[Security] Bump urllib3 from 1.26.3 to 1.26.4
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 1fa93bf18e..99014e9400 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -121,7 +121,7 @@ toml==0.10.2
     #   tox
 tox==3.22.0
     # via -r requirements/dev.in
-urllib3==1.26.3
+urllib3==1.26.4
     # via requests
 virtualenv==20.4.2
     # via
diff --git a/requirements/docs.txt b/requirements/docs.txt
index d986bacebc..08d3bcb081 100644
--- a/requirements/docs.txt
+++ b/requirements/docs.txt
@@ -66,7 +66,7 @@ sphinxcontrib-qthelp==1.0.3
     # via sphinx
 sphinxcontrib-serializinghtml==1.1.4
     # via sphinx
-urllib3==1.26.3
+urllib3==1.26.4
     # via requests
 
 # The following packages are considered to be unsafe in a requirements file:

Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.3 to 1.26.4. **This update includes a security fix.**
<details>
<summary>Vulnerabilities fixed</summary>
<p><em>Sourced from <a href="https://github.com/advisories/GHSA-5phf-pp7p-vc2r">The GitHub Security Advisory Database</a>.</em></p>
<blockquote>
<p><strong>Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection</strong></p>
<h3>Impact</h3>
<p>Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via <code>proxy_config</code>.
Only the default SSLContext is impacted.</p>
<h3>Patches</h3>
<p><a href="https://github.com/urllib3/urllib3/releases/tag/1.26.4">urllib3 &gt;=1.26.4 has the issue resolved</a>. urllib3&lt;1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.</p>
<h3>Workarounds</h3>
<p>Upgrading is recommended as this is a minor release and not likely to break current usage.</p>
<p>Configuring an <code>SSLContext</code> with <code>check_hostname=True</code> and passing via <code>proxy_config</code> instead of relying on the default <code>SSLContext</code></p>
<h3>For more information</h3>
<p>If you have any questions or comments about this advisory:</p>
<ul>
<li>Email us at <a href="mailto:sethmichaellarson@gmail.com">sethmichaellarson@gmail.com</a></li>
</ul>
<p>Affected versions: &gt;= 1.26.0, &lt;= 1.26.3</p>
</blockquote>
</details>
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p>
<blockquote>
<h2>1.26.4</h2>
<p>:warning: <strong>IMPORTANT: urllib3 v2.0 will drop support for Python 2</strong>: <a href="https://urllib3.readthedocs.io/en/latest/v2-roadmap.html">Read more in the v2.0 Roadmap</a></p>
<ul>
<li>Changed behavior of the default <code>SSLContext</code> when connecting to HTTPS proxy during HTTPS requests. The default <code>SSLContext</code> now sets <code>check_hostname=True</code>.</li>
</ul>
<p><strong>If you or your organization rely on urllib3 consider supporting us via <a href="https://github.com/sponsors/urllib3">GitHub Sponsors</a></strong></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p>
<blockquote>
<h1>1.26.4 (2021-03-15)</h1>
<ul>
<li>Changed behavior of the default <code>SSLContext</code> when connecting to HTTPS proxy during HTTPS requests. The default <code>SSLContext</code> now sets <code>check_hostname=True</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/urllib3/urllib3/commit/a8913042b676c510e94fc2b097f6b514ae11a537"><code>a891304</code></a> Release 1.26.4</li>
<li><a href="https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"><code>8d65ea1</code></a> Merge pull request from GHSA-5phf-pp7p-vc2r</li>
<li><a href="https://github.com/urllib3/urllib3/commit/5e3432646ad63749ff0d655c157fe293cdc6c2aa"><code>5e34326</code></a> Add proper stacklevel to method_allowlist warning</li>
<li>See full diff in <a href="https://github.com/urllib3/urllib3/compare/1.26.3...1.26.4">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=1.26.3&new-version=1.26.4)](https://dependabot.com/compatibility-score/?dependency-name=urllib3&package-manager=pip&previous-version=1.26.3&new-version=1.26.4)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
If all status checks pass Dependabot will automatically merge this pull request.

[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)



</details>