.coveragerc

@@ -2,28 +2,27 @@
 source =
     urllib3
 
-omit =
-    *urllib3/packages/*
-    *urllib3/contrib/appengine.py
-    *urllib3/contrib/ntlmpool.py
-    *urllib3/contrib/pyopenssl.py
-    *urllib3/contrib/securetransport.py
-    *urllib3/contrib/_securetransport/*
-
 [paths]
 source =
     src/urllib3
-    .tox/*/lib/python*/site-packages/urllib3
-    .tox\*\Lib\site-packages\urllib3
-    .tox/pypy*/site-packages/urllib3
+    */urllib3
+    *\urllib3
 
 [report]
+omit =
+    src/urllib3/contrib/pyopenssl.py
+    src/urllib3/contrib/securetransport.py
+    src/urllib3/contrib/_securetransport/*
+
 exclude_lines =
+    except ModuleNotFoundError:
     except ImportError:
     pass
     import
-    raise
+    raise NotImplementedError
     .* # Platform-specific.*
     .*:.* # Python \d.*
     .* # Abstract
     .* # Defensive:
+    if (?:typing.)?TYPE_CHECKING:
+    ^\s*?\.\.\.\s*$

.github/CODEOWNERS

@@ -1,8 +1,8 @@
 # Restrict all files related to deploying to
 # require lead maintainer approval.
 
-.github/CODEOWNERS          @sethmlarson @shazow
-src/urllib3/_version.py     @sethmlarson @shazow
-setup.py                    @sethmlarson @shazow
-ci/                         @sethmlarson @shazow
-.travis.yml                 @sethmlarson @shazow
+.github/workflows/          @sethmlarson @pquentin @shazow
+.github/CODEOWNERS          @sethmlarson @pquentin @shazow
+src/urllib3/_version.py     @sethmlarson @pquentin @shazow
+pyproject.toml              @sethmlarson @pquentin @shazow
+ci/                         @sethmlarson @pquentin @shazow

.github/FUNDING.yml

@@ -1,3 +1,3 @@
 tidelift: pypi/urllib3
+github: urllib3
 open_collective: urllib3
-custom: https://gitcoin.co/grants/65/urllib3

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: false
 contact_links:
   - name: 📚 Documentation
-    url: https://urllib3.readthedocs.io/en/latest/
+    url: https://urllib3.readthedocs.io
     about: Make sure you read the relevant docs
   - name: ❓ Ask on StackOverflow
     url: https://stackoverflow.com/questions/tagged/urllib3

.github/PULL_REQUEST_TEMPLATE/release.md

@@ -0,0 +1,19 @@
+* [ ]  See if all tests, including integration, pass
+* [ ]  Get the release pull request approved by a [CODEOWNER](https://github.com/urllib3/urllib3/blob/main/.github/CODEOWNERS)
+* [ ]  Squash merge the release pull request with message "`Release <VERSION>`"
+* [ ]  Tag with X.Y.Z, push tag on urllib3/urllib3 (not on your fork, update `<REMOTE>` accordingly)
+  * Notice that the `<VERSION>` shouldn't have a `v` prefix (Use `1.26.6` instead of `v.1.26.6`)
+  * ```
+    git tag -s -a '<VERSION>' -m 'Release: <VERSION>'
+    git push <REMOTE> --tags
+    ```
+* [ ]  Execute the `publish` GitHub workflow. This requires a review from a maintainer.
+* [ ]  Ensure that all expected artifacts are added to the new GitHub release. Should
+       be one `.whl`, one `.tar.gz`, and one `multiple.intoto.jsonl`. Update the GitHub
+       release to have the content of the release's changelog.
+* [ ]  Announce on:
+  * [ ]  Twitter
+  * [ ]  Discord
+  * [ ]  OpenCollective
+* [ ]  Update Tidelift metadata
+* [ ]  If this was a 1.26.x release, add changelog to the `main` branch

.github/SECURITY.md

@@ -0,0 +1,4 @@
+# Security Disclosures
+
+To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure with maintainers.

.github/codeql.yml

@@ -0,0 +1,3 @@
+paths:
+- "src/"
+

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    ignore:
+      # Ignore all patch releases as we can manually
+      # upgrade if we run into a bug and need a fix.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-patch"]

.github/workflows/changelog.yml

@@ -0,0 +1,28 @@
+name: Check
+
+on:
+  pull_request:
+    types: [labeled, unlabeled, opened, reopened, synchronize]
+
+permissions: "read-all"
+
+jobs:
+  check-changelog-entry:
+    name: changelog entry
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: "Checkout repository"
+        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
+        with:
+          # `towncrier check` runs `git diff --name-only origin/main...`, which
+          # needs a non-shallow clone.
+          fetch-depth: 0
+
+      - name: "Check changelog"
+        if: "!contains(github.event.pull_request.labels.*.name, 'Skip Changelog')"
+        run: |
+          if ! pipx run towncrier check --compare-with origin/${{ github.base_ref }}; then
+          echo "Please see https://github.com/urllib3/urllib3/blob/main/changelog/README.rst for guidance."
+            false
+          fi

.github/workflows/ci.yml

@@ -2,81 +2,137 @@ name: CI
 
 on: [push, pull_request]
 
+permissions: "read-all"
+
 defaults:
   run:
     shell: bash
 
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v2
-      - name: Set up Python 3.8
-        uses: actions/setup-python@v2
-        with:
-          python-version: 3.8
-      - name: Install dependencies
-        run: python3.8 -m pip install nox
-      - name: Lint the code
-        run: nox -s lint
-
   package:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v2
-      - name: Set up Python 3.7
-        uses: actions/setup-python@v2
+      - name: "Checkout repository"
+        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
+
+      - name: "Setup Python"
+        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
         with:
-          python-version: 3.7
-      - name: Check packages
+          python-version: "3.x"
+          cache: "pip"
+
+      - name: "Check packages"
         run: |
-          python3.7 -m pip install wheel twine rstcheck;
-          python3.7 setup.py sdist bdist_wheel;
-          rstcheck README.rst CHANGES.rst
-          python3.7 -m twine check dist/*
+          python -m pip install -U pip setuptools wheel build twine rstcheck
+          python -m build
+          rstcheck CHANGES.rst
+          python -m twine check dist/*
+
   test:
     strategy:
       fail-fast: false
       matrix:
-        python-version: [2.7, 3.5, 3.6, 3.7, 3.8]
-        os: [macos-latest, windows-latest]
-        experimental: [false]
+        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12-dev"]
+        os:
+          - macos-11
+          - windows-latest
+          - ubuntu-20.04  # OpenSSL 1.1.1
+          - ubuntu-22.04  # OpenSSL 3.0
+        nox-session: ['']
         include:
-          - python-version: 3.9-dev
-            os: macos-latest
+          - experimental: false
+          - python-version: "pypy-3.7"
+            os: ubuntu-latest
+            experimental: false
+            nox-session: test-pypy
+          - python-version: "pypy-3.8"
+            os: ubuntu-latest
+            experimental: false
+            nox-session: test-pypy
+          - python-version: "3.x"
+            os: ubuntu-latest
+            experimental: false
+            nox-session: test_brotlipy
+          # Test CPython with a broken hostname_checks_common_name (the fix is in 3.9.3)
+          - python-version: "3.9.2"
+            os: ubuntu-20.04  # CPython 3.9.2 is not available for ubuntu-22.04.
+            experimental: false
+            nox-session: test-3.9
+          - python-version: "3.12-dev"
             experimental: true
+        exclude:
+          # Ubuntu 22.04 comes with OpenSSL 3.0, so only CPython 3.9+ is compatible with it
+          # https://github.com/python/cpython/issues/83001
+          - python-version: "3.7"
+            os: ubuntu-22.04
+          - python-version: "3.8"
+            os: ubuntu-22.04
+          # Testing with non-final CPython on macOS is too slow for CI.
+          - python-version: "3.12-dev"
+            os: macos-11
 
     runs-on: ${{ matrix.os }}
-    name: ${{ fromJson('{"macos-latest":"macOS","windows-latest":"Windows"}')[matrix.os] }} (${{ matrix.python-version }})
+    name: ${{ fromJson('{"macos-11":"macOS","windows-latest":"Windows","ubuntu-latest":"Ubuntu","ubuntu-20.04":"Ubuntu 20.04 (OpenSSL 1.1.1)","ubuntu-22.04":"Ubuntu 22.04 (OpenSSL 3.0)"}')[matrix.os] }} ${{ matrix.python-version }} ${{ matrix.nox-session}}
     continue-on-error: ${{ matrix.experimental }}
+    timeout-minutes: 30
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v2
+      - name: "Checkout repository"
+        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
 
-      - name: Set Up Python - ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+      - name: "Setup Python ${{ matrix.python-version }}"
+        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Set Up Python 3.7 to run nox
-        if: matrix.python-version != '3.7'
-        uses: actions/setup-python@v2
-        with:
-          python-version: 3.7
-
-      - name: Install Dependencies
-        run: python -m pip install --upgrade nox
+      - name: "Install dependencies"
+        run: python -m pip install --upgrade pip setuptools nox
 
-      - name: Run Tests
+      - name: "Run tests"
         run: ./ci/run_tests.sh
         env:
           PYTHON_VERSION: ${{ matrix.python-version }}
+          NOX_SESSION: ${{ matrix.nox-session }}
 
-      - name: Upload Coverage
-        run: ./ci/upload_coverage.sh
-        env:
-          JOB_NAME: "${{ runner.os }} (${{ matrix.python-version }})"
+      - name: "Upload artifact"
+        uses: "actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce"
+        with:
+          name: coverage-data
+          path: ".coverage.*"
+          if-no-files-found: error
+
+
+  coverage:
+    if: always()
+    runs-on: "ubuntu-latest"
+    needs: test
+    steps:
+      - name: "Checkout repository"
+        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
+
+      - name: "Setup Python"
+        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
+        with:
+          python-version: "3.x"
+
+      - name: "Install coverage"
+        run: "python -m pip install --upgrade coverage"
+
+      - name: "Download artifact"
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
+        with:
+          name: coverage-data
+
+      - name: "Combine & check coverage"
+        run: |
+          python -m coverage combine
+          python -m coverage html --skip-covered --skip-empty
+          python -m coverage report --ignore-errors --show-missing --fail-under=100
+
+      - if: ${{ failure() }}
+        name: "Upload report if check failed"
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+        with:
+          name: coverage-report
+          path: htmlcov

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 0 * * 5"
+
+permissions: "read-all"
+
+jobs:
+  analyze:
+    name: "Analyze"
+    runs-on: "ubuntu-latest"
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+    - name: "Checkout repository"
+      uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
+
+    - name: "Run CodeQL init"
+      uses: "github/codeql-action/init@b2c19fb9a2a485599ccf4ed5d65527d94bc57226"
+      with:
+        config-file: "./.github/codeql.yml"
+        languages: "python"
+
+    - name: "Run CodeQL autobuild"
+      uses: "github/codeql-action/autobuild@b2c19fb9a2a485599ccf4ed5d65527d94bc57226"
+
+    - name: "Run CodeQL analyze"
+      uses: "github/codeql-action/analyze@b2c19fb9a2a485599ccf4ed5d65527d94bc57226"

.github/workflows/integration.yml

@@ -0,0 +1,29 @@
+name: Downstream
+
+on: [push, pull_request]
+
+permissions: "read-all"
+
+jobs:
+  integration:
+    strategy:
+      fail-fast: false
+      matrix:
+        downstream: [botocore, requests]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - name: "Checkout repository"
+        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
+
+      - name: "Setup Python"
+        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
+        with:
+          python-version: "3.x"
+
+      - name: "Install dependencies"
+        run: python -m pip install --upgrade nox
+
+      - name: "Run downstream tests"
+        run: nox -s downstream_${{ matrix.downstream }}