From f90dab7c2638384170f5735b53aa3f0537fe3c83 Mon Sep 17 00:00:00 2001
From: Karrissa <karrissa.volcy@lob.com>
Date: Tue, 1 Sep 2026 16:17:51 -0400
Subject: [PATCH 1/2] chore(SYN-642): clear high-severity Dependabot findings
 in pip deps

Bump urllib3 1.26.12->2.7.0, certifi 2022.12.7->2026.7.22, requests
2.28.1->2.34.2 (needed for urllib3 2.x compat, unused at runtime), and
idna 3.3->3.19 in requirements.txt. Pin setuptools>=78.1.1,<81 via a
new pyproject.toml [build-system] table, since it wasn't declared as
a dependency anywhere. Update CI matrix to Python 3.10/3.11/3.12 since
the new dependency floors require it (3.8/3.9 are EOL).

Verified: 247/247 unit tests pass, full integration suite run against
the live API (135/148 pass, with the 13 pre-existing failures proven
identical on old vs new deps), pip-audit goes from 23 findings/4
packages to 0, and a real `python -m build --sdist` confirms the
setuptools pin works. Also dismissed 9 stale Dependabot alerts (#5,
#11, #14, #29, #32, #41, #42, #44, #51) attributed to Pipfile.lock,
which was removed from this repo in 0660e89 (2022-09-19) and no longer
exists.
---
 .github/workflows/run_tests.yml | 2 +-
 pyproject.toml                  | 3 +++
 requirements.txt                | 8 ++++----
 3 files changed, 8 insertions(+), 5 deletions(-)
 create mode 100644 pyproject.toml

diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml
index 5140372..f3a5989 100644
--- a/.github/workflows/run_tests.yml
+++ b/.github/workflows/run_tests.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.11"]
+        python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@v4
 
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 0000000..262751d
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,3 @@
+[build-system]
+requires = ["setuptools>=78.1.1,<81"]
+build-backend = "setuptools.build_meta"
diff --git a/requirements.txt b/requirements.txt
index cbeab29..843623f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,9 +1,9 @@
-certifi==2022.12.7
+certifi==2026.7.22
 charset-normalizer==2.1.1
-idna==3.3
+idna==3.19
 lob==4.5.4
 python-dateutil==2.8.2
-requests==2.28.1
+requests==2.34.2
 six==1.16.0
-urllib3==1.26.12
+urllib3==2.7.0
 python-dotenv>=0.21.0

From 18d08b294bd9db0ef2eb69357bb4de2ef4b8d4ef Mon Sep 17 00:00:00 2001
From: Karrissa <karrissa.volcy@lob.com>
Date: Tue, 1 Sep 2026 16:46:55 -0400
Subject: [PATCH 2/2] Bump version to 5.2.1

---
 setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index 21262fc..26825a4 100644
--- a/setup.py
+++ b/setup.py
@@ -11,7 +11,7 @@
 from setuptools import setup, find_packages  # noqa: H301
 
 NAME = "lob-python"
-VERSION = "5.2.0"
+VERSION = "5.2.1"
 # To install the library, run the following
 #
 # python setup.py install