From 6a7ceef2e337212be9357585d797b848a08246d8 Mon Sep 17 00:00:00 2001 From: Hernan Date: Thu, 12 Nov 2026 15:41:54 -0300 Subject: [PATCH] Drop Python 3.10 and update dependencies, Pillow 13 among them Pillow 12.1.1, which the ~= pin held every consumer to, has five Critical CVEs fixed in 13.0.0 (heap overflows in the TIFF, FPX and JPEG codecs, Ghostscript argument injection, stale multi-frame storage). Pillow 13 requires Python 3.11, so 3.10 goes from python_requires, the classifiers, tox and both CI matrices; the publish job builds on 3.13. Runtime requirements become ranges up to the next major instead of ~= pins, so a consumer's lockfile can take fixes without waiting for an SDK release: - pillow >=13.0,<14 - protobuf >=5.29.6,<8 (the generated module loads on 7 unchanged) - rdp2 >=1.1.2,<2 - opencv-python-headless (video extra) up to <6 - pyaml replaced by PyYAML >=6.0,<7: the SDK only ever imported yaml, which pyaml merely pulled in - OpenTelemetry 1.45 / exporter 0.66b2 (telemetry extra) Dev tools move to their current releases (black 26.10, pytest 9, coverage 7.17, flake8 7.5, tox 4.67, twine 7, setuptools 84). tox gets an explicit [gh-actions] mapping and py311..py313 env names. Tests: flake8, black --check and the 184 unit tests pass on 3.11, 3.12 and 3.13 with the newest versions, and on 3.11 with the floors (protobuf 5.29.6, opencv 4.9, rdp2 1.1.2, pydantic 2.6.4, requests 2.31). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-main.yml | 4 ++-- .github/workflows/test-and-lint.yml | 2 +- README.md | 2 +- requirements-dev.txt | 20 ++++++++++---------- requirements-telemetry.txt | 6 +++--- requirements-video.txt | 2 +- requirements.txt | 8 ++++---- setup.py | 3 +-- tox.ini | 8 +++++++- 9 files changed, 30 insertions(+), 25 deletions(-) diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml index 50f541a..a36c6f0 100644 --- a/.github/workflows/build-main.yml +++ b/.github/workflows/build-main.yml @@ -17,7 +17,7 @@ jobs: strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] - python-version: ['3.10', '3.11', '3.12', '3.13'] + python-version: ['3.11', '3.12', '3.13'] architecture: ['x86_64', 'aarch64'] steps: @@ -46,7 +46,7 @@ jobs: - name: Set up Python uses: actions/setup-python@v1 with: - python-version: '3.10' + python-version: '3.13' - name: Install Dependencies run: | python -m pip install --upgrade pip diff --git a/.github/workflows/test-and-lint.yml b/.github/workflows/test-and-lint.yml index 21f1eab..ee3cc5f 100644 --- a/.github/workflows/test-and-lint.yml +++ b/.github/workflows/test-and-lint.yml @@ -13,7 +13,7 @@ jobs: strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] - python-version: ['3.10', '3.11', '3.12', '3.13'] + python-version: ['3.11', '3.12', '3.13'] architecture: ['x86_64', 'aarch64'] steps: diff --git a/README.md b/README.md index c1cb355..d8366fc 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,7 @@ the code. 2. `make build` - This will run `tox` which will run all your tests in Python 3.10 - 3.13 as + This will run `tox` which will run all your tests in Python 3.11 - 3.13 as well as linting your code. 3. `make clean` diff --git a/requirements-dev.txt b/requirements-dev.txt index 0fbdaa2..2c01e14 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1,13 +1,13 @@ bump2version~=1.0 -black~=26.3.1 -coverage~=7.6 -flake8~=7.1 +black~=26.10 +coverage~=7.17 +flake8~=7.5 flake8-pyproject~=1.2 -pip~=26.0 -pytest~=8.4 -pytest-mock~=3.14 +pip~=26.3 +pytest~=9.2 +pytest-mock~=3.17 requests-mock~=1.12 -setuptools~=80.9 -tox~=4.32 -twine~=6.2 -wheel~=0.46.2 +setuptools~=84.2 +tox~=4.67 +twine~=7.0 +wheel~=0.48.0 diff --git a/requirements-telemetry.txt b/requirements-telemetry.txt index 1513fa9..7af1b13 100644 --- a/requirements-telemetry.txt +++ b/requirements-telemetry.txt @@ -1,5 +1,5 @@ -opentelemetry-api~=1.41.0 -opentelemetry-sdk~=1.41.0 +opentelemetry-api~=1.45.2 +opentelemetry-sdk~=1.45.2 # 0.x release line; must match the SDK line (see PyPI for each version’s opentelemetry-sdk pin) -opentelemetry-exporter-prometheus~=0.62b0 +opentelemetry-exporter-prometheus~=0.66b2 prometheus-client>=0.20,<1.0 diff --git a/requirements-video.txt b/requirements-video.txt index 5b72c7f..ff3178e 100644 --- a/requirements-video.txt +++ b/requirements-video.txt @@ -1 +1 @@ -opencv-python-headless>=4.9,<5.0 +opencv-python-headless>=4.9,<6.0 diff --git a/requirements.txt b/requirements.txt index 40359a2..1fa687a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,9 +1,9 @@ requests>=2.31,<3.0 paho-mqtt>=2.1.0,<3.0 -pillow~=12.1.1 -pyaml>=23.12,<24.0 +pillow>=13.0,<14.0 +PyYAML>=6.0,<7.0 pydantic>=2.6,<3.0 pysocks>=1.7,<2.0 -protobuf~=5.29.6 +protobuf>=5.29.6,<8.0 certifi>=2024.2 -rdp2~=1.1.2 +rdp2>=1.1.2,<2.0 diff --git a/setup.py b/setup.py index b18cdfb..2c052df 100644 --- a/setup.py +++ b/setup.py @@ -40,7 +40,6 @@ "Operating System :: MacOS :: MacOS X", "Operating System :: Microsoft :: Windows", "Operating System :: POSIX :: Linux", - "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", @@ -68,7 +67,7 @@ # package_dir={"": "src"}, packages=find_packages(exclude=["tests", "*.tests", "*.tests.*"]), platforms=["Linux", "Mac OS-X", "Windows"], - python_requires=">=3.10, <3.14", + python_requires=">=3.11, <3.14", url=GITHUB_REPO, # Do not edit manually, always use bumpversion (see CONTRIBUTING.rst) version=VERSION, diff --git a/tox.ini b/tox.ini index bfe0caf..dfaaa09 100644 --- a/tox.ini +++ b/tox.ini @@ -1,6 +1,12 @@ [tox] skipsdist = True -envlist = py10, py11, py12, py13 +envlist = py311, py312, py313 + +[gh-actions] +python = + 3.11: py311 + 3.12: py312 + 3.13: py313 [testenv] deps =