[herchu]

Your checklist for this pull request

🚨Please review the guidelines for contributing to this repository.

• Make sure you are requesting to pull a topic/feature/bugfix branch (right side). Don't request your main!
• Make sure you are making a pull request against the main branch (left side). Also you should start your branch off our main.
• Check your code additions will fail neither code linting checks nor unit test.

Description

Drops Python 3.10 and updates the dependencies, to be released as 3.5.0 in a follow-up Bump version: 3.4.0 → 3.5.0 PR.

Why. pillow~=12.1.1 held every consumer on Pillow 12.1.x, which has five Critical CVEs fixed in 13.0.0 (Dependabot alert #64). Consumers cannot take the fix today without overriding the SDK's pin. Pillow 13 requires Python 3.11, hence dropping 3.10.

Runtime requirements become ranges up to the next major, instead of ~= pins, so a consumer's lockfile can take patch and minor fixes without waiting for an SDK release.

Package	Before	After	Note
pillow	~=12.1.1	>=13.0,<14	the CVE fix; needs Python 3.11
protobuf	~=5.29.6	>=5.29.6,<8	the generated inorbit_pb2.py loads on 7 unchanged, no warnings
rdp2	~=1.1.2	>=1.1.2,<2
pyaml	>=23.12,<24	replaced by PyYAML>=6.0,<7	the SDK only imports yaml; pyaml just pulled PyYAML in
opencv-python-headless (video)	>=4.9,<5	>=4.9,<6	resize, imencode and VideoCapture unchanged in 5
opentelemetry-api / sdk (telemetry)	~=1.41.0	~=1.45.2
opentelemetry-exporter-prometheus	~=0.62b0	~=0.66b2	matches the 1.45 SDK line

requests, paho-mqtt, pydantic, pysocks, certifi and prometheus-client keep their ranges, which already allow the current releases.

Dev tools: black 26.10, pytest 9.2, pytest-mock 3.17, coverage 7.17, flake8 7.5, tox 4.67, twine 7.0, setuptools 84.2, pip 26.3, wheel 0.48. black 26.10 reformats nothing.

Python 3.10 removed from: python_requires (now >=3.11, <3.14), the classifiers, tox's envlist (now py311, py312, py313, with an explicit [gh-actions] mapping), both CI matrices, and the README. The publish job builds on 3.13 instead of 3.10.

Testing

In python:3.x-slim containers, the tox commands (flake8, black --check, pytest):

Python	Versions	Result
3.11, 3.12, 3.13	newest allowed: pillow 13.0.0, protobuf 7.36.2, opencv 5.0.0, PyYAML 6.0.3, rdp2 1.2.1, OTel 1.45.2	184 passed, lint clean
3.11	floors: protobuf 5.29.6, opencv 4.9.0, rdp2 1.1.2, pydantic 2.6.4, paho-mqtt 2.1.0, requests 2.31.0	184 passed

Plus a smoke script on both ends (protobuf 7 + opencv 5, and protobuf 5.29.6 + opencv 4.9), with all warnings shown. It round-trips a LocationAndPoseMessage, reads a frame from a generated MJPG file with cv2.VideoCapture, and encodes it with convert_frame. No warnings appeared on either end.

RobotMap, the SDK's Pillow user, also loads and re-encodes a real 1523×705 map PNG on Pillow 13.

Note for consumers

Python 3.10 users stay on 3.4.x. Requiring protobuf 7 is not forced: the range keeps 5.29.6 and up, so connectors pinned to protobuf 5 or 6 for ROS or gRPC keep resolving.

🤖 Generated with Claude Code