From 5e8925f8fdc9be55fad29d09ce203b3acae59d1a Mon Sep 17 00:00:00 2001
From: Vangelis Ruiz <VANGELIS.RUIZ@delinea.com>
Date: Thu, 23 Jul 2026 13:18:18 -0600
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20bump=20requests=202.34.?=
 =?UTF-8?q?2=20&=20urllib3=202.7.0;=20drop=20Python=203.8/3.9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clears CVE-2026-25645 (requests) and CVE-2026-44431/44432 (urllib3) per
work item 741117. The fixed releases require Python >= 3.10.

- requirements.txt: requests==2.34.2, urllib3==2.7.0
- pyproject.toml: requires-python >=3.10, requests floor >= 2.34.2
- tox.ini / run_tests.yml: matrix trimmed to 3.10-3.12
- README: minimum Python 3.10

BREAKING: drops Python 3.8/3.9 support (both EOL) and raises the
published requests floor for downstream consumers.
---
 .github/workflows/run_tests.yml |  3 ++-
 README.md                       |  2 +-
 pyproject.toml                  | 16 +++++++++++-----
 requirements.txt                |  4 ++--
 tox.ini                         |  3 ++-
 5 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml
index af891d6..b8a2acb 100644
--- a/.github/workflows/run_tests.yml
+++ b/.github/workflows/run_tests.yml
@@ -9,7 +9,8 @@ jobs:
     environment: testing
     strategy:
       matrix:
-        python: [3.8, 3.9, "3.10", "3.11"]
+        # Python 3.8/3.9 dropped: fixed requests/urllib3 pins require Python >= 3.10 (work item 741117)
+        python: ["3.10", "3.11", "3.12"]
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
diff --git a/README.md b/README.md
index a64c152..72343ed 100644
--- a/README.md
+++ b/README.md
@@ -188,7 +188,7 @@ When using a self-signed certificate for SSL, the `REQUESTS_CA_BUNDLE` environme
 
 ## Create a Build Environment (optional)
 
-The SDK requires [Python 3.8](https://www.python.org/downloads/) or higher.
+The SDK requires [Python 3.10](https://www.python.org/downloads/) or higher.
 
 First, ensure Python is in `$PATH`, then run:
 
diff --git a/pyproject.toml b/pyproject.toml
index 737c6fa..36dc096 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,14 +9,20 @@ author-email = "GitHub@delinea.com"
 classifiers = [
     "License :: OSI Approved :: Apache Software License",
     "Operating System :: OS Independent",
-    "Programming Language :: Python :: 3.8",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
-    "Programming Language :: Python :: 3.11"
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12"
 ]
 description-file = "README.md"
+# BREAKING (consumer-facing): the requests floor was raised from 2.12.5 to 2.34.2
+# to clear CVE-2026-25645 (requests) and its transitive urllib3 advisories for
+# downstream installs, not just CI. requests 2.34.2 requires Python >= 3.10.
 requires = [
-    "requests >= 2.12.5"
+    "requests >= 2.34.2"
 ]
-requires-python=">=3.8"
+# BREAKING (consumer-facing): minimum Python raised from 3.8 to 3.10. The fixed
+# requests/urllib3 releases that clear the flagged CVEs dropped 3.8/3.9 support
+# (both EOL). Consumers on Python 3.8/3.9 must stay on an older SDK release or
+# upgrade their runtime. See work item 741117.
+requires-python=">=3.10"
 dist-name = "python-tss-sdk"
diff --git a/requirements.txt b/requirements.txt
index 3f6a39b..32891dc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,8 +1,8 @@
-requests==2.32.4
+requests==2.34.2 # pinned to address CVE-2026-25645 (2.33.0 was never published); requires Python >= 3.10
 tox
 pytest
 python-dotenv
 flit
 black
-urllib3==2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability
+urllib3==2.7.0 # not directly required, pinned by Snyk to avoid a vulnerability (CVE-2026-44431/44432); requires Python >= 3.10
 zipp==3.23.0 # not directly required, pinned by Snyk to avoid a vulnerability
diff --git a/tox.ini b/tox.ini
index 2420de2..a38f05a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -6,7 +6,8 @@
 # Docs for tox config -> https://tox.readthedocs.io/en/latest/config.html
 
 [tox]
-envlist = 3.8, 3.9, 3.10, 3.11, 3.12
+# Python 3.8/3.9 dropped: fixed requests/urllib3 pins require Python >= 3.10 (work item 741117)
+envlist = 3.10, 3.11, 3.12
 isolated_build = True
 skipsdist = True