Repository navigation
_GzipDecoder.decompress() incompatible with urllib3 2.6.x (missing max_length parameter) #16043
Description
Summary
google-resumable-media defines a _GzipDecoder subclass of urllib3.response.GzipDecoder in google/resumable_media/requests/download.py (line 655). This subclass overrides decompress() with a signature that only accepts data:
class _GzipDecoder(urllib3.response.GzipDecoder):
def decompress(self, data):
self._checksum.update(data)
return super().decompress(data)urllib3 2.6.0 (CVE-2025-66471) added a max_length parameter to GzipDecoder.decompress() and BaseHTTPResponse._decode() now calls self._decoder.decompress(data, max_length=max_length).
Because _GzipDecoder.decompress() doesn't accept max_length, this raises:
TypeError: _GzipDecoder.decompress() got an unexpected keyword argument 'max_length'
Reproduction
Install google-resumable-media==2.8.0 with urllib3>=2.6.0 and download a gzip-encoded blob from GCS using google-cloud-storage.
Suggested fix
Update _GzipDecoder.decompress() (and _BrotliDecoder if applicable) to forward additional keyword arguments:
def decompress(self, data, **kwargs):
self._checksum.update(data)
return super().decompress(data, **kwargs)Versions
google-resumable-media==2.8.0urllib3>=2.6.0(tested with 2.6.3)google-cloud-storage==2.19.0- Python 3.12
Activity
parthea commentedon Mar 6, 2026
Thanks for reporting this issue. I'm going to migrate this to google-cloud-python as we are in the process of migrating the code for
google-resumable-mediathere.Leolebleis commentedon Mar 6, 2026
Thank you! I just noticed that the fix is already merged in both the old repo and the monorepo, but no release has been cut since v2.8.0. Any timeline for a new release?
daniel-sanche commentedon Mar 6, 2026
The monorepo is released every Thursday. so now that it's moved over, you can expect the next release on the 12th
daniel-sanche commentedon Mar 6, 2026
I think we can close this out if the code for the fix is merged, but feel free to re-open if you still see the issue
christhegrand commentedon Apr 1, 2026
Was a fix for this released, and if so which version was it fixed in?
parthea commentedon Apr 1, 2026
According to the links below,
google-resumable-media >= 2.8.1has the fixhttps://pypi.org/project/google-resumable-media/2.8.0/
https://github.com/googleapis/google-cloud-python/blob/google-resumable-media-v2.8.0/packages/google-resumable-media/google/resumable_media/requests/download.py#L670-L680
https://pypi.org/project/google-resumable-media/2.8.1
https://github.com/googleapis/google-cloud-python/blob/google-resumable-media-v2.8.1/packages/google-resumable-media/google/resumable_media/requests/download.py#L670-L685
https://pypi.org/project/google-resumable-media/2.8.2
https://github.com/googleapis/google-cloud-python/blob/google-resumable-media-v2.8.2/packages/google-resumable-media/google/resumable_media/requests/download.py#L670-L685
christhegrand commentedon Apr 1, 2026
Thank you! We're unfortunately dealing with a production issue caused by this right now and are upgrading to the new version of the library.