fix(security): clear 43 advisories in python-api/uv.lock (aiohttp, urllib3, requests, pytest, idna, pygments)

[benfrank241]

Bundled security update for the (uv, python-api/uv.lock) target. Clears 43 unique GHSA advisories (6 HIGH, 21 MODERATE, 16 LOW).

Dependabot alerts are not scanning this repo. The alerts endpoint responds 200 but returns zero alerts in every state (open, fixed, dismissed, auto_dismissed) — it has never recorded a single alert despite a committed lockfile with real advisories. So there are no alert #NNN numbers to close; the advisory set below was derived locally by auditing python-api/uv.lock against OSV.dev (batch API), before and after. Please consider enabling Dependabot alerts in Settings → Code security.

The load-bearing decision: requires-python >= 3.8 → >= 3.10

This needs a maintainer's call. Every fix version for the flagged packages requires Python >= 3.10:

package	min fixed version	its requires_python
aiohttp	3.14.3	>=3.10
urllib3	2.7.0	>=3.10
requests	2.33.0	>=3.10
pytest	9.0.3	>=3.10
pygments	2.20.0	>=3.9
idna	3.15	>=3.8

Because the project declared requires-python = ">=3.8", uv forked the lockfile and pinned known-vulnerable versions on the legacy branches (aiohttp 3.10.11, urllib3 2.2.3, pytest 8.3.5). Bumping the constraints without raising requires-python is not possible — the resolution has nowhere to go.

Raising it to >=3.10 collapses all 44 fork markers into a single resolution and is what makes the fix reachable. Both dropped versions are end-of-life (3.8 EOL 2024-10, 3.9 EOL 2025-10), and CI already builds only on 3.11 — but this is a packaging change for a published library, so it is flagged rather than assumed.

If 3.8/3.9 support must be retained, say so and I will reduce this to a lock-only upgrade that fixes the modern fork and leaves 59 GHSA occurrences on the legacy branches.

Changes

python-api/pyproject.toml

• requires-python: >=3.8 → >=3.10; removed the now-inaccurate 3.8/3.9 classifiers
• aiohttp: >=3.9.0 → >=3.14.3
• requests: >=2.28.0 → >=2.33.0
• pytest (dev): >=7.0.0 → >=9.0.3

python-api/uv.lock — regenerated scoped to the six affected packages (uv lock --upgrade-package …), not from scratch. Transitives urllib3 2.7.0, idna 3.19, pygments 2.21.0 land via that resolution. The lock shrinks 2584 → 1293 lines because the three Python-version forks collapse into one.

Advisories cleared

aiohttp 3.10.11 / 3.13.2 → 3.14.3 — 33 GHSA (2 HIGH)
GHSA-2fqr-mr3j-6wp8, GHSA-2vrm-gr82-f7m5, GHSA-3wq7-rqq7-wx6j, GHSA-4fvr-rgm6-gqmc, GHSA-4m7w-qmgq-4wj5, GHSA-54jq-c3m8-4m76, GHSA-63hf-3vf5-4wqf, GHSA-63hw-fmq6-xxg2, GHSA-69f9-5gxw-wvc2, GHSA-6jhg-hg63-jvvf, GHSA-6mq8-rvhq-8wgg, GHSA-9548-qrrj-x5pj, GHSA-966j-vmvw-g2g9, GHSA-9x8q-7h8h-wcw9, GHSA-c427-h43c-vf67, GHSA-cq5v-8q36-5273, GHSA-fh55-r93g-j68g, GHSA-g3cq-j2xw-wf74, GHSA-g84x-mcqj-x9qq, GHSA-hcc4-c3v8-rx92, GHSA-hg6j-4rv6-33pg, GHSA-hpj7-wq8m-9hgp, GHSA-jg22-mg44-37j8, GHSA-jj3x-wxrx-4x23, GHSA-m5qp-6w8w-w647, GHSA-m6qw-4cw2-hm4m, GHSA-mfx4-hv73-q22v, GHSA-mq44-7p77-q5h7, GHSA-mqqc-3gqh-h2x8, GHSA-mwh4-6h8g-pg8w, GHSA-p998-jp59-783m, GHSA-w2fm-2cpv-w7v5, GHSA-xcgm-r5h9-7989

urllib3 2.2.3 / 2.5.0 → 2.7.0 — 6 GHSA (4 HIGH)
GHSA-2xpw-w6gg-jr37, GHSA-38jv-5279-wg99, GHSA-48p4-8xcf-vxj5, GHSA-gm62-xv2j-4w53, GHSA-pq67-6m6q-mj2v, GHSA-qccp-gfcp-xxvc

requests 2.32.4 / 2.32.5 → 2.34.2 — GHSA-gc5v-m9x4-r6x2
idna 3.11 → 3.19 — GHSA-65pc-fj4g-8rjx
pytest (dev) 8.3.5 / 8.4.2 / 9.0.1 → 9.1.1 — GHSA-6w46-j5rx-g56g
pygments (dev) 2.19.2 → 2.21.0 — GHSA-5239-wwwm-4pmq

Verification

Run locally against python-api (commands derived from this repo — .github/workflows/ci.yml and [tool.pytest.ini_options]):

• uv sync — clean
• python -m build — passes. This is the only python-api check CI actually runs.
• uv run pytest — 10 failed, 9 passed, 10 skipped, byte-identical to the same run on unmodified main. No new failures.
• Post-change OSV audit of all 33 resolved pins — zero advisories
• Import smoke test — vectorize_iris public API imports cleanly on aiohttp 3.14.3 / requests 2.34.2 / urllib3 2.7.0 / pydantic 2.12.4

Pre-existing test failures (not caused by this PR)

The 10 failures exist on unmodified main and are unrelated to dependencies:

AttributeError: module 'vectorize_iris' has no attribute 'requests'

The tests patch vectorize_iris.requests / vectorize_iris.aiohttp, but the package does not re-export those modules. CI never caught it because the python-api job only runs python -m build — it never invokes pytest. Worth a follow-up; deliberately not fixed here, to keep this bundle purely a security change.

The repo's only aiohttp usage is a single aiohttp.ClientSession() in vectorize_iris/async_client.py:47, an API stable across 3.9→3.14.

---

🤖 Generated with Claude Code