deps: raise pip and refresh tool pins

.github/requirements-ci.in

@@ -6,5 +6,5 @@
 # - .github/requirements-ci.txt is regenerated with hashes and auto-committed
 #
 # You only need to edit tox-gh-actions here when you intentionally bump it.
-tox==4.58.0
+tox==4.61.4
 tox-gh-actions==3.5.0

.github/requirements-ci.txt

@@ -54,16 +54,20 @@ tomli-w==1.2.0 \
     --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
     --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
     # via tox
-tox==4.58.0 \
-    --hash=sha256:ab0b126a04dd56bc18e6d216386db09335247f2289b54cf534deb5c4ae3a8d2e \
-    --hash=sha256:dcae21f5f015f3a67658e35644cce0d1aa0dedcd06f3927f95d84e1717f6cea5
+tox==4.61.4 \
+    --hash=sha256:1ec27a26f485c408a3f128722959086099894955d1eb74ab973e233bd362e99e \
+    --hash=sha256:d3fa82dc2fe847fe45b576ed0614e850a674aadec3a664f409e2bf295c473e20
     # via
     #   -r .github/requirements-ci.in
     #   tox-gh-actions
 tox-gh-actions==3.5.0 \
     --hash=sha256:070790114c92f4c94337047515ca5e077ceb269a5cb9366e0a0b3440a024eca1 \
     --hash=sha256:cc8e148c4513042e5019973e5672594c3df241b035e7fb550f6f778588110051
     # via -r .github/requirements-ci.in
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
+    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
+    # via tox
 virtualenv==21.7.0 \
     --hash=sha256:7f9519b9432ff11b6e1a3e94061664efc2ff99ea21780e3cf4f6bd0a5da8b37c \
     --hash=sha256:a8370c1c5530fbabf955e40b8fbbc68a431648b10f9433faa587db30a06e51dd

.github/requirements-update-ci.in

@@ -2,5 +2,5 @@
 # Regenerated with:
 #   pip-compile --generate-hashes --allow-unsafe \
 #     -o .github/requirements-update-ci.txt .github/requirements-update-ci.in
-pip==26.1.2
-pip-tools==7.6.0
+pip==26.2.1
+pip-tools==7.6.1

.github/requirements-update-ci.txt

@@ -18,10 +18,10 @@ packaging==26.2 \
     # via
     #   build
     #   wheel
-pip-tools==7.6.0 \
-    --hash=sha256:4bd99155b6d8de358a214b0865e1a2855a453570c1a83d40f7b564870b8657be \
-    --hash=sha256:c1c59f7844df4866fa9542d3f50d1f44be537ac0027cb50b2563d6a992853981
-    # via -r requirements-update-ci.in
+pip-tools==7.6.1 \
+    --hash=sha256:6111c8b4b07fd14b7223ca921485b0e96cf66e20bf94da95eeed9845f510cb8f \
+    --hash=sha256:695556edeb647eb94ee8345cc7108657fdb7fb16b3876623a399b4f61bbede01
+    # via -r .github/requirements-update-ci.in
 pyproject-hooks==1.2.0 \
     --hash=sha256:1e859bd5c40fae9448642dd871adf459e5e2084186e8d2c2a79a824c970da1f8 \
     --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
@@ -34,11 +34,11 @@ wheel==0.47.0 \
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==26.1.2 \
-    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
-    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
+pip==26.2.1 \
+    --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \
+    --hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f
     # via
-    #   -r requirements-update-ci.in
+    #   -r .github/requirements-update-ci.in
     #   pip-tools
 setuptools==83.0.0 \
     --hash=sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef \

ChangeLog.md

@@ -12,6 +12,8 @@
     are loaded once and shared for performance
   - document threading model (do not share one `PamAuthenticator` across threads)
   - document when to use `resetcreds=True` vs `False` (#52)
+  - bump pip to 26.2.1 (CVE-2026-13346 / GHSA-qwm4-qh6w-59xr)
+  - refresh tox, pylint, mypy, pytest-env, and pip-tools pins
 
 ## 2.0.2 Latest
 March 17, 2022

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "python-pam"
-version = "2.1.0-beta1"
+version = "2.1.0"
 description = ""
 authors = [{name = "David Ford", email = "david@blue-labs.org"}]
 readme = "README.md"
@@ -17,18 +17,18 @@ packages = [{include = "pam", from = "python-pam"}]
 [tool.poetry.group.dev.dependencies]
 pytest = "^9.1.1"
 pytest-cov = "^7.1.0"
-pylint = "^4.0.6"
-tox = "^4.0.0"
+pylint = "^4.0.8"
+tox = "^4.61.4"
 bandit = "*"
-mypy = "*"
+mypy = ">=2.3.1,<3"
 
 [tool.poetry.group.test.dependencies]
 pytest = "^9.1.1"
 pytest-cov = "^7.1.0"
-pytest-env = "^1.7.0"
-tox = "*"
+pytest-env = "^1.7.1"
+tox = ">=4.61.4,<5"
 flake8 = "*"
-pylint = "*"
+pylint = ">=4.0.8,<5"
 
 [tool.coverage.run]
 source = ["pam"]

python-pam/pam/version.py

@@ -1,4 +1,4 @@
 """Version information for python-pam package."""
-VERSION = '2.1.0-beta1'
+VERSION = '2.1.0'
 AUTHOR = 'David Ford <david.ford@blue-labs.org>'
-RELEASED = '2025 December 13'
+RELEASED = '2026 September 16'