GeezerVison

Summary

Release PR for 3.6.1. It ships the Dependabot security bumps merged since 3.6.0, which fix critical vulnerabilities in certifi, uv and virtualenv:

Changes

• Bumped socketdev/version.py to 3.6.1.
• Added a CHANGELOG.md entry covering the security bumps, the Python 3.10 floor from fix: update security dependencies for Python 3.10+ #112, the requests>=2.33.0 floor, and the build tooling maintenance.
• Requires certifi>=2026.10.19. requests takes its CA bundle from certifi, and socketdev didn't constrain it, so pip could leave consumers on a bundle that trusts the compromised eMudhra intermediate CAs. It's a floor rather than an exact pin, so later trust-store fixes still reach them. The built wheel now lists Requires-Dist: certifi>=2026.10.19.
• Synced the release build toolchain pins. .github/actions/setup-hatch (used by release.yml, package-check.yml and pr-preview.yml) still installed virtualenv==21.7.13 and hatchling==1.32.0. Dependabot updates uv.lock but not the pip pins inside composite-action shell steps. Both pins now match the lock and [build-system] (virtualenv==21.14.7, hatchling==1.32.4), so the published artifacts are built with the patched virtualenv.

Notes for reviewers

• uv.lock controls only this repo's dev and CI environment. The new certifi floor is what reaches consumers.
• This patch release includes the requires-python >=3.10 change from fix: update security dependencies for Python 3.10+ #112. On Python 3.9, pip keeps resolving 3.6.0.

Testing

• Built the sdist and wheel locally with hatch==1.18.1, hatchling==1.32.4 and virtualenv==21.14.7 (the new setup-hatch toolchain). twine check passes for both.
• uv lock --check is clean.
• Rebuilt after adding the certifi floor: the wheel's metadata requires certifi>=2026.10.19, and twine check passes. The integration tests need SOCKET_SECURITY_API_KEY and SOCKET_ORG_SLUG, so they were skipped locally.
• Unit tests: 150 passed, 1 skipped.

Public Changelog

Security release: picks up patched certifi, uv and virtualenv versions and requires Python 3.10 or newer. See CHANGELOG.md for details.