internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: urllib3/urllib3

Issue:
urllib3 logo is unreadable in docs in dark mode
This is a recent Furo addition, you can see it in this pull request build: https://urllib3--2026.org.readthedocs.build/en/2026/index.html. Here's what I see (with Firefox on macOS with dark mode enabled):

<img width="237" alt="urllib3 logo in dark mode in docs" src="https://user-images.githubusercontent.com/42327/96408490-ad2c8300-11f4-11eb-8054-661fb38a6c23.png">

I'm not sure what the correct fix is here. The obvious one would be to force a white background. I guess we could also... add a dark mode urllib3 logo, by switching black letters to white?

(The rest of the content looks good, even if the contrast seems low to me.)


Discussion:
Looks like this is supported by Furo now: https://github.com/pradyunsg/furo/issues/27
There's a release containing the support now.

> if the contrast seems low to me.

Is this for the content? The contrast on the sidebar is intentionally lower -- otherwise it was distracting for me while I was designing this.


Resolving patch:
diff --git a/docs/conf.py b/docs/conf.py
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -73,8 +73,8 @@ def __getattr__(cls, name):
 # a list of builtin themes.
 html_theme = "furo"
 html_favicon = "images/favicon.png"
-html_logo = "images/banner.svg"
 
+html_static_path = ["_static"]
 html_theme_options = {
     "announcement": """
         <a style=\"text-decoration: none; color: white;\" 
@@ -83,6 +83,8 @@ def __getattr__(cls, name):
         </a>
     """,
     "sidebar_hide_name": True,
+    "light_logo": "banner.svg",
+    "dark_logo": "dark-logo.svg",
 }
 
 intersphinx_mapping = {"python": ("https://docs.python.org/3", None)}


Test patch:
Repository: urllib3/urllib3

Issue:
Broken import for HTTPHeaderDict in 1.26.0
### Subject

[Responses](https://github.com/getsentry/responses) has historically used `from urllib3.connection import HTTPHeaderDict` but that import is now failing in 1.26.0. Looking through the history this was changed as part of #2018  

This change wasn't in the release notes and seems like an accidental regression. Is there a more stable package we should be importing HTTPHeaderDict from?

### Environment

Describe your environment.

* Using `responses` and `urllib>=1.25.10`

### Steps to Reproduce

```python
from urllib3.connection import HTTPHeaderDict
```

### Expected Behavior

This import has worked for at least the past year.

### Actual Behavior

An import error is raised.

Refs getsentry/responses#354



Discussion:
> Is there a more stable package we should be importing HTTPHeaderDict from?

This passive aggressive tact is unnecessary.
`HTTPHeaderDict` isn't *supposed* to be a public class (hence being defined in `_collections`). The import of `HTTPHeaderDict` in `urllib3.response` is likely more stable but there aren't any guarantees there either.

Resolving patch:
diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py
--- a/src/urllib3/connection.py
+++ b/src/urllib3/connection.py
@@ -43,6 +43,7 @@ class BrokenPipeError(Exception):
         pass
 
 
+from ._collections import HTTPHeaderDict  # noqa (historical, removed in v2)
 from ._version import __version__
 from .exceptions import (
     ConnectTimeoutError,


Test patch:
Repository: urllib3/urllib3

Issue:
v.1.26+ doesn't support  SSL in python 2.7.6
### Subject

Describe the issue here.
It errors out `An HTTP Client raised an unhandled exception: global name 'wrap_socket' is not defined`

### Environment

Describe your environment.
At least, paste here the output of:

```python
import platform
import urllib3

print("OS", platform.platform())
print("Python", platform.python_version())
print("urllib3", urllib3.__version__)
```
Python/2.7.6 botocore/1.19.16 Linux/4.4.0-96-generic


### Steps to Reproduce

A simple and isolated way to reproduce the issue. A code snippet would be great.

I'm calling from latest aws cli which uses urllib3 1.26.1

`aws dynamodb list-tables`

### Expected Behavior

No errors

### Actual Behavior

It errors out `An HTTP Client raised an unhandled exception: global name 'wrap_socket' is not defined`

You may attach logs, packet captures, etc.



Discussion:
I'm able to reproduce this issue, will get a fix in and ship 1.26.2 soon.

Resolving patch:
diff --git a/src/urllib3/util/ssl_.py b/src/urllib3/util/ssl_.py
--- a/src/urllib3/util/ssl_.py
+++ b/src/urllib3/util/ssl_.py
@@ -44,13 +44,21 @@ def _const_compare_digest_backport(a, b):
 
 try:  # Test for SSL features
     import ssl
-    from ssl import HAS_SNI  # Has SNI?
     from ssl import CERT_REQUIRED, wrap_socket
+except ImportError:
+    pass
+
+try:
+    from ssl import HAS_SNI  # Has SNI?
+except ImportError:
+    pass
 
+try:
     from .ssltransport import SSLTransport
 except ImportError:
     pass
 
+
 try:  # Platform-specific: Python 3.6
     from ssl import PROTOCOL_TLS
 


Test patch:
Repository: urllib3/urllib3

Issue:
[v2] Detect unsupported Python versions and raise a helpful ImportError
We'll need to ensure our `urllib3/__init__.py` is still Python 2.x compatible for early urllib3 v2.x releases. If we detect an unsupported Python version we raise a helpful error message recommending pinning to `urllib3<2`


Discussion:
Is the reasoning is that we're catering for users that still don't use pip 9+, released four years ago in November 2016? When should we be allowed to only rely on `python_requires`?

By the way, https://python3statement.org/practicalities/ is an interesting documentation about this issue, and here is what Django does: https://github.com/django/django/blob/3.1.3/setup.py#L7-L33
@pquentin Yeah for old pip installs, still a good amount of them out there. 

Nice find! Yeah something exactly like Django would be great :)

Resolving patch:
diff --git a/noxfile.py b/noxfile.py
--- a/noxfile.py
+++ b/noxfile.py
@@ -70,6 +70,20 @@ def test(session):
     tests_impl(session)
 
 
+@nox.session(python=["2.7"])
+def unsupported_python2(session):
+    # Can't check both returncode and output with session.run
+    process = subprocess.run(
+        ["python", "setup.py", "install"],
+        env={**session.env},
+        text=True,
+        capture_output=True,
+    )
+    assert process.returncode == 1
+    print(process.stderr)
+    assert "Unsupported Python version" in process.stderr
+
+
 @nox.session(python=["3"])
 def google_brotli(session):
     # https://pypi.org/project/Brotli/ is the Google version of brotli, so
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -4,9 +4,38 @@
 import codecs
 import os
 import re
+import sys
 
 from setuptools import setup
 
+CURRENT_PYTHON = sys.version_info[:2]
+REQUIRED_PYTHON = (3, 6)
+
+# This check and everything above must remain compatible with Python 2.7.
+if CURRENT_PYTHON < REQUIRED_PYTHON:
+    sys.stderr.write(
+        """
+==========================
+Unsupported Python version
+==========================
+This version of urllib3 requires Python {}.{}, but you're trying to
+install it on Python {}.{}.
+This may be because you are using a version of pip that doesn't
+understand the python_requires classifier. Make sure you
+have pip >= 9.0 and setuptools >= 24.2, then try again:
+    $ python -m pip install --upgrade pip setuptools
+    $ python -m pip install urllib3
+This will install the latest version of urllib3 which works on your
+version of Python. If you can't upgrade your pip (or Python), request
+an older version of urllib3:
+    $ python -m pip install "urllib3<2"
+""".format(
+            *(REQUIRED_PYTHON + CURRENT_PYTHON)
+        )
+    )
+    sys.exit(1)
+
+
 base_path = os.path.dirname(__file__)
 
 # Get the version (borrowed from SQLAlchemy)


Test patch:
Repository: urllib3/urllib3

Issue:
[v2] Remove _const_compare_digest() in favor of hmac.compare_digest()
Within `urllib3.util.ssl_` we previously needed to backport `hmac.compare_digest()`, this is no longer the case in Python 3.6+


Discussion:

Resolving patch:
diff --git a/src/urllib3/util/ssl_.py b/src/urllib3/util/ssl_.py
--- a/src/urllib3/util/ssl_.py
+++ b/src/urllib3/util/ssl_.py
@@ -19,21 +19,6 @@
 HASHFUNC_MAP = {32: md5, 40: sha1, 64: sha256}
 
 
-def _const_compare_digest_backport(a, b):
-    """
-    Compare two digests of equal length in constant time.
-
-    The digests must be of type str/bytes.
-    Returns True if the digests match, and False otherwise.
-    """
-    result = abs(len(a) - len(b))
-    for left, right in zip(bytearray(a), bytearray(b)):
-        result |= left ^ right
-    return result == 0
-
-
-_const_compare_digest = getattr(hmac, "compare_digest", _const_compare_digest_backport)
-
 try:  # Do we have ssl at all?
     import ssl
     from ssl import (
@@ -115,7 +100,7 @@ def assert_fingerprint(cert, fingerprint):
 
     cert_digest = hashfunc(cert).digest()
 
-    if not _const_compare_digest(cert_digest, fingerprint_bytes):
+    if not hmac.compare_digest(cert_digest, fingerprint_bytes):
         raise SSLError(
             f'Fingerprints did not match. Expected "{fingerprint}", got "{hexlify(cert_digest)}".'
         )


Test patch:
diff --git a/test/test_util.py b/test/test_util.py
--- a/test/test_util.py
+++ b/test/test_util.py
@@ -1,4 +1,3 @@
-import hashlib
 import io
 import logging
 import socket
@@ -24,12 +23,7 @@
 from urllib3.util.proxy import connection_requires_http_tunnel, create_proxy_ssl_context
 from urllib3.util.request import _FAILEDTELL, make_headers, rewind_body
 from urllib3.util.response import assert_header_parsing
-from urllib3.util.ssl_ import (
-    _const_compare_digest_backport,
-    resolve_cert_reqs,
-    resolve_ssl_version,
-    ssl_wrap_socket,
-)
+from urllib3.util.ssl_ import resolve_cert_reqs, resolve_ssl_version, ssl_wrap_socket
 from urllib3.util.timeout import Timeout
 from urllib3.util.url import Url, get_host, parse_url, split_first
 from urllib3.util.util import to_bytes, to_str
@@ -669,19 +663,6 @@ class NotReallyAFile:
         with pytest.raises(ValueError):
             is_fp_closed(NotReallyAFile())
 
-    def test_const_compare_digest_fallback(self):
-        target = hashlib.sha256(b"abcdef").digest()
-        assert _const_compare_digest_backport(target, target)
-
-        prefix = target[:-1]
-        assert not _const_compare_digest_backport(target, prefix)
-
-        suffix = target + b"0"
-        assert not _const_compare_digest_backport(target, suffix)
-
-        incorrect = hashlib.sha256(b"xyz").digest()
-        assert not _const_compare_digest_backport(target, incorrect)
-
     def test_has_ipv6_disabled_on_compile(self):
         with patch("socket.has_ipv6", False):
             assert not _has_ipv6("::1")
Repository: urllib3/urllib3

Issue:
pyopenssl.py should explictly bubble up errno from OpenSSL.SSL.SysCallError
### Context

Several spots in pyopenssl catch OpenSSL.SSL.SysCallError and then reraise the exception as SocketError (an alias for socket.error).

Example code:

https://github.com/urllib3/urllib3/blob/83652e0fe9113fbe35f7c34ee71c2f7ed268c5f9/src/urllib3/contrib/pyopenssl.py#L278-L282

`raise SocketError(str(e))` passes all the information about the underlying exception as a string.  The string includes the underlying `errno`.  There's an opportunity to explicitly include the `errno` in the re-raised exception.  Libraries that use urllib3 can then extract the errno if it's present.

### Alternatives

No obvious alternatives.

### Contribution

Would you be willing to submit a PR?  Yes, a PR is forthcoming.


Discussion:

Resolving patch:
diff --git a/src/urllib3/contrib/pyopenssl.py b/src/urllib3/contrib/pyopenssl.py
--- a/src/urllib3/contrib/pyopenssl.py
+++ b/src/urllib3/contrib/pyopenssl.py
@@ -279,7 +279,7 @@ def recv(self, *args, **kwargs):
             if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):
                 return b""
             else:
-                raise SocketError(str(e))
+                raise SocketError(e.args[0], str(e))
         except OpenSSL.SSL.ZeroReturnError:
             if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:
                 return b""
@@ -304,7 +304,7 @@ def recv_into(self, *args, **kwargs):
             if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):
                 return 0
             else:
-                raise SocketError(str(e))
+                raise SocketError(e.args[0], str(e))
         except OpenSSL.SSL.ZeroReturnError:
             if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:
                 return 0
@@ -332,7 +332,7 @@ def _send_until_done(self, data):
                     raise timeout()
                 continue
             except OpenSSL.SSL.SysCallError as e:
-                raise SocketError(str(e))
+                raise SocketError(e.args[0], str(e))
 
     def sendall(self, data):
         total_sent = 0


Test patch:
Repository: urllib3/urllib3

Issue:
is_connection_dropped checks against None but uses False as default value for getattr
I happened to read this line and the code looks fishy. I did not otherwise verify the potential bug.

See implementation of `is_connection_dropped(conn: socket.socket) -> bool`:

https://github.com/urllib3/urllib3/blob/287052a16a59bcaba5772387de36fa9a49eb8378/src/urllib3/util/connection.py#L19-L23

If there is no property `sock` on `conn`, then we will call `wait_for_read(False, timeout=0.0)`, which e.g. may end up putting the `False` into the iterable passed to `select`.

Since this seemed to never have caused problems, the `sock = getattr(conn, "sock", False)` can probably be replaced with just `sock = conn.sock`.

Alternatives would be to replace the default (last argument of `getattr`) of `False` with `None` or replace the `if sock is None` with `if not sock`.


Discussion:
Great catch, luckily this doesn't effect any released version as 1.26.x series has the [proper handling of `conn` without `sock`](https://github.com/urllib3/urllib3/blob/1.26.x/src/urllib3/util/connection.py).

Would you be willing to submit a PR changing `False` to `None`?

Resolving patch:
diff --git a/src/urllib3/util/connection.py b/src/urllib3/util/connection.py
--- a/src/urllib3/util/connection.py
+++ b/src/urllib3/util/connection.py
@@ -16,7 +16,7 @@ def is_connection_dropped(conn: socket.socket) -> bool:  # Platform-specific
     :param conn:
         :class:`http.client.HTTPConnection` object.
     """
-    sock = getattr(conn, "sock", False)
+    sock = getattr(conn, "sock", None)
     if sock is None:  # Connection already closed (such as by httplib).
         return True
     # Returns True if readable, which here means it's been dropped


Test patch:
Repository: urllib3/urllib3

Issue:
Misleading deprecation warning in 1.26.X
### Subject

While using `Retry.DEFAULT_METHOD_WHITELIST` warning message asks to use `Retry.DEFAULT_METHODS_ALLOWED` which does not exist. The proper attribute name is `DEFAULT_ALLOWED_METHODS`.

### Environment

Issue seems to be platform-agnostic.

OS macOS-10.15.7-x86_64-i386-64bit
Python 3.9.0
urllib3 1.26.5

### Steps to Reproduce

```
import warnings
from urllib3.util import Retry


with warnings.catch_warnings(record=True) as w:
    warnings.simplefilter("always")
    Retry.DEFAULT_METHOD_WHITELIST
    print(w[0].message)
    Retry.DEFAULT_METHODS_ALLOWED

```

output:

```
Using 'Retry.DEFAULT_METHOD_WHITELIST' is deprecated and will be removed in v2.0. Use 'Retry.DEFAULT_METHODS_ALLOWED' instead
Traceback (most recent call last):
  File "[...]test.py", line 9, in <module>
    Retry.DEFAULT_METHODS_ALLOWED
AttributeError: type object 'Retry' has no attribute 'DEFAULT_METHODS_ALLOWED'
```

### Expected Behavior

Message should mention `Retry.DEFAULT_ALLOWED_METHODS` instead of `Retry.DEFAULT_METHODS_ALLOWED` (swapped `ALLOWED` and `METHODS` words)

### Actual Behavior

Warning message mentions `Retry.DEFAULT_METHODS_ALLOWED` which does not exist.



Discussion:

Resolving patch:
diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py
--- a/src/urllib3/util/retry.py
+++ b/src/urllib3/util/retry.py
@@ -37,7 +37,7 @@ class _RetryMeta(type):
     def DEFAULT_METHOD_WHITELIST(cls):
         warnings.warn(
             "Using 'Retry.DEFAULT_METHOD_WHITELIST' is deprecated and "
-            "will be removed in v2.0. Use 'Retry.DEFAULT_METHODS_ALLOWED' instead",
+            "will be removed in v2.0. Use 'Retry.DEFAULT_ALLOWED_METHODS' instead",
             DeprecationWarning,
         )
         return cls.DEFAULT_ALLOWED_METHODS


Test patch:
Repository: urllib3/urllib3

Issue:
Deprecate NTLMConnectionPool in 1.26.x
As was mentioned in https://github.com/urllib3/urllib3/pull/2278#issuecomment-864414599 and https://github.com/urllib3/urllib3/pull/2278#issuecomment-864450016 we're moving to remove `NTLMConnectionPool` and the `urllib3.contrib.nltmpool` module from urllib3 in v2.0 if we don't find a new maintainer for the module (perhaps as a third-party package ie `urllib3-ntlmpool`?)

- The module is not covered by our test suite.
- It is not clear even which pypi package is needed for it.
- It has fallen into disrepair (e.g. timeout/ssl/other options not being respected).
- According to Wikipedia, "Since 2010, Microsoft no longer recommends NTLM in applications"
- Seems like it's not used often, if at all.

In the `1.26.x` branch we should unconditionally raise a `DeprecationWarning` when the module is imported. Should link to this issue with a call to action to comment in the issue if they are a user. This should help us better discover who (if any) our users are here so we can better make a decision.


Discussion:
I will try to work on this. 
Sounds good @imkaka, let me know if you have questions.

Resolving patch:
diff --git a/src/urllib3/contrib/ntlmpool.py b/src/urllib3/contrib/ntlmpool.py
--- a/src/urllib3/contrib/ntlmpool.py
+++ b/src/urllib3/contrib/ntlmpool.py
@@ -5,6 +5,7 @@
 """
 from __future__ import absolute_import
 
+import warnings
 from logging import getLogger
 
 from ntlm import ntlm
@@ -12,6 +13,14 @@
 from .. import HTTPSConnectionPool
 from ..packages.six.moves.http_client import HTTPSConnection
 
+warnings.warn(
+    "The 'urllib3.contrib.ntlmpool' module is deprecated and will be removed "
+    "in urllib3 v2.0 release, urllib3 is not able to support it properly due "
+    "to reasons listed in issue: https://github.com/urllib3/urllib3/issues/2282. "
+    "If you are a user of this module please comment in the mentioned issue.",
+    DeprecationWarning,
+)
+
 log = getLogger(__name__)
 
 


Test patch:
Repository: urllib3/urllib3

Issue:
Add decode_content parameter to top-level APIs
Like the title says, add `decode_content` to the top-level APIs `urllib3.request()`.

See https://github.com/urllib3/urllib3/commit/ddf7361ac0467431a2f3df6ba346c9c506c29d56 for an example.


Discussion:
I will work on this. What is the functionality of this parameter ?
The functionality is already implemented, only needs to be forwarded to the lower levels.
@V1NAY8 please let me know if you are working on this, else I will love to work on this.
@imkaka go ahead and implement it. I'll pick something else.
Cool @V1NAY8, will start on this.

Resolving patch:
diff --git a/src/urllib3/__init__.py b/src/urllib3/__init__.py
--- a/src/urllib3/__init__.py
+++ b/src/urllib3/__init__.py
@@ -96,6 +96,7 @@ def request(
     fields: Optional[_TYPE_FIELDS] = None,
     headers: Optional[Mapping[str, str]] = None,
     preload_content: Optional[bool] = True,
+    decode_content: Optional[bool] = True,
     redirect: Optional[bool] = True,
     retries: Optional[Union[Retry, bool, int]] = None,
     timeout: Optional[Union[Timeout, float, int]] = 3,
@@ -114,6 +115,7 @@ def request(
         fields=fields,
         headers=headers,
         preload_content=preload_content,
+        decode_content=decode_content,
         redirect=redirect,
         retries=retries,
         timeout=timeout,


Test patch:
diff --git a/test/with_dummyserver/test_poolmanager.py b/test/with_dummyserver/test_poolmanager.py
--- a/test/with_dummyserver/test_poolmanager.py
+++ b/test/with_dummyserver/test_poolmanager.py
@@ -1,3 +1,4 @@
+import gzip
 import json
 from test import LONG_TIMEOUT
 from unittest import mock
@@ -424,6 +425,25 @@ def test_top_level_request_with_preload_content(self):
         r.data
         assert r.connection is None
 
+    def test_top_level_request_with_decode_content(self):
+        r = request(
+            "GET",
+            f"{self.base_url}/encodingrequest",
+            headers={"accept-encoding": "gzip"},
+            decode_content=False,
+        )
+        assert r.status == 200
+        assert gzip.decompress(r.data) == b"hello, world!"
+
+        r = request(
+            "GET",
+            f"{self.base_url}/encodingrequest",
+            headers={"accept-encoding": "gzip"},
+            decode_content=True,
+        )
+        assert r.status == 200
+        assert r.data == b"hello, world!"
+
     def test_top_level_request_with_redirect(self):
         r = request(
             "GET",
@@ -466,6 +486,7 @@ def test_top_level_request_with_timeout(self):
                 fields=None,
                 headers=None,
                 preload_content=True,
+                decode_content=True,
                 redirect=True,
                 retries=None,
                 timeout=2.5,
Repository: urllib3/urllib3

Issue:
Possible bug in securetransport _cert_array_from_pem() error handling
While working on an unrelated change, I noticed this line, which *seems* to miss a `raise` after the free in the `except` block. I may be wrong; I didn't try at all to understand what the code does, it just looks wrong to me so thought I'd report it.

https://github.com/urllib3/urllib3/blob/21945b84b0707a3143b09ade5c59e8dbf6a69a0f/src/urllib3/contrib/_securetransport/low_level.py#L186-L206


Discussion:
Ahh, I think we're missing `raise` in there to re-reaise the exception raised in the `try`-block. Good catch
OK, I'll send a PR.

Resolving patch:
diff --git a/src/urllib3/contrib/_securetransport/low_level.py b/src/urllib3/contrib/_securetransport/low_level.py
--- a/src/urllib3/contrib/_securetransport/low_level.py
+++ b/src/urllib3/contrib/_securetransport/low_level.py
@@ -202,6 +202,7 @@ def _cert_array_from_pem(pem_bundle: bytes) -> CFArray:
         # We only want to do that if an error occurs: otherwise, the caller
         # should free.
         CoreFoundation.CFRelease(cert_array)
+        raise
 
     return cert_array
 


Test patch:
diff --git a/test/contrib/test_securetransport.py b/test/contrib/test_securetransport.py
--- a/test/contrib/test_securetransport.py
+++ b/test/contrib/test_securetransport.py
@@ -1,3 +1,4 @@
+import base64
 import contextlib
 import socket
 import ssl
@@ -51,3 +52,15 @@ def test_no_crash_with_empty_trust_bundle():
         ws = WrappedSocket(s)
         with pytest.raises(ssl.SSLError):
             ws._custom_validate(True, b"")
+
+
+def test_no_crash_with_invalid_trust_bundle():
+    invalid_cert = base64.b64encode(b"invalid-cert")
+    cert_bundle = (
+        b"-----BEGIN CERTIFICATE-----\n" + invalid_cert + b"\n-----END CERTIFICATE-----"
+    )
+
+    with contextlib.closing(socket.socket()) as s:
+        ws = WrappedSocket(s)
+        with pytest.raises(ssl.SSLError):
+            ws._custom_validate(True, cert_bundle)