[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26 (PR originally opened 2026-10-05).
Change type: Major version bump — includes source/config changes to adapt to a breaking change.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
urllib3 (runtime)	pip	Minor (+ Python floor change)	>=2.1.0 → >=2.7.0	High	112d	Dependabot	GHSA-mf9v-mfxr-j63j / CVE-2026-44432, GHSA-qccp-gfcp-xxvc / CVE-2026-44431
pytest (dev)	pip	Major	>=7.2.1 → >=9.0.3	Medium	112d	Dependabot, Wiz	GHSA-6w46-j5rx-g56g / CVE-2025-71176
filelock (dev, transitive via tox)	pip	Minor (new explicit floor)	unconstrained → >=3.20.3	Medium	112d	Dependabot, Wiz	GHSA-w853-jp5j-5j7f / CVE-2025-68146, GHSA-qmgc-5h2g-mvrw / CVE-2026-22701

Breaking change for consumers (hence fix!:): every patched release above (urllib3 2.7.0, pytest 9.0.3, filelock 3.20.3) declares Requires-Python >=3.10, so the package's supported-Python floor is raised 3.9 → 3.10 (Python 3.9 is upstream EOL):

• pyproject.toml requires-python and setup.py PYTHON_REQUIRES: >=3.9 → >=3.10
• .github/workflows/python.yml matrix: dropped 3.9
• README.md: "Python 3.9+" → "Python 3.10+"
• requirements.txt / test-requirements.txt / pyproject.toml dev group mirror the new floors (filelock >= 3.20.3 added explicitly).

2026-10-26: merged main (generated release 25.0.0). The only conflict was setup.py; resolved to VERSION = "25.0.0" (from main) + PYTHON_REQUIRES = ">= 3.10" (this PR). The PR diff vs main is still 6 files / +11 −9. The 25.0.0 regeneration reverted nothing else, but confirms the generator note: these files come from openapi-generator in ld-openapi; unless the generator config there is updated (Python floor + dependency floors), future releases will keep conflicting with / reverting this change.

Deferred / excluded findings

• Still within the 7-day hold — urllib3 2.7.0 → 2.8.0 (High ×2 / Medium, GHSA-vxq7-64xx-v4gw / CVE-2026-97689, GHSA-8988-9cw3-xx77 / CVE-2026-97687, GHSA-gh4c-6fx4-qh6g / CVE-2026-97688, 3d). The floor is not raised to 2.8.0 yet; a fresh install already resolves urllib3 2.8.0.
• The generated .travis.yml / .gitlab-ci.yml still list Python 3.9; they are generator boilerplate not used by this repo's CI (GitHub Actions) and are left untouched.

Verification

• Install: ✅ pip install -r requirements.txt -r test-requirements.txt && pip install -e . + pip check on Python 3.10.20 (resolved urllib3 2.8.0, pytest 9.1.1, filelock 4.1.0)
• Build: ✅ (pip install -e . builds the package)
• Tests: ✅ pytest — 1122 passed on 3.10 (after merging 25.0.0)
• Lint: ✅ flake8 launchdarkly_api --select=E9,F63,F7,F82 — 0 issues (CI does not run a linter)

---

Note

Overview
Addresses dependency security advisories by tightening version floors and dropping Python 3.9 support in favor of Python 3.10+ (requires-python / PYTHON_REQUIRES, README, and GitHub Actions matrix).

Runtime urllib3 minimum moves from >=2.1.0 to >=2.7.0 in pyproject.toml, requirements.txt, and setup.py. Dev tooling bumps pytest to >=9.0.3 and adds an explicit filelock >=3.20.3 floor in pyproject.toml and test-requirements.txt. No launchdarkly_api source changes.

^{Reviewed by Cursor Bugbot for commit 076c537. Bugbot is set up for automated code reviews on this repo. Configure here.}

Link to Devin session: https://app.devin.ai/sessions/8fbccb467dd4402f85e12e5f1613065c
Open in Devin Desktop: https://app.devin.ai/desktop/session/8fbccb467dd4402f85e12e5f1613065c?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring