security: require Python 3.10+, dropping a vulnerable resolution branch (#14)

* security: require Python 3.10+, dropping a vulnerable resolution branch

#11 closed the critical langchain-core advisory, but had a side effect worth
correcting.

langchain-core 1.6.1 requires Python 3.10+, while this package still declared
`requires-python = ">=3.9"`. uv therefore split the resolution, pinning an
older set for the 3.9 branch:

    urllib3   2.6.3   (python < 3.10)   vs  2.7.0   (>= 3.10)
    requests  2.32.5  (python < 3.10)   vs  2.34.2  (>= 3.10)
    orjson    3.11.5  (python < 3.10)   vs  3.12.0  (>= 3.10)

Anyone installing under 3.9 got the left-hand column, which carries three high
and one medium advisory:

    urllib3 2.6.3   GHSA-mf9v-mfxr-j63j  decompression-bomb bypass      high
    urllib3 2.6.3   GHSA-qccp-gfcp-xxvc  headers forwarded cross-origin high
    orjson  3.11.5  GHSA-hx9q-6w63-j58v  unbounded recursion            high
    requests 2.32.5 GHSA-gc5v-m9x4-r6x2  insecure temp file reuse       medium

Raising `requires-python` to >=3.10 collapses the split. It is also honest:
the package's primary dependency dropped 3.9, so claiming 3.9 support was
already inaccurate.

- `requires-python` >=3.9 -> >=3.10
- removed the `Programming Language :: Python :: 3.9` classifier
- CI matrix 3.9-3.13 -> 3.10-3.13

## Verification

Every dual resolution is gone except `websockets` (16.1.1 / 17.1), and neither
of those carries an advisory. Single resolutions now:

    langchain-core 1.6.1   urllib3 2.7.0   requests 2.34.2
    orjson 3.12.0          h11 0.16.0

`uv sync --frozen --all-groups` clean; imports resolve and VectorizeRetriever
still has BaseRetriever in its MRO; urllib3 2.7.0 and requests 2.34.2 confirmed
at runtime.

Claude-Session: https://claude.ai/code/session_01SK2htrNEFAj2VuxKWqFavo

* fix: lint the matrix Pythons, clear anyio, adopt 3.10 annotations

Three things this PR needed to go green and to close the critical anyio
alert (#23, GHSA-82r6-8w77-94w6):

- lint.yml declared a 3.9/3.13 matrix but setup-python read
  python-version-file instead, so it installed the newest release (3.14),
  which pyo3-ffi 0.22 cannot build against. Use the matrix, and drop 3.9 to
  match requires-python >=3.10.
- Re-lock anyio. With 3.9 gone the resolution no longer splits, so the only
  anyio is 4.15.1. Before, the 3.9 branch was pinned to a vulnerable 4.12.1
  because anyio's fixed releases require Python 3.10+.
- ruff's UP045 now applies (Optional[str] -> str | None) since the minimum
  is 3.10; applied with ruff --fix.

Verified locally on 3.10 and 3.13: ruff format --check, ruff check, mypy
all pass. pytest needs VECTORIZE_TOKEN and a paid-plan account (CI fails
with UPGRADE_REQUIRED), so it is environmental and unchanged by this PR.

Claude-Session: https://claude.ai/code/session_014J7s5yzoVEqoZ8LmnD8bQd

Author: cdbartholomew

.github/workflows/lint.yml

@@ -17,7 +17,7 @@ jobs:
         working-directory: ./langchain
     strategy:
       matrix:
-        python-version: ['3.9', '3.13']
+        python-version: ['3.10', '3.13']
     steps:
       - uses: actions/checkout@v4
         with:
@@ -30,7 +30,10 @@ jobs:
       - name: "Set up Python"
         uses: actions/setup-python@v5
         with:
-          python-version-file: "langchain/pyproject.toml"
+          # Use the matrix version. Reading pyproject's requires-python made
+          # setup-python pick the newest release (3.14), which pyo3-ffi 0.22
+          # cannot build against, so the matrix was never actually tested.
+          python-version: ${{ matrix.python-version }}
       - name: Restore uv cache
         uses: actions/cache@v4
         with:

.github/workflows/python_test.yml

@@ -17,7 +17,7 @@ jobs:
             working-directory: ./langchain
     strategy:
       matrix:
-        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
+        python-version: ['3.10', '3.11', '3.12', '3.13']
     steps:
       - uses: actions/checkout@v4
         with:

langchain/langchain_vectorize/retrievers.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Any, Literal, Optional
+from typing import TYPE_CHECKING, Any, Literal
 
 from langchain_core.documents import Document
 from langchain_core.retrievers import BaseRetriever
@@ -109,9 +109,9 @@ def format_docs(docs):
     """The Vectorize API token."""
     environment: Literal["prod", "dev", "local", "staging"] = "prod"
     """The Vectorize API environment."""
-    organization: Optional[str] = None
+    organization: str | None = None
     """The Vectorize organization ID."""
-    pipeline_id: Optional[str] = None
+    pipeline_id: str | None = None
     """The Vectorize pipeline ID."""
     num_results: int = 5
     """The number of documents to return."""

langchain/pyproject.toml

@@ -7,7 +7,7 @@ keywords = ["langchain", "vectorize", "retrieval", "search"]
 authors = [
     { name = "Vectorize", email = "contact@vectorize.io" },
 ]
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 dependencies = [
     "langchain-core>=0.3.45",
     "vectorize-client>=0.4.0",
@@ -17,7 +17,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Topic :: Software Development :: Build Tools",
     "License :: OSI Approved :: MIT License",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",