chore(deps): pytest advisory is blocked on dropping Python 3.9 — which is now EOL

The alert

Dependabot alert #39 — pytest GHSA-6w46-j5rx-g56g (vulnerable tmpdir handling), moderate, in packages/py-sdk/requirements-lock.txt.

It is the only open Dependabot alert in this repo, and it has been open since ~2026-07.

Why it cannot be bumped

There is no in-range escape. The advisory is a flat range with a single fix:

vulnerable:     < 9.0.3
first patched:  9.0.3     (no 8.x backport exists)

And pytest 9.0.3 declares requires-python = >=3.10 (verified against PyPI directly).

Meanwhile this SDK declares:

Where	Value
packages/py-sdk/pyproject.toml	requires-python = ">=3.9"
.github/workflows/ci.yml:44	python-version: '3.9'

So fixing the advisory requires dropping Python 3.9 — bump requires-python and the CI matrix. That is a support-matrix decision, not a dependency bump, which is why no dependency PR has been opened for it in either the August or September sweep.

New information: Python 3.9 is already end-of-life

This is the part that has changed since the decision was first deferred:

Version	Released	EOL
Python 3.9	2020-10-05	2025-10-31 — already past
Python 3.10	2021-10-04	2026-10-31

Python 3.9 stopped receiving security fixes over ten months ago. Continuing to declare >=3.9 advertises support for an interpreter that upstream no longer patches — and it is the single thing keeping this advisory open.

Worth noting 3.10 itself reaches EOL on 2026-10-31, so a floor of 3.10 buys under two months. 3.11 is the floor that ages well, and this repo already publishes on 3.11 (publish-py.yml, release-py.yml).

Risk of the alert itself

Low, and it should be weighed honestly rather than used to justify urgency:

• pytest is a dev/test dependency. It is never installed by a consumer of the SDK.
• requirements-lock.txt is not the install path — CI installs via pip install -e ".[dev]" against the declared ranges. The lockfile exists so GitHub's dependency graph has versions to scan at all (see the header comment in that file).

So this is not an exposure to users. It is a housekeeping decision that happens to be the last thing standing between this repo and a clean alert list.

Options

1. Bump the floor to 3.11 — matches what the publish workflows already use, clears the alert, and does not need revisiting in two months. Requires pyproject.toml, the CI matrix, and regenerating the lockfile on the new interpreter.
2. Bump to 3.10 — smallest change that clears the alert, but 3.10 is EOL on 2026-10-31.
3. Keep 3.9 and accept the alert — the status quo. Still defensible if a known consumer is pinned to 3.9; the header comment in requirements-lock.txt already documents it as accepted.

Option 1 is the recommendation, but this is a product call about who the SDK supports — please decide rather than treating it as a routine bump.

Not blocking anything. Filed so the reasoning lives somewhere findable instead of only in a lockfile comment.