Clear Dependabot high alert (urllib3)

.github/workflows/ci.yml

@@ -81,7 +81,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.13", "3.12", "3.11", "3.10", "3.9"]
+        python-version: ["3.13", "3.12", "3.11", "3.10"]
     runs-on: ${{matrix.os}}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

CHANGELOG.md

@@ -1,3 +1,15 @@
+## 11.3.1
+
+### Breaking Changes ⚠
+
+- Drop support for Python 3.9. `codecov-cli` now requires Python 3.10 or newer
+  (`requires-python = ">=3.10"`). This is required to adopt `urllib3>=2.7.0`,
+  which patches Dependabot high alerts and no longer supports Python 3.9.
+
+### Internal Changes 🔧
+
+- Floor `urllib3` to `>=2.7.0` and remove Python 3.9 from the CI test matrix.
+
 ## 11.2.8
 
 ### New Features ✨

README.md

@@ -31,13 +31,24 @@ CodecovCLI is a new way for users to interact with Codecov directly from the use
 
 # Installing
 
+> [!IMPORTANT]
+> **Python 3.9 support is dropped.** Starting with this release, `codecov-cli`
+> requires **Python 3.10 or newer**. Python 3.9 reached end-of-life in October
+> 2025, and a security update to `urllib3` (2.7.0) no longer supports 3.9.
+> Please upgrade your runtime (or pin an older `codecov-cli` release) before
+> installing.
+
 ## Using PIP
 To use codecov-cli in your local machine, or your CI workflows, you need to install it:
 
 `pip install codecov-cli`
 
 The above command will download the latest version of Codecov-cli. If you wish to use a specific version, releases can be viewed [here](https://pypi.org/project/codecov-cli/#history).
 
+**Requires Python 3.10+.** On Python 3.9, `pip install codecov-cli` will fail
+to resolve a compatible release; upgrade Python or pin a prior version that
+still supports 3.9.
+
 Note: If you're installing in a `pyenv` environment, you may need to call `pyenv rehash` before the CLI will work.
 
 ## As a Binary
@@ -237,6 +248,9 @@ This repository, like all of Codecov's repositories, strives to follow our gener
 
 ## Requirements
 
+Development and runtime require **Python 3.10 or newer** (Python 3.9 is no
+longer supported).
+
 Most of this package is a very conventional Python package. The main difference is the static the CLI's analysis module uses both git submodules and C code
 
 Before installing, one should pull the submodules with:

codecov.yml

@@ -1,2 +1,9 @@
 ignore:
   - tests/**
+
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1

pyproject.toml

@@ -10,8 +10,9 @@ authors = [
 maintainers = [
     {name = "Codecov Support", email = "support@codecov.io"},
 ]
-requires-python = ">= 3.9"
+requires-python = ">=3.10"
 dependencies = [
+    "urllib3>=2.7.0",
     "click>=8.0.0,<8.3.0",
     "ijson==3.*",
     "PyYAML==6.*",

ruff.toml

@@ -34,8 +34,8 @@ exclude = [
 line-length = 88
 indent-width = 4
 
-# Assume Python 3.9
-target-version = "py39"
+# Assume Python 3.10 (matches requires-python)
+target-version = "py310"
 
 [lint]
 # Enable Pyflakes (`F`) and a subset of the pycodestyle (`E`)  codes by default.