[pedro-lb]

bumps two runtime pins in Pipfile.lock:

• certifi 2026.2.25 -> 2026.10.19, closes the critical #45 (emSign root CAs with compromised intermediate keys). due 2026-10-30 under our SOC2 window
• urllib3 2.6.3 -> 2.8.0, closes #38 (chunked deflate infinite loop)

only the default section changes. versions and hashes come from PyPI, the same way Dependabot edits the file. urllib3 2.8.0 needs Python 3.10+, which requests 2.33.0 here already needs.

the published package only requires requests~=2.26, so customers aren't pinned to these. this is the repo's own lockfile.

tested locally: pip install --require-hashes of the default section, then imported requests, urllib3, certifi and constructor_io. the test suite needs TEST_REQUEST_API_KEY, so I didn't run it.

this supersedes Dependabot's #100 (urllib3 2.7.0), which doesn't fix #38. we can close it once this merges.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[constructor-claude-bedrock]

Code Review

This PR bumps certifi (2026.2.25 → 2026.10.19) and urllib3 (2.6.3 → 2.8.0) in Pipfile.lock to address two security advisories; the changes are correct and well-scoped to the dev lockfile only.

Inline comments: 2 discussions added

Overall Assessment: ⚠️ Needs Work

[constructor-claude-bedrock]

Important Issue: The urllib3 2.8.0 marker now requires Python ≥ 3.10, but the repo's Pipfile declares python_version = "3" (i.e. any Python 3.x) and setup.py has no python_requires floor at all — so the published package can theoretically be installed on Python 3.7–3.9.

urllib3 2.8.0 itself does not install on Python < 3.10 (it will resolve to an older version for end-users via the wheel markers), but the locked lockfile will now fail pipenv sync / pip install --require-hashes for anyone on the team still running Python 3.9.

If the project has dropped support for Python < 3.10, this should be made explicit:

• Set python_requires = '>=3.10' in setup.py
• Update [requires] python_version = "3.10" in Pipfile
• Update CI matrix / README accordingly

If Python 3.9 still needs to be supported, urllib3 2.8.0 should not be used here and the lockfile should stay on a >=3.9-compatible release.

[constructor-claude-bedrock]

Suggestion: The PR description correctly notes that requests 2.33.0 in the lockfile already requires Python ≥ 3.10, which makes the upgrade safe for this dev environment. It would be useful to document that reasoning as a comment in Pipfile (e.g. a # Python >=3.10 required by requests 2.33 note next to the urllib3 pin) or in a CHANGELOG/SECURITY.md entry, so future maintainers understand why the floor was raised. This is a minor nit but helps long-term maintainability.