DeprecationWarning in api_client and rest: `getheader` and `getheaders`

[sshishov]

Hi dear Xero team,

We are receiving the following warning from your codebase:

DeprecationWarning: HTTPResponse.getheaders() is deprecated and will be removed in urllib3 v2.6.0.
Instead access HTTPResponse.headers directly.

I have noticed the usage in files:

• rest.py:48: return self.urllib3_response.getheaders()
• rest.py:52: return self.urllib3_response.getheader(name, default)
• api_client/__init__.py:221: return (return_data, response_data.status, response_data.getheaders())
• api_client/__init__.py:604: content_disposition = response.getheader("Content-Disposition")
• exceptions/__init__.py:38: return self.http_resp.getheaders() if self.http_resp else None

For being able to upgrade urllib3 it is very important to keep the codebase up-to-date. Could you please fix the issue.

Best regards,
Sergei

[github-actions]

PETOSS-791

[github-actions]

Thanks for raising an issue, a ticket has been created to track your request

[sshishov]

How to see the progress? Any updates here?

[ton77v]

urllib3 v2.5.0 has vulnerability that's fixed upgrading to 2.6.0

Unfortunately, this breaks xero-python functionality because of using methods in question.

[golankopi]

any progress? this breaks xero-python functionality and blocks to a urllib3 version with vulnerabilities

[joe-niland]

urllib3 should also be version pinned in requirements.txt to avoid version conflicts in projects consuming this one

[hiselitelordship]

This is breaking deployments and requiring workarounds because it has now been removed in https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#260-2025-12-05 . Any update?