diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6f5d5b..2dce532 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+# 3.3.5
+  * Bump requests to 2.33.0 (CVE-2026-25645)
+
 # 3.3.4
   * Fix malformed URL causing 'since' filter to be dropped for Issues and Comments streams [#230](https://github.com/singer-io/tap-github/pull/230)
 
diff --git a/setup.py b/setup.py
index 9948a3e..49a4429 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 from setuptools import setup, find_packages
 
 setup(name='tap-github',
-      version='3.3.4',
+      version='3.3.5',
       description='Singer.io tap for extracting data from the GitHub API',
       author='Stitch',
       url='http://singer.io',
@@ -12,7 +12,7 @@
       install_requires=[
           'singer-python==5.12.1',
           'requests==2.33.0',
-          'backoff==1.8.0'
+          'backoff==1.10.0'
       ],
       extras_require={
           'dev': [