Unpin urllib3 dependency

[trvachov]

Description

It seems there is a dependency pin for torchx to a specific version of urllib that was pinned ~3 years ago (https://github.com/pytorch/torchx/blob/4566149b5119af09a5d69ceb1b96fd2230f19ee0/requirements.txt#L9)

Motivation/Background

urllib3 is on version 2.x -- having this specific pin for torchx makes it difficult to co-install torchx with other packages.

Detailed Proposal

Unpin torchx, test it. Possibly modify APIs to be compatible with new urllib3 versions.

Alternatives

Additional context/links

[akuzminsky]

Friendly heads-up: torchx currently allows urllib3 versions only from 1.21.1 up to 1.27 - which sadly includes the GHSA-pq67-6m6q-mj2v vulnerability. Since that issue was patched in urllib3 2.5.0, it’s really important that torchx’s constraints be updated to support urllib3 >= 2.5.0

[benglewis]

@kiukchung Please can you take a look at this? 🙏 I see that the code has been changed, but no release of this package has been made since July 17 2024. Would it be possible to create a new release? I see that there have been quite a lot of changes since the v0.7.0 release. In the meantime, I guess that the workaround is to install directly from main from the git repository, but that is rather ugly and could be unstable...