chore(py-sdk): close anyio and pytest advisories without dropping Python 3.9 #83

Change type

Dependency security maintenance for the Python SDK (scan lockfile and CI only). The supported Python floor does not change; 3.9 stays supported.

Scope changed after review: this was first opened as "raise the Python floor to 3.10". That turned out to be unnecessary to close the advisories, so the floor change was dropped.

Risk / impact

Low. No change to the published package: pyproject.toml, source, and READMEs are untouched.

Security impact assessed?

Yes. Two packages in the Python SDK's resolved tree have open advisories whose patched releases require Python 3.10 or newer:

• anyio (GHSA-82r6-8w77-94w6, GHSA-5p39-cfhj-2xmp), fixed in 4.14.2. Runtime, via httpx.
• pytest (GHSA-6w46-j5rx-g56g), fixed in 9.0.3. Test tooling only.

The SDK does not pin anyio, so installs on Python 3.10+ already resolve the patched release. Installs on 3.9 resolve 4.12.1, and no release of this SDK can change that because upstream publishes no patched build for 3.9. The alerts were raised against the scan-only requirements-lock.txt, which was resolved for 3.9.

Residual: users who remain on Python 3.9 keep the older anyio. Exposure is narrow (TLS host name handling for internationalized domain names; the SDK talks to an ASCII host by default).

Details — description & full context

• requirements-lock.txt resolved for Python 3.10 (anyio 4.15.1, pytest 9.1.1), with the reasoning in the file header
• CI Python job runs on both 3.9 and 3.10

Component / area

Python SDK (packages/py-sdk), CI.

Testing & validation

• Full Python suite passes locally on 3.10 with the newly resolved versions (345 passed)
• CI passes on the implementing PR for both 3.9 and 3.10

Rollback plan

Revert the PR. Nothing is published by merging it.

Breaking change for consumers?

No.

Reviewer / approver

@nicolasiscoding