[turip]

Raise the Python SDK and examples minimum to Python 3.10 so their HTTP dependencies can use supported security fixes. Add secure dependency floors to published SDK metadata and refresh both Poetry lockfiles, covering the 17 high and 31 medium Dependabot records in these projects. Update the documented minimum and type-check examples as Python 3.10.

Validation:

• Poetry lock consistency checks, dependency installation, and SDK wheel/source builds.
• Python 3.10: synchronous and asynchronous clients list meters and ingest a synthetic event against a local HTTP fixture; SDK byte-compilation and example Pyright checks.
• Python 3.14: SDK build and example Pyright checks.

Compatibility: this intentionally ends Python 3.9 support. SDK consumers receive the secure minimum versions through package metadata rather than relying on this repository's lockfiles.

Confidence Score: 5/5

The PR appears safe to merge; no actionable defects were found.

Summary

Raises the Python SDK and examples minimum to Python 3.10 and adds HTTP dependency floors to the SDK’s published requirements.

• The Python SDK and examples now require Python 3.10.
• SDK installs now require patched HTTP dependency versions.

_{Reviews (1) · Last reviewed commit: "fix(python): require Python 3.10 and pat..." · Reviewed by Greptile}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 6

• api/client/python/README.md is excluded by !api/client/**
• api/client/python/examples/poetry.lock is excluded by !**/*.lock, !api/client/**, !**/*.lock
• api/client/python/examples/pyproject.toml is excluded by !api/client/**
• api/client/python/examples/pyrightconfig.json is excluded by !api/client/**
• api/client/python/poetry.lock is excluded by !**/*.lock, !api/client/**, !**/*.lock
• api/client/python/pyproject.toml is excluded by !api/client/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Source mode: Auto
• Repository: openmeterio/openmeter
• Branch: feat/security-python-dependencies
• File: .coderabbit.yaml
• Commit: 9bfd561
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: cdf68a52-8bfa-4c50-a0df-0d630d477a9f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}