[ROB-2887] patching cves in urllib3

CVE-2025-66418
CVE-2025-66471

Author: Avi-Robusta

poetry.lock

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "prometrix"
-version = "0.2.8"
+version = "0.2.9"
 authors = ["Avi Kotlicky <avi@robusta.dev>"]
 readme = "README.md"
 packages = [{include = "prometrix"}]
@@ -11,14 +11,14 @@ description = "A Python Prometheus client for all Prometheus instances."
 "Bug Tracker" = "https://github.com/robusta-dev/prometrix/issues"
 
 [tool.poetry.dependencies]
-python = ">=3.9,<4.0"
-boto3 = "^1.28.15"
-botocore = "^1.31.15"
+python = ">=3.10,<4.0"
+urllib3 = ">=2.6.0,<3.0.0" # pinned to patch urllib3 cves
+botocore = "^1.38"
+boto3 = "^1.38"
 pydantic = ">=1.8.1,<3"
 prometheus-api-client = "^0.5.3"
 pillow = "^10.3.0" # added to Pin transitive dependency, not needed directly
 fonttools = "^4.43.0" # added to Pin transitive dependency, not needed directly
-urllib3 = "^1.26.20" # added to Pin transitive dependency, not needed directly
 zipp = "^3.20.1" # added to Pin transitive dependency, not needed directly
 idna = "^3.7"
 requests = ">2.32.4"