[scottmckenzie]

Summary

Raises the minimum Python from 3.9 to 3.10 so the dev environment can use a fixed pytest. This resolves Dependabot alert #1.

Why

• The alert: CVE-2025-71176 / GHSA-6w46-j5rx-g56g (medium). pytest before 9.0.3 uses predictable /tmp/pytest-of-{user} directories, so another local user can cause a denial of service or possibly gain privileges.
• Why 3.9 was stuck: the fix is only in 9.0.3+, and pytest 9 requires Python 3.10. So uv.lock kept pytest 8.4.2 for Python 3.9, which is affected.
• Python 3.9 stopped getting security fixes in October 2025.
• Impact was low: pytest is a dev dependency and not in the published wheel, the only 3.9 environment was a single-user CI runner, and the suite never uses tmp_path. Fixing it at the source is still cleaner than a permanent dismissal.

Changes

• requires-python = ">=3.10"; ruff target-version = "py310"; pyrefly python-version = "3.10". Ruff's 3.10 upgrade rules found nothing to change.
• pytest>=9.0.3. uv.lock now resolves a single pytest, 9.1.1, instead of 8.4.2 plus 9.1.1.
• CI test matrix: Python 3.10 and 3.14 (was 3.9 and 3.14).
• README says Python 3.10+. CLAUDE.md's Python version section is updated, now allowing X | None at runtime, typing.TypeAlias and match statements.

Compatibility

New releases won't install on Python 3.9. The current PyPI release, 0.1.0, is unaffected: it still installs on any Python 3.

⚠️ Ruleset update needed

The protect-main-master ruleset requires a status check named test (3.9), which this PR removes. Replace it with test (3.10) before merging, or this PR, and every PR after it, will wait forever for a check that never runs.

Test plan

• uv run pytest passes on Python 3.10, 3.12 and 3.14 (47 tests)
• ruff check, ruff format --check, pyrefly check
• uv sync --locked matches the lock file
• Ruleset required check changed from test (3.9) to test (3.10)
• CI passes
• Dependabot alert Support for Holman BTX1 Tap Mounted Smart Valve? #1 closes after merge

🤖 Generated with Claude Code

https://claude.ai/code/session_01T53VSjKogcDk3z3avG76Ay

[scottmckenzie]

Superseded by #13. This PR closed when its branch was renamed from build/python-3.10 to fix/python-3.10 to match the branch naming convention. Same commit, same description.