Please do not push this update out to stable! pymongo version 3 is not backwards compatible and will break its dependent packages! Also, the CVE this addresses is extremely low impact and is highly unlikely to happen in the real world as CAs do not issue certificates like this. If we want to fix the CVE, the correct thing to do is to backport a patch, not to raise the version in a way that breaks dependencies.

Per the update policy, under the "Philosophy" section, "Releases of the Fedora distribution are like releases of the individual packages that compose it. A major version number reflects a more-or-less stable set of features and functionality. As a result, we should avoid major updates of packages within a stable release. Updates should aim to fix bugs, and not introduce features, particularly when those features would materially affect the user or developer experience. The update rate for any given release should drop off over time, approaching zero near release end-of-life; since updates are primarily bugfixes, fewer and fewer should be needed over time." https://fedoraproject.org/wiki/Updates_Policy This is a major version update of the package, breaking backwards compatibility with the previous major version. I suggest finding an alternate solution. It is already noted here that this will break functionality for one package (Pulp)