fix(deps): drop py3.9 to require urllib3 >=2.7.0

[zfarrell]

Bumps requires-python to >=3.10 (3.9 is EOL since Oct 2025) so urllib3 resolves to 2.7.0 across the whole support range, clearing Aikido high finding #35199161; previously the 3.9 lock branch was stuck on vulnerable urllib3 2.6.3. Also begins tracking uv.lock. Verified with import/client smoke and 415 passing offline tests on 3.14.

[claude]

nit (not blocking): README.md:7 still says "Python 3.9+" under Requirements. Since this PR drops 3.9 support, update it to "Python 3.10+" to match requires-python.

Verified the lock resolves urllib3 to 2.7.0 (uv.lock:274), which clears the Aikido finding. CI matrices already target 3.12, so nothing else references 3.9 (tox = ">= 3.9.0" is the tox tool version, unrelated).

[zfarrell]

Good catch — updated README.md Requirements to "Python 3.10+" in 64837db. That was the only remaining 3.9 reference (tox >= 3.9.0 is the tox tool version, and CI matrices already target 3.12).

[claude]

nit: the declared dependency floor is still urllib3 (>=2.1.0,<3.0.0), so the published package advertises compatibility with the vulnerable 2.6.3. The fix works because dropping 3.9 lets the resolver pick 2.7.0 for the lock and fresh installs, but the PR title says "require urllib3 >=2.7.0". Consider bumping the floor to make the intent explicit and prevent a deliberate/constrained downgrade from re-introducing the CVE (urllib3 2.7.0 requires Python >=3.10, which now matches requires-python):

Suggested change

	"urllib3 (>=2.1.0,<3.0.0)",
	"urllib3 (>=2.7.0,<3.0.0)",

(not blocking)

[claude]

Approving. Clean, minimal dependency fix — requires-python bumped to >=3.10, README/lock kept in sync, urllib3 resolves to 2.7.0, no lingering 3.9 references in CI/tox/docs. Left one non-blocking nit on the urllib3 floor.

[zfarrell]

Applied in 6f1e7f0 — raised the declared floor to urllib3 (>=2.7.0,<3.0.0) in both pyproject.toml and requirements.txt. As you noted, this is only valid because we dropped 3.9: urllib3 2.7.0 requires Python >=3.10, so the floor bump and the requires-python bump go together (keeping 3.9 with a >=2.7.0 floor would make the package unresolvable on 3.9). Lock still resolves 2.7.0; import smoke passes.

[claude]

Verified the fix is consistent: urllib3 floor bumped to >=2.7.0 in both pyproject.toml and requirements.txt, requires-python raised to 3.10 across pyproject.toml/README/uv.lock, and CI runs on 3.12 with no lingering 3.9 matrix. Prior floor-bump nit is addressed.