⚠️ SECURITY: Patch 7 open Dependabot advisories (urllib3, requests, filelock, python-dotenv)

[FernandoCelmer]

Summary

Closes every open Dependabot advisory by removing the EOL Python 3.9 leg (which was pinning vulnerable wheels) and refreshing the lockfile:

#	Severity	Package	From	To
8	high	urllib3	2.6.3	2.7.0
7	high	urllib3	2.6.3	2.7.0
6	medium	python-dotenv	1.1.1	1.2.2
4	medium	requests	2.32.5	2.34.2
3	medium	filelock	3.19.1	3.29.0
2	medium	filelock	3.19.1	3.29.0
5	medium	pytest (dev)	8.4.2	left at 8.x — 9.0.3 requires Python ≥3.10 only, kept on 8 to limit blast radius until a separate dev-dep PR

Changes

• requires-python = ">=3.10" (Python 3.9 reached EOL on 2025-10-31)
• python-dotenv ^1.2.2 (was ^1.0)
• Regenerated poetry.lock — all transitively-pinned vulnerable wheels removed
• Dropped 3.9 from the CI test matrix and the tox envlist

Breaking change

Consumers still running Python 3.9 must upgrade. 3.9 has been EOL for over six months; the trade-off is keeping vulnerable transitive deps forever vs. cutting an EOL interpreter.

Test plan

• pytest — 208 passed
• poetry lock resolves cleanly
• No remaining matches for vulnerable versions (urllib3<2.7, requests<2.33, filelock<3.20, python-dotenv<1.2.2)

[FernandoCelmer]

🔍 Code Review

Code issues found: 1

#	Severity	Comment
1	[Suggestion]	Breaking change deserves a major version bump

The dependency refresh and Python-3.9 drop are correct — 3.9 has been EOL since 2025-10-31 and was pinning the vulnerable transitive wheels. Lockfile regeneration looks clean. Test matrix and tox envlist are consistent.

[Suggestion]

Problem — Dropping support for Python 3.9 is a backward-incompatible change for downstream consumers. Per SemVer §8, a backward-incompatible public API change (and the supported-interpreter set is part of the public contract for libraries) requires a major version bump. pyproject.toml still declares version = "1.0.0" in both [project] and [tool.poetry]. Anyone who pinned email-profile ^1.0 and is still on 3.9 will get a broken install after this lands.

Fix — Bump to 2.0.0 in both [project] and [tool.poetry]. Add a CHANGELOG / release-notes entry titled Breaking changes listing:

• Python 3.9 dropped (EOL 2025-10-31)
• python-dotenv minimum raised to 1.2.2

As a bonus, the Development Status :: 4 - Beta classifier still appears in both sections — at 2.0.0 it would also make sense to promote to Development Status :: 5 - Production/Stable (or stay at Beta but reflect that in the version, e.g. 2.0.0b1). The current 1.0.0 + Beta combination is already inconsistent.

References — https://semver.org/#spec-item-8 (backward incompatible changes MUST bump MAJOR).