version 4.0.0 - bump dependencies and drop Python 3.8/3.9 (security)

[dianaKhortiuk-frontegg]

version 4.0.0

Security-driven dependency refresh. Regenerates poetry.lock so an OSV / pip-audit scan reports 0 known vulnerabilities across the full tree (main, extras, and dev). The Nov-2024 lockfile pinned many now-vulnerable versions (aiohttp 3.9.1, urllib3 1.26.18, certifi 2023.11.17, starlette 0.35.1, jinja2 3.1.3, werkzeug 3.0.1, …).

⚠️ Breaking change — Python 3.10+ required (major bump)

The 2026 security fixes for requests, aiohttp, starlette, and click require Python ≥ 3.10, and the patched cryptography / PyJWT releases dropped Python 3.8. Since Python 3.8 (EOL Oct 2024) and 3.9 (EOL Oct 2025) are both end-of-life, the minimum supported Python is raised to 3.10. Consistent with 3.0.0, which dropped Python 3.7 → this is 4.0.0.

Changes

Shipped dependencies (pyproject.toml):

package	before	after (locked)
requests	^2.28.2	^2.33.0 → 2.34.2
aiohttp (extra)	^3.6.2	^3.14.1 → 3.14.1
PyJWT	^2.6.0	^2.10.1 → 2.13.0
cryptography	>=42.0.5	>=44.0.1 → 49.0.0
flask (extra)	^2.0	^3.1.3 → 3.1.3
urllib3 (trans.)	1.26.18	2.7.0
starlette (trans.)	0.35.1	1.3.1
certifi / idna / jinja2 / werkzeug / click	—	2026.6.17 / 3.18 / 3.1.6 / 3.1.8 / 8.4.2

Dev tooling — modernized for Python 3.10+ (old versions don't install on 3.10+): pytest 5→9, flake8 3→7, autopep8 1→2, pydocstyle 5→6, pytest-flask 0.15→1.3, flask-cors 3→6, uvicorn 0.18→0.34; removed the deprecated flake8-mypy.

Docs / meta: version 3.0.3 → 4.0.0, classifiers → 3.10–3.13, tox.ini → py310-py313, README Breaking Changes + Security section (disclosure to security@frontegg.com).

Verification

• OSV/pip-audit: 0 vulnerabilities across the full poetry.lock.
• Smoke test on Python 3.13: all shipped modules import and the Flask (3.1.3) and FastAPI (0.139 / starlette 1.3.1) Frontegg integrations instantiate cleanly.

Note (pre-existing, out of scope)

tests/conftest.py on master imports frontegg.flask2.flask, a module that doesn't exist in the repo, so the suite fails to collect regardless of deps (verification was done via smoke tests). The vestigial Pipfile / Pipfile.lock (a different, unmanaged package set, referenced only by .gitignore) were left untouched — candidates for a follow-up cleanup.

🤖 Generated with Claude Code

[dianaKhortiuk-frontegg]

Folded in the test-suite repair from #151 (the broken frontegg.flask2 conftest import + obsolete proxy tests, replaced with network-free tests against the current frontegg.flask API). #151 is now closed as superseded — this PR is the single consolidated 4.0.0 change. Verified: 5 tests pass, OSV audit 0 vulnerabilities, Flask/FastAPI smoke test clean.

[dianaKhortiuk-frontegg]

Also folded in the comprehensive test suite from #148 (26 unit files + 3 e2e files: Flask/FastAPI secure access + a credential-gated live-vendor-auth suite; conftest mints real RS256 JWTs and fakes the vendor-token HTTP call). Adapted to the 4.0.0 stack and verified: 162 passed, 31 skipped (live vendor auth needs credentials), 0 failures, on Python 3.13 / pytest 9 / Flask 3 / FastAPI+starlette 1.x / cryptography 49 / PyJWT 2.13. Added fakeredis as a dev dependency and removed the obsolete proxy-era tests. OSV audit remains 0 vulnerabilities. #148 will be closed as superseded — this PR is now the single consolidated 4.0.0 change (deps + security + full test suite).