From 89807bfe1cc46dbae4111f8565dbfbb289449a7f Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 16:57:32 -0400
Subject: [PATCH 1/2] chore(release): 3.6.1 with patched certifi, uv and
 virtualenv

Cut a release that ships the Dependabot security bumps merged since 3.6.0
(#112, #116, #117, #118, #119).

The release build toolchain in setup-hatch still pinned virtualenv 21.7.13
and hatchling 1.32.0, because Dependabot updates uv.lock but not the pip
pins inside the composite action. Sync them to the locked virtualenv
21.14.7 and the [build-system] hatchling 1.32.4 so published artifacts are
built with the patched versions.
---
 .github/actions/setup-hatch/action.yml |  2 +-
 CHANGELOG.md                           | 28 ++++++++++++++++++++++++++
 socketdev/version.py                   |  2 +-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/.github/actions/setup-hatch/action.yml b/.github/actions/setup-hatch/action.yml
index 4c86133..6a6d55c 100644
--- a/.github/actions/setup-hatch/action.yml
+++ b/.github/actions/setup-hatch/action.yml
@@ -9,4 +9,4 @@ runs:
     - shell: bash
       run: |
         python -m pip install --upgrade pip
-        python -m pip install "hatch==1.18.1" "hatchling==1.32.0" "virtualenv==21.7.13"
+        python -m pip install "hatch==1.18.1" "hatchling==1.32.4" "virtualenv==21.14.7"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 71f6099..27d569e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog
 
+## 3.6.1
+
+### Security: patched releases of certifi, uv and virtualenv
+
+- Updated the locked versions of `certifi` (2025.11.12 → 2026.10.19), `uv`
+  (0.11.17 → 0.13.4) and `virtualenv` (20.36.1 → 21.14.7) to pick up fixes for
+  critical vulnerabilities. These versions are pinned in `uv.lock`, which
+  controls the development and CI environment. socketdev does not pin
+  `certifi` for consumers because it comes in through `requests`, so upgrade
+  it in your own environment.
+- The release build toolchain (`.github/actions/setup-hatch`) now installs
+  `virtualenv==21.14.7` and `hatchling==1.32.4`, matching `uv.lock` and the
+  `[build-system]` pin. Published artifacts are built with the patched versions.
+- Raised the `requests` floor to `>=2.33.0`.
+
+### Changed: Python 3.10 or newer is required
+
+- `requires-python` is now `>=3.10` (previously `>=3.9`). The patched
+  dependency releases no longer support Python 3.9, which reached end of life
+  in October 2025. On Python 3.9, pip continues to resolve socketdev 3.6.0.
+
+### Maintenance
+
+- Pinned the `hatchling` build backend to 1.32.4 and capped built
+  distributions at core metadata 2.4 so the locked Twine can validate them.
+- Raised the dev and test extras floors to `hatch>=1.18.1` and
+  `pytest>=9.0.3`.
+
 ## 3.6.0
 
 ### Changed: every API-sourced enum now tolerates unknown values
diff --git a/socketdev/version.py b/socketdev/version.py
index 85197cb..b202327 100644
--- a/socketdev/version.py
+++ b/socketdev/version.py
@@ -1 +1 @@
-__version__ = "3.6.0"
+__version__ = "3.6.1"

From a9f1ad6d712b442b01cc8a0fc80bc42e6ab85776 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:18:06 -0400
Subject: [PATCH 2/2] Require certifi>=2026.10.19

requests takes its CA bundle from certifi, and socketdev didn't constrain
it, so pip could leave consumers on a bundle that trusts the compromised
eMudhra intermediate CAs. A floor rather than an exact pin, so later
trust-store fixes still reach them.
---
 CHANGELOG.md   | 7 ++++---
 pyproject.toml | 5 ++++-
 uv.lock        | 4 +++-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27d569e..d9fd1f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,9 +7,10 @@
 - Updated the locked versions of `certifi` (2025.11.12 → 2026.10.19), `uv`
   (0.11.17 → 0.13.4) and `virtualenv` (20.36.1 → 21.14.7) to pick up fixes for
   critical vulnerabilities. These versions are pinned in `uv.lock`, which
-  controls the development and CI environment. socketdev does not pin
-  `certifi` for consumers because it comes in through `requests`, so upgrade
-  it in your own environment.
+  controls the development and CI environment.
+- socketdev now requires `certifi>=2026.10.19`, so installing it also upgrades
+  the CA bundle `requests` uses. Older bundles trust the compromised eMudhra
+  intermediate CAs.
 - The release build toolchain (`.github/actions/setup-hatch`) now installs
   `virtualenv==21.14.7` and `hatchling==1.32.4`, matching `uv.lock` and the
   `[build-system]` pin. Published artifacts are built with the patched versions.
diff --git a/pyproject.toml b/pyproject.toml
index ee64984..4ce6ca0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,10 @@ dynamic = ["version"]
 requires-python = ">= 3.10"
 dependencies = [
     'requests>=2.33.0,<3',
-    'typing-extensions>=4.12.2,<5'
+    'typing-extensions>=4.12.2,<5',
+    # requests' CA bundle. 2026.10.19 drops the roots behind the compromised
+    # eMudhra intermediates; a floor, so later trust-store fixes still apply.
+    'certifi>=2026.10.19'
 ]
 readme = "README.rst"
 license = {file = "LICENSE"}
diff --git a/uv.lock b/uv.lock
index cbc1392..af243ab 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.10"
 resolution-markers = [
     "python_full_version >= '3.12' and sys_platform == 'emscripten'",
@@ -1032,6 +1032,7 @@ wheels = [
 name = "socketdev"
 source = { editable = "." }
 dependencies = [
+    { name = "certifi" },
     { name = "requests" },
     { name = "typing-extensions" },
 ]
@@ -1050,6 +1051,7 @@ test = [
 
 [package.metadata]
 requires-dist = [
+    { name = "certifi", specifier = ">=2026.10.19" },
     { name = "hatch", marker = "extra == 'dev'", specifier = ">=1.18.1" },
     { name = "hatchling", marker = "extra == 'dev'", specifier = ">=1.27.0" },
     { name = "pytest", marker = "extra == 'test'", specifier = ">=9.0.3" },