Release v3.6.1: patched certifi, uv and virtualenv; require certifi>=2026.10.19 (#120)

* chore(release): 3.6.1 with patched certifi, uv and virtualenv

Cut a release that ships the Dependabot security bumps merged since 3.6.0
(#112, #116, #117, #118, #119).

The release build toolchain in setup-hatch still pinned virtualenv 21.7.13
and hatchling 1.32.0, because Dependabot updates uv.lock but not the pip
pins inside the composite action. Sync them to the locked virtualenv
21.14.7 and the [build-system] hatchling 1.32.4 so published artifacts are
built with the patched versions.

* Require certifi>=2026.10.19

requests takes its CA bundle from certifi, and socketdev didn't constrain
it, so pip could leave consumers on a bundle that trusts the compromised
eMudhra intermediate CAs. A floor rather than an exact pin, so later
trust-store fixes still reach them.

Author: lelia

.github/actions/setup-hatch/action.yml

@@ -9,4 +9,4 @@ runs:
     - shell: bash
       run: |
         python -m pip install --upgrade pip
-        python -m pip install "hatch==1.18.1" "hatchling==1.32.0" "virtualenv==21.7.13"
+        python -m pip install "hatch==1.18.1" "hatchling==1.32.4" "virtualenv==21.14.7"

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 3.6.1
+
+### Security: patched releases of certifi, uv and virtualenv
+
+- Updated the locked versions of `certifi` (2025.11.12 → 2026.10.19), `uv`
+  (0.11.17 → 0.13.4) and `virtualenv` (20.36.1 → 21.14.7) to pick up fixes for
+  critical vulnerabilities. These versions are pinned in `uv.lock`, which
+  controls the development and CI environment.
+- socketdev now requires `certifi>=2026.10.19`, so installing it also upgrades
+  the CA bundle `requests` uses. Older bundles trust the compromised eMudhra
+  intermediate CAs.
+- The release build toolchain (`.github/actions/setup-hatch`) now installs
+  `virtualenv==21.14.7` and `hatchling==1.32.4`, matching `uv.lock` and the
+  `[build-system]` pin. Published artifacts are built with the patched versions.
+- Raised the `requests` floor to `>=2.33.0`.
+
+### Changed: Python 3.10 or newer is required
+
+- `requires-python` is now `>=3.10` (previously `>=3.9`). The patched
+  dependency releases no longer support Python 3.9, which reached end of life
+  in October 2025. On Python 3.9, pip continues to resolve socketdev 3.6.0.
+
+### Maintenance
+
+- Pinned the `hatchling` build backend to 1.32.4 and capped built
+  distributions at core metadata 2.4 so the locked Twine can validate them.
+- Raised the dev and test extras floors to `hatch>=1.18.1` and
+  `pytest>=9.0.3`.
+
 ## 3.6.0
 
 ### Changed: every API-sourced enum now tolerates unknown values

pyproject.toml

@@ -8,7 +8,10 @@ dynamic = ["version"]
 requires-python = ">= 3.10"
 dependencies = [
     'requests>=2.33.0,<3',
-    'typing-extensions>=4.12.2,<5'
+    'typing-extensions>=4.12.2,<5',
+    # requests' CA bundle. 2026.10.19 drops the roots behind the compromised
+    # eMudhra intermediates; a floor, so later trust-store fixes still apply.
+    'certifi>=2026.10.19'
 ]
 readme = "README.rst"
 license = {file = "LICENSE"}

socketdev/version.py

@@ -1 +1 @@
-__version__ = "3.6.0"
+__version__ = "3.6.1"