[pacificcode]

Fixes the HIGH Snyk findings in requirements.txt (ADO/ArmorCode tickets 761395 black, 761468 urllib3).

Changes

package	before	after	why
black	unpinned (Snyk resolved 23.3.0)	26.3.1	Directory Traversal (ticket fix version 26.3.1)
urllib3	2.6.3	2.8.0	2.7.0 fixes the ticketed highs. 2.8.0 also fixes SNYK-PYTHON-URLLIB3-20302844 / -20302845 / -20302846, which Snyk now reports against 2.7.0
requests	2.32.4	2.34.2	SNYK-PYTHON-REQUESTS-15763443 (fixed in 2.33.0)
example.py		black 26 formatting	The Lint workflow installs unpinned black, so it already runs black 26. Without this, Lint fails on the next PR.

Scope

requirements.txt is the README's dev-setup file. pyproject.toml (package metadata, requests >= 2.12.5) and tox.ini (test deps) are unchanged, so the published package and its requires-python >= 3.8 are unaffected. Note: the new pins need Python ≥ 3.10 for local dev setup (black 26, urllib3 2.8 and requests 2.34 all require it).

Results

• Snyk (requirements.txt, Python 3.12): 6 issues → 0 (main: 4 high + 2 medium)
• black --check .: passes

Testing

• The pytest suite needs live TSS_* credentials. Locally it gives the same result on main and this branch (Must provide either tenant or base_url). CI's Run Tests uses tox.ini deps, which this PR doesn't touch.
• SDK smoke test against a stub Secret Server, with urllib3 2.6.3 (main) and 2.8.0 / requests 2.34.2 (this branch): PasswordGrantAuthorizer → POST /oauth2/token, get_secret(42) → ServerSecret with all fields and the password value, the file-attachment field fetch (/secrets/42/fields/private-key), and a missing secret raising SecretServerClientError. Identical behaviour on both.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[pacificcode]

Note on the red build (3.x) checks: they predate this PR.

• The only failures are the 7 test_platform_* tests. All Secret Server tests pass.
• They fail at the Platform login: PasswordGrantAuthorizer.get_access_token() → get_access_grant gets a 4xx from the token URL → SecretServerClientError.
• The same 7 tests fail the same way on feature/server-detection (run 34654835482, 2026-09-11), three weeks before this PR. Run Tests last passed on 2026-08-12 and has failed on every branch since 2026-08-25.
• This PR can't affect them: CI's tox environment installs deps from tox.ini (requests unpinned), not from requirements.txt, which is the only dependency file changed here.

⇒ It looks like the Platform test credentials in the testing environment (TSS_PLATFORM_USERNAME / TSS_PLATFORM_PASSWORD / TSS_PLATFORM_BASE_URL) stopped working between 08-12 and 08-25 (expired or rotated password, locked account, or a tenant change). Whoever owns that test tenant would need to refresh them. Happy to re-run the checks once they're updated.