chore(py-sdk): close anyio and pytest advisories — resolve the scan lockfile for 3.10, test 3.9 and 3.10

[nicolasiscoding]

Closes #83

Closes the open anyio and pytest advisories on the Python package without changing the supported Python floor. Python 3.9 stays supported.

Why the alerts existed

requirements-lock.txt is a scan-only file: nothing installs from it, it exists so the dependency graph has exact versions to match advisories against. It was resolved for Python 3.9, and the patched releases of two packages in the tree do not install on 3.9:

• anyio: 4.13+ requires Python 3.10; the fixes are in 4.14.2 (GHSA-82r6-8w77-94w6, GHSA-5p39-cfhj-2xmp)
• pytest: 9.x requires Python 3.10; the fix is in 9.0.3 (GHSA-6w46-j5rx-g56g), test tooling only

The SDK does not pin anyio (it arrives through httpx), so an install on Python 3.10 or newer already resolves the patched release. An install on 3.9 resolves anyio 4.12.1 and no release of this SDK can change that, because upstream publishes no patched build for 3.9.

Changes

• packages/py-sdk/requirements-lock.txt: resolved for Python 3.10 instead of 3.9 (anyio 4.12.1 → 4.15.1, pytest 8.4.2 → 9.1.1, plus the rest of the tree), with the reasoning written into the file header
• .github/workflows/ci.yml: the Python job runs as a matrix on 3.9 (the floor) and 3.10 (what the lockfile describes), so both resolved trees are tested

No change to pyproject.toml, the READMEs, or any source. No version bump and nothing to release.

What this does not do

Users who stay on Python 3.9 keep resolving the older anyio. Exposure is narrow (TLS host name handling for internationalized, non-ASCII domain names; the SDK talks to an ASCII host by default), and the way out for them is Python 3.10+. Dropping 3.9 from requires-python remains a separate decision for a future release.

Supersedes #80.

Testing

CI runs the full Python suite on both 3.9 and 3.10. Locally on 3.10 with the newly resolved versions: 345 passed.

🤖 Generated with Claude Code

[nicolasiscoding]

CI/CD green, Claude reviewed. All 12 checks passed, including the Python suite on both 3.9 and 3.10. The final diff is two files: the Python CI job becomes a 3.9 / 3.10 matrix, and the scan-only requirements-lock.txt is resolved for 3.10 (anyio 4.15.1, pytest 9.1.1). Nothing installs from that file, and pyproject.toml, source and docs are unchanged, so the supported Python floor stays 3.9 and there is no consumer-facing change. The check name changes from Test Python SDK to Test Python SDK (3.9) / (3.10); main has no required checks that reference the old name.