllib3>=1.26.8,<1.26.15

To reproduce

python -m pip install urllib3>=1.26.17 sagemaker[local]==2.188.0
...

ERROR: Cannot install sagemaker-templates==19.1.1 and sagemaker[local]==2.188.0 because these package versions have conflicting dependencies.

The conflict is caused by:
    sagemaker-templates 19.1.1 depends on urllib3>=1.26.17
    sagemaker[local] 2.188.0 depends on urllib3<1.26.15 and >=1.26.8; extra == "local"

Expected behavior
Installable.

Screenshots or logs

System information
A description of your system. Please provide:

• SageMaker Python SDK version: main
• Framework name (eg. PyTorch) or algorithm (eg. KMeans): n/a
• Framework version: n/a
• Python version: 3.11
• CPU or GPU: cpu
• Custom Docker image (Y/N): N

Additional context
Add any other context about the problem here.

[jmahlik]

There is now also https://www.cve.org/CVERecord?id=CVE-2023-45803. Submitting PR.

[jmahlik]

Docker python 6.1 now supports urllib 2+ so safe to go with the upper bound of 3.