[Ferdinand (guzmud)]

Proposed changes

Testing Instructions

1. Step-by-step how to test
2. Environment or config notes

Related issues

• Closes fix(client-python): security updates #367

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

Further comments

[Copilot]

🟡 Changes recommended

The unsupported uv self-update command stops the coverage job before tests run.

1 open issue

• Remove incompatible uv self-update from coverage workflow · New

What changed in this PR

Updates Python client dependencies and CI security tooling for #367.

Changes:

• Adds a minimum certifi version.
• Adds optional Bandit security scanning.
• Updates pip and certificate packages in CI workflows.

File	Description
pyproject.toml	Requires certifi>=2026.10.19.
.github/​workflows/​sats-analysis.yml	Adds optional Bandit scanning.
.github/​workflows/​release.yml	Upgrades pip and certifi before release dependencies.
.github/​workflows/​coverage.yml	Adds pip, certifi, and uv update commands.
.circleci/​config.yml	Upgrades pip and certifi across jobs.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Availability of the specified upstream versions and compatibility with the CI environments remain unverified.

No open issues 🎉

1 resolved since last review

• Remove incompatible uv self-update from coverage workflow

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Dependency and tooling compatibility needs successful validation across the affected GitHub Actions and CircleCI environments.

No open issues 🎉

_{Review effort: Balanced}