Merge branch 'main' into docs/fix-comparison-type-claims

Author: 27Bslash6

.github/workflows/ci.yml

@@ -64,7 +64,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ${{ github.event_name == 'push' && fromJSON('["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]') || fromJSON('["3.12"]') }}
+        python-version: ${{ github.event_name == 'push' && fromJSON('["3.10", "3.11", "3.12", "3.13", "3.14"]') || fromJSON('["3.12"]') }}
 
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -161,11 +161,12 @@ jobs:
 
     - name: Scan Python dependencies for CVEs
       run: |
-        # GHSA-5239-wwwm-4pmq: pygments ReDoS in AdlLexer (dev-only, no fix available)
-        # GHSA-58qw-9mgm-455v: pip tar/zip confusion (pip itself, no fix available)
-        uv run pip-audit --desc \
-          --ignore-vuln GHSA-5239-wwwm-4pmq \
-          --ignore-vuln GHSA-58qw-9mgm-455v
+        # No suppressions: every prior CVE is resolved at source on the py3.10+
+        # resolution. urllib3>=2.7.0 and pip>=26.1.2 are pinned via
+        # [tool.uv] constraint-dependencies; pygments/pyarrow advisories cleared
+        # by their py3.10+ fix versions. Keep this list IDENTICAL to
+        # security-fast.yml's pip-audit so the two cannot drift.
+        uv run pip-audit --desc
 
     - name: Run markdown documentation tests
       run: make test-docs-examples

.github/workflows/release-please.yml

@@ -84,26 +84,26 @@ jobs:
     strategy:
       matrix:
         include:
-          # Linux builds - must specify interpreters explicitly (manylinux has 3.8+ but we support 3.9+)
+          # Linux builds - must specify interpreters explicitly (manylinux has 3.8+ but we support 3.10+)
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
-            interpreter: -i python3.9 -i python3.10 -i python3.11 -i python3.12 -i python3.13
+            interpreter: -i python3.10 -i python3.11 -i python3.12 -i python3.13
           # macOS/Windows - must specify interpreters explicitly (auto-discovery unreliable)
           - os: macos-latest
             target: x86_64-apple-darwin
-            interpreter: -i python3.9 -i python3.10 -i python3.11 -i python3.12 -i python3.13
+            interpreter: -i python3.10 -i python3.11 -i python3.12 -i python3.13
           - os: macos-latest
             target: aarch64-apple-darwin
-            interpreter: -i python3.9 -i python3.10 -i python3.11 -i python3.12 -i python3.13
+            interpreter: -i python3.10 -i python3.11 -i python3.12 -i python3.13
           - os: windows-latest
             target: x86_64-pc-windows-msvc
-            interpreter: -i python3.9 -i python3.10 -i python3.11 -i python3.12 -i python3.13
+            interpreter: -i python3.10 -i python3.11 -i python3.12 -i python3.13
           # aarch64 Linux cross-compilation - must specify Python versions explicitly
           # (cross containers don't have discoverable Python interpreters)
           # Uses manylinux_2_28 for modern GCC (fixes ring crate aarch64 build)
           - os: ubuntu-latest
             target: aarch64-unknown-linux-gnu
-            interpreter: -i python3.9 -i python3.10 -i python3.11 -i python3.12 -i python3.13
+            interpreter: -i python3.10 -i python3.11 -i python3.12 -i python3.13
             manylinux: "2_28"
     runs-on: ${{ matrix.os }}
     steps:
@@ -119,7 +119,6 @@ jobs:
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: |
-            3.9
             3.10
             3.11
             3.12

.github/workflows/security-fast.yml

@@ -87,20 +87,12 @@ jobs:
 
     - name: Run pip-audit
       run: |
-        # Dev-only transitive CVEs — no runtime impact, fixes require py3.10+ (we support 3.9)
-        # GHSA-5239-wwwm-4pmq: pygments ReDoS in AdlLexer (dev-only, no fix available)
-        # GHSA-58qw-9mgm-455v: pip tar/zip confusion (pip itself, no fix available)
-        # GHSA-jp4c-xjxw-mgf9: pip self-update import ordering (fix requires py3.10+)
-        # GHSA-qccp-gfcp-xxvc: urllib3 cross-origin header leak (dev dep via uv sync; runtime uses httpx, fix 2.7.0 requires py3.10+)
-        # GHSA-mf9v-mfxr-j63j: urllib3 decompression bomb (dev dep via uv sync; runtime uses httpx, fix 2.7.0 requires py3.10+)
-        # PYSEC-2026-113: pyarrow C++ IPC pre-buffer UAF (PreBufferMetadata not exposed to Python bindings per advisory)
-        uv run pip-audit --desc --format json --output pip-audit-report.json \
-          --ignore-vuln GHSA-5239-wwwm-4pmq \
-          --ignore-vuln GHSA-58qw-9mgm-455v \
-          --ignore-vuln GHSA-jp4c-xjxw-mgf9 \
-          --ignore-vuln GHSA-qccp-gfcp-xxvc \
-          --ignore-vuln GHSA-mf9v-mfxr-j63j \
-          --ignore-vuln PYSEC-2026-113
+        # No suppressions: every prior CVE is resolved at source on the py3.10+
+        # resolution. urllib3>=2.7.0 and pip>=26.1.2 are pinned via
+        # [tool.uv] constraint-dependencies; pygments/pyarrow advisories cleared
+        # by their py3.10+ fix versions. Keep this list IDENTICAL to ci.yml's
+        # post-merge pip-audit so the two cannot drift.
+        uv run pip-audit --desc --format json --output pip-audit-report.json
 
     - name: Upload report
       if: always()

.secrets.baseline

@@ -10,7 +10,7 @@ This project follows a standard code of conduct. Please be respectful and profes
 
 ### Prerequisites
 
-- Python 3.9 or higher
+- Python 3.10 or higher
 - Rust 1.80 or higher
 - Redis 5.0 or higher (for testing)
 - [uv](https://github.com/astral-sh/uv) (recommended for dependency management)
@@ -80,7 +80,7 @@ This project follows a standard code of conduct. Please be respectful and profes
 - **Linter**: Ruff (runs automatically with `make lint`)
 - **Type checker**: basedpyright (standard mode, zero errors enforced)
 - **Type hints**: Required for all public APIs
-- **Python 3.9+ compatibility**: Use `from __future__ import annotations` for modern union syntax
+- **Python 3.10+ compatibility**: Use `from __future__ import annotations` for modern union syntax
 - **Docstrings**: Google style for public functions/classes
 - **Imports**: Absolute imports only
 

CONTRIBUTING.md

@@ -405,7 +405,7 @@ See [CONTRIBUTING.md][contributing-url] for full development guidelines.
 
 | Component | Version |
 |:----------|:--------|
-| Python | 3.9+ |
+| Python | 3.10+ |
 
 ---
 

Cargo.lock

@@ -30,7 +30,7 @@
     "reportUnnecessaryCast": "warning",
     "reportUnnecessaryComparison": "warning",
 
-    "pythonVersion": "3.9",
+    "pythonVersion": "3.10",
     "pythonPlatform": "Linux",
 
     "stubPath": "typings",

README.md

@@ -782,7 +782,7 @@ def typed_function(data: dict[str, Any]) -> str | int | None:
     return process_data(data)
 ```
 
-**Type Safety**: The library uses `from __future__ import annotations` for Python 3.9+ compatibility, enabling modern union syntax (`X | Y`) while maintaining backward compatibility.
+**Type Safety**: The library uses `from __future__ import annotations` for Python 3.10+ compatibility, enabling modern union syntax (`X | Y`) while maintaining backward compatibility.
 
 ## Monitoring and Observability
 

basedpyright.json

@@ -36,7 +36,6 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -51,7 +50,7 @@ classifiers = [
     "Framework :: AsyncIO",
     "Typing :: Typed",
 ]
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 dependencies = [
     # Core Redis functionality
     "redis[hiredis]>=4.0.0",
@@ -101,7 +100,7 @@ include = ["LICENSE", "README.md"]
 # Ruff configuration
 [tool.ruff]
 line-length = 129
-target-version = "py39"
+target-version = "py310"
 
 [tool.ruff.lint]
 select = [
@@ -237,7 +236,11 @@ fuzz = [
 # Override vulnerable transitive dependencies
 [tool.uv]
 constraint-dependencies = [
-    "urllib3>=2.6.0",
+    "urllib3>=2.7.0",
     "fonttools>=4.60.2",
     "werkzeug>=3.1.4",
+    # pip is a dev-only transitive dep (pip-audit -> pip-api -> pip). 26.1.2 fixes
+    # PYSEC-2026-196 (entry-point path traversal), GHSA-58qw-9mgm-455v (tar/zip
+    # confusion) and GHSA-jp4c-xjxw-mgf9 (self-update import ordering).
+    "pip>=26.1.2",
 ]