[github-actions]

closes #337

Automated dependency update for poetry.lock.
This PR was created by the workflow dependency-update.yml

Remaining vulnerable dependencies after the automated update:

[
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112906",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112940",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112914",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112913",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112937",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112907",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112938",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112910",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112934",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112909",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112911",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112939",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112915",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112935",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112912",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112908",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "filelock",
    "version": "4.1.0",
    "vulnerability": "CVE-2026-112941",
    "fix_versions": [
      "4.2.1"
    ]
  },
  {
    "name": "tornado",
    "version": "6.5.10",
    "vulnerability": "CVE-2026-116577",
    "fix_versions": [
      "6.6"
    ]
  },
  {
    "name": "tornado",
    "version": "6.5.10",
    "vulnerability": "CVE-2026-115927",
    "fix_versions": [
      "6.6"
    ]
  },
  {
    "name": "tornado",
    "version": "6.5.10",
    "vulnerability": "CVE-2026-116578",
    "fix_versions": [
      "6.6"
    ]
  }
]

After removing Python 3.10:

❯ poetry run -- nox -s dependency:audit
nox > Running session dependency:audit
[]
nox > Session dependency:audit was successful in 6 seconds.

[ckunki]

Proposal: Add removal of python support to the summary, as well, as this might be an important breaking change that should be announced boldly to the users.

See also latest releases in our Java repositories, adding a section "Breaking Changes" to the release letter. Maybe that could be an inspiration for python releases, as well?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud