chore(release): 3.6.1 with patched certifi, uv and virtualenv

Cut a release that ships the Dependabot security bumps merged since 3.6.0
(#112, #116, #117, #118, #119).

The release build toolchain in setup-hatch still pinned virtualenv 21.7.13
and hatchling 1.32.0, because Dependabot updates uv.lock but not the pip
pins inside the composite action. Sync them to the locked virtualenv
21.14.7 and the [build-system] hatchling 1.32.4 so published artifacts are
built with the patched versions.

Author: lelia

.github/actions/setup-hatch/action.yml

@@ -9,4 +9,4 @@ runs:
     - shell: bash
       run: |
         python -m pip install --upgrade pip
-        python -m pip install "hatch==1.18.1" "hatchling==1.32.0" "virtualenv==21.7.13"
+        python -m pip install "hatch==1.18.1" "hatchling==1.32.4" "virtualenv==21.14.7"

CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 3.6.1
+
+### Security: patched releases of certifi, uv and virtualenv
+
+- Updated the locked versions of `certifi` (2025.11.12 → 2026.10.19), `uv`
+  (0.11.17 → 0.13.4) and `virtualenv` (20.36.1 → 21.14.7) to pick up fixes for
+  critical vulnerabilities. These versions are pinned in `uv.lock`, which
+  controls the development and CI environment. socketdev does not pin
+  `certifi` for consumers because it comes in through `requests`, so upgrade
+  it in your own environment.
+- The release build toolchain (`.github/actions/setup-hatch`) now installs
+  `virtualenv==21.14.7` and `hatchling==1.32.4`, matching `uv.lock` and the
+  `[build-system]` pin. Published artifacts are built with the patched versions.
+- Raised the `requests` floor to `>=2.33.0`.
+
+### Changed: Python 3.10 or newer is required
+
+- `requires-python` is now `>=3.10` (previously `>=3.9`). The patched
+  dependency releases no longer support Python 3.9, which reached end of life
+  in October 2025. On Python 3.9, pip continues to resolve socketdev 3.6.0.
+
+### Maintenance
+
+- Pinned the `hatchling` build backend to 1.32.4 and capped built
+  distributions at core metadata 2.4 so the locked Twine can validate them.
+- Raised the dev and test extras floors to `hatch>=1.18.1` and
+  `pytest>=9.0.3`.
+
 ## 3.6.0
 
 ### Changed: every API-sourced enum now tolerates unknown values

socketdev/version.py

@@ -1 +1 @@
-__version__ = "3.6.0"
+__version__ = "3.6.1"