fix!: bump urllib3, pytest, filelock and require Python 3.10+ (dependency vulnerability fixes)

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-05.
Change type: Major version bump — includes source/config changes to adapt to a breaking change.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
urllib3 (runtime)	pip	Minor (+ Python floor change)	>=2.1.0 → >=2.7.0	High	91d	Dependabot	GHSA-mf9v-mfxr-j63j, GHSA-qccp-gfcp-xxvc
pytest (dev)	pip	Major	>=7.2.1 → >=9.0.3	Medium	91d	Dependabot	GHSA-6w46-j5rx-g56g
filelock (dev, transitive via tox)	pip	Minor (new explicit floor)	unconstrained → >=3.20.3	Medium	91d	Dependabot	GHSA-w853-jp5j-5j7f, GHSA-qmgc-5h2g-mvrw

Breaking change for consumers (hence fix!:): every patched release above (urllib3 2.7.0, pytest 9.0.3, filelock 3.20.3) declares Requires-Python >=3.10, so the package's supported-Python floor is raised 3.9 → 3.10 (Python 3.9 is upstream EOL since Oct 2025):

• pyproject.toml requires-python and setup.py PYTHON_REQUIRES: >=3.9 → >=3.10
• .github/workflows/python.yml matrix: dropped 3.9
• README.md: "Python 3.9+" → "Python 3.10+"
• requirements.txt / test-requirements.txt / pyproject.toml dev group mirror the new floors (filelock >= 3.20.3 added explicitly).

The three findings are grouped in one PR because they all depend on the same Python-floor change; no library source code changed.

Generator note: these files are produced by openapi-generator from ld-openapi. Unless the generator config/templates there are updated to match (Python floor and dependency floors), the next automated release will regenerate and revert these lines — please mirror the change upstream.

Deferred / excluded findings

• None.

Verification

• Install: ✅ (pip install -r requirements.txt -r test-requirements.txt && pip install -e . + pip check on Python 3.10.20 and 3.12.13; resolved urllib3 2.8.0, pytest 9.1.1, filelock 4.0.11). Confirmed pip install on Python 3.9 is now rejected by Requires-Python, as intended.
• Build: ✅ (python -m build sdist + wheel)
• Tests: ✅ (pytest — 1059 passed on 3.10 and 3.12)
• Lint: ✅ (flake8 --select=E9,F63,F7,F82 — 0 issues; CI does not run a linter)

Link to Devin session: https://app.devin.ai/sessions/ddd296438c6848c387865a0135cc2558
Open in Devin Desktop: https://app.devin.ai/desktop/session/ddd296438c6848c387865a0135cc2558?variant=devin

---

Note

Overview
Raises the package’s minimum supported Python from 3.9 to 3.10 in pyproject.toml, setup.py, and the README, and drops Python 3.9 from the GitHub Actions test matrix.

Bumps runtime urllib3 to >=2.7.0 and dev dependencies to pytest >=9.0.3 and an explicit filelock >=3.20.3, mirrored in requirements.txt, test-requirements.txt, and Poetry dev deps. No client library source changes—only packaging, docs, and CI.

^{Reviewed by Cursor Bugbot for commit ce3a3ef. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring