[lelia]

Summary

Release PR for 3.6.1. It ships the Dependabot security bumps merged since 3.6.0, which fix critical vulnerabilities in certifi, uv and virtualenv:

Package	3.6.0 lock	3.6.1 lock	PR
certifi	2025.11.12	2026.10.19	#117
uv	0.11.17	0.13.4	#116
virtualenv	20.36.1	21.14.7	#112, #118

Changes

• Bumped socketdev/version.py to 3.6.1.
• Added a CHANGELOG.md entry covering the security bumps, the Python 3.10 floor from fix: update security dependencies for Python 3.10+ #112, the requests>=2.33.0 floor, and the build tooling maintenance.
• Requires certifi>=2026.10.19. requests takes its CA bundle from certifi, and socketdev didn't constrain it, so pip could leave consumers on a bundle that trusts the compromised eMudhra intermediate CAs. It's a floor rather than an exact pin, so later trust-store fixes still reach them. The built wheel now lists Requires-Dist: certifi>=2026.10.19.
• Synced the release build toolchain pins. .github/actions/setup-hatch (used by release.yml, package-check.yml and pr-preview.yml) still installed virtualenv==21.7.13 and hatchling==1.32.0. Dependabot updates uv.lock but not the pip pins inside composite-action shell steps. Both pins now match the lock and [build-system] (virtualenv==21.14.7, hatchling==1.32.4), so the published artifacts are built with the patched virtualenv.

Notes for reviewers

• uv.lock controls only this repo's dev and CI environment. The new certifi floor is what reaches consumers.
• This patch release includes the requires-python >=3.10 change from fix: update security dependencies for Python 3.10+ #112. On Python 3.9, pip keeps resolving 3.6.0.

Testing

• Built the sdist and wheel locally with hatch==1.18.1, hatchling==1.32.4 and virtualenv==21.14.7 (the new setup-hatch toolchain). twine check passes for both.
• uv lock --check is clean.
• Rebuilt after adding the certifi floor: the wheel's metadata requires certifi>=2026.10.19, and twine check passes. The integration tests need SOCKET_SECURITY_API_KEY and SOCKET_ORG_SLUG, so they were skipped locally.
• Unit tests: 150 passed, 1 skipped.

Public Changelog

Security release: picks up patched certifi, uv and virtualenv versions and requires Python 3.10 or newer. See CHANGELOG.md for details.

---

Note

Medium Risk
Raises minimum Python and adds certifi/requests floors that affect all consumers; changes are intentional security fixes with a documented Python 3.9 pin to 3.6.0.

Overview
3.6.1 is a security-focused release that bumps the package version and documents dependency fixes in CHANGELOG.md.

For installers, the PR tightens runtime constraints: requires-python is now >=3.10, requests floor is >=2.33.0, and certifi>=2026.10.19 is added as a direct dependency so pip pulls a CA bundle that no longer trusts the compromised eMudhra intermediates used by requests. uv.lock is refreshed for dev/CI (including certifi, uv, and virtualenv security updates).

Release builds align with the lockfile: .github/actions/setup-hatch now installs hatchling==1.32.4 and virtualenv==21.14.7 (matching pyproject.toml [build-system]), so wheels/sdists published from release.yml / package-check.yml / pr-preview.yml use the patched toolchain.

^{Reviewed by Cursor Bugbot for commit a9f1ad6. Configure here.}

[lelia]

bugbot run

[cursor]

Stale Bugbot comment from a previous run.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a9f1ad6. Configure here.}