A library mostly shouldn't apply version pinning when not exactly needed. Only applications usually do, and libraries should be able to cope with different up- and downstream-versions.
Considering that both runtime dependencies are stable on their own, this should not cause too many forseeable headaches. When urllib3 v3 will be released, it might be different, but honestly I can't imagine it will be breaking its designated interface too much, if at all.
About
A library mostly shouldn't apply version pinning when not exactly needed. Only applications usually do, and libraries should be able to cope with different up- and downstream-versions.
Considering that both runtime dependencies are stable on their own, this should not cause too many forseeable headaches. When urllib3 v3 will be released, it might be different, but honestly I can't imagine it will be breaking its designated interface too much, if at all.