chore(deps): drop Python 3.9 + numpy 1.x (fixes GHSA-6w46-j5rx-g56g)

[Fieldnote-Echo]

What

Remediates GHSA-6w46-j5rx-g56g / CVE-2025-71176 (pytest vulnerable tmpdir handling) by raising the ordvec-python floor to Python 3.10 and numpy 2.0, and removes the Dependabot numpy-floor ignore.

Why this shape (not a plain pytest bump)

pytest's fix (9.0.3) dropped Python 3.9, so there is no patched pytest for 3.9 — 8.4.2 was the newest that ran there. Combined with Python 3.9 being EOL since October 2025, the honest fix is to stop claiming/testing 3.9 rather than ship a wheel for a version we can no longer test with a patched toolchain.

Two related honesty cleanups rode along:

• We declared numpy>=1.20 but only ever tested numpy 2.x (the 3.9 leg tested numpy 2.0.2, never 1.x) — an unverified claim. Floor raised to numpy>=2.0 to match what's actually exercised.
• The Dependabot ignore that pinned the old numpy floor is removed, so numpy is now managed normally.

Changes

• pyproject.toml: requires-python = ">=3.10", drop the 3.9 classifier, numpy>=2.0.
• Cargo.toml: pyo3 abi3-py39 → abi3-py310.
• requirements-dev.txt: regenerated at --python-version 3.10 → pytest 9.0.3 throughout, numpy 2.x, no <3.10 closure.
• python.yml: CI floor leg 3.9 → 3.10.
• release-python.yml: abi3 wheel comments → abi3-py310 / CPython 3.10+.
• dependabot.yml: drop the numpy-floor ignore.
• README.md, CHANGELOG.md: updated.

Notes

• 3.9 runtime support is dropped (requires-python>=3.10); no users affected — PyPI publish is held, so there are none yet.
• Core Rust crate is unaffected — binding-only change.
• Verified locally: binding builds with abi3-py310 (--locked), cargo fmt + clippy -D warnings clean. Full maturin + pytest runs in CI on the new 3.10 matrix.
• Floor-verification caveat: we declare numpy>=2.0, but the lowest version the matrix actually exercises is 2.2.6 (the py3.10 universal resolve). Say the word and I'll add a dedicated numpy==2.0.* floor leg so the literal 2.0 floor is pinned in CI.

[gemini-code-assist]

Code Review

This pull request raises the minimum supported Python version for the ordvec-python bindings to Python 3.10 and the minimum numpy version to 2.0. It updates the PyO3 configuration to target abi3-py310, cleans up Dependabot configurations, and updates development dependencies (including upgrading pytest to 9.0.3 to address CVE-2025-71176). There are no review comments, so no additional feedback is provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Updates the ordvec-python binding package’s supported runtime/toolchain floor to remediate the referenced pytest tmpdir vulnerability by moving to a patched pytest release line (which requires dropping Python 3.9), and aligns declared numpy support with what CI/tooling actually targets.

Changes:

• Raised Python floor to >=3.10 and updated wheel ABI target from abi3-py39 → abi3-py310.
• Raised the Python binding’s runtime dependency floor to numpy>=2.0 and regenerated hash-pinned dev/test requirements (pytest 9.0.3).
• Updated CI/release workflows, Dependabot config, and docs/changelog to reflect the new support policy.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
ordvec-python/requirements-dev.txt	Regenerated universal, hash-pinned dev/test dependency lock for Python 3.10+ (pytest 9.0.3, numpy 2.x).
ordvec-python/README.md	Updated stated wheel support to CPython 3.10+ (abi3).
ordvec-python/pyproject.toml	Dropped Python 3.9 support and raised runtime numpy floor to >=2.0.
ordvec-python/Cargo.toml	Switched PyO3 ABI3 feature from abi3-py39 to abi3-py310.
CHANGELOG.md	Documented the Python floor changes and the security remediation.
.github/workflows/release-python.yml	Updated release workflow comments/labels to reflect abi3-py310 / CPython 3.10+.
.github/workflows/python.yml	Updated CI matrix floor leg from Python 3.9 to 3.10 and clarified abi3 coverage.
.github/dependabot.yml	Removed the numpy-floor ignore so Dependabot manages numpy normally.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.