chore(ci): Harden the supply chain — harden-runner, Dependabot, pinned dependencies

[lcaflc]

Started as harden-runner on the workflows (step-security docs), to audit outbound calls during the release process. Grew into the rest of the supply-chain hardening.

What is in here

Commit
chore(ci)	harden-runner on every job of both workflows, egress policy audit
ci(deps)	Dependabot: weekly version updates for pip and github-actions, grouped into one PR per ecosystem. Commit prefixes follow the Angular convention so python-semantic-release keeps parsing the history
build(deps)	requirements.lock.txt: the resolved runtime closure, pinned
build(deps)	click>=8,<9: the CLI relies on click.MultiCommand, removed in click 9 — see #89
build!	Security floors, and Python 3.9 dropped

Why the lock file

Dependabot's security updates rely on the dependency graph, and the graph could not see anything useful: unpinned requirements are recorded without a version, and GitHub does not resolve transitive pip dependencies without a lock. The repository showed 17 packages, none with a version, and no transitive dependency at all — so no alert could ever fire, including on cryptography, which is where four high-severity advisories were sitting.

The lock is the detection layer. It protects nobody downstream: it is not in the wheel, and pip never reads it. That is what the floors are for.

⚠️ Breaking change

Python 3.9 is no longer supported, the minimum is 3.10. The fixed releases of urllib3 (2.7.0), requests (2.33.0) and black (26.3.1) all require 3.10, so the floors below and 3.9 were mutually exclusive. Python 3.9 has been end-of-life since October 2025. setup.cfg and the CI matrix follow.

Floors added to requirements.txt, which setup.cfg feeds into install_requires — these are the only constraints that reach users installing from PyPI:

• urllib3>=2.7.0 — 6 advisories, 4 high
• requests>=2.33.0 — 2 advisories
• cryptography>=50.0.0 — 6 advisories, 4 high; not imported directly, but paramiko's own >=3.3 allows vulnerable versions
• black>=26.3.1 — 1 high advisory

Verification

• pytest: 116 passed
• black --check: clean
• pylint src/: 10.00/10
• GitHub advisory database queried for all 23 pinned runtime versions and the 4 dev tools: no advisory remains
• Package metadata checked after build: Requires-Python: >=3.10 and the floors are present in Requires-Dist

Follow-up

• Migrate off click.MultiCommand to lift the click<9 pin #89 — migrate off click.MultiCommand so the <9 pin can be lifted
• CI still installs the unpinned requirements*.txt; now that 3.9 is gone, it could install from the lock instead for reproducible builds

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.