fix(security): validate daemon requests and update vulnerable dependencies

.github/workflows/ci.yml

@@ -56,8 +56,7 @@ jobs:
           enable-cache: true
       - run: uv python install 3.12
       - run: uv sync --extra dev
-      # CVE-2026-4539: no fixed pygments release yet (last_affected=2.19.2); ignore until upstream ships a patch
-      - run: uv run --with pip-audit pip-audit --ignore-vuln CVE-2026-4539
+      - run: uv run --with pip-audit pip-audit
 
   validate-aur:
     name: Validate AUR PKGBUILD
@@ -104,7 +103,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.12", "3.14"]
+        python-version: ["3.11", "3.12", "3.14"]
         os: [ubuntu-latest, windows-latest]
     steps:
       - name: Checkout
@@ -158,7 +157,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.12", "3.14"]
+        python-version: ["3.11", "3.12", "3.14"]
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -205,7 +204,7 @@ jobs:
   release:
     name: Publish to PyPI + GitHub Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [build-and-verify, test-macos]
+    needs: [build-and-verify, test-macos, security]
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

.github/workflows/docs.yml

@@ -65,7 +65,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
           cache-dependency-path: docs-astro/package-lock.json
 

CONTRIBUTING.md

@@ -83,7 +83,7 @@ Enforced by CI — just follow the tooling:
 ### CI checks on PRs
 
 - Lint (ruff) + type check (mypy)
-- Unit tests — Python 3.10 / 3.12 / 3.14 on Linux + Windows
+- Unit tests — Python 3.11 / 3.12 / 3.14 on Linux + Windows
 - Commitlint — conventional commit format
 - Dependency audit (pip-audit)
 

README.md

@@ -8,7 +8,7 @@
 ```
 
 [![PyPI](https://img.shields.io/pypi/v/rdc-cli)](https://pypi.org/project/rdc-cli/)
-[![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://pypi.org/project/rdc-cli/)
+[![Python](https://img.shields.io/badge/python-3.11%2B-blue)](https://pypi.org/project/rdc-cli/)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Commands](https://img.shields.io/endpoint?url=https://bananasjim.github.io/rdc-cli/badges/commands.json)](https://bananasjim.github.io/rdc-cli/)
 [![Tests](https://img.shields.io/endpoint?url=https://bananasjim.github.io/rdc-cli/badges/tests.json)](https://bananasjim.github.io/rdc-cli/)
@@ -30,6 +30,10 @@ rdc close
 
 ## Install
 
+Requires Python 3.11 or newer. Starting with 0.7.0, rdc-cli requires Pillow 13
+for its security fixes. Python 3.10 users must upgrade Python; rebuild the
+RenderDoc Python module when changing Python minor versions.
+
 **PyPI — Linux** (recommended)
 
 ```bash

aur/PKGBUILD

@@ -7,9 +7,9 @@ arch=('x86_64')
 url="https://github.com/BANANASJIM/rdc-cli"
 license=('MIT')
 depends=(
-  'python'
+  'python>=3.11'
   'python-click'
-  'python-pillow'
+  'python-pillow>=13.0.0'
   'python-numpy'
   'libx11'
   'libxcb'

aur/stable/PKGBUILD

@@ -7,9 +7,9 @@ arch=('x86_64')
 url="https://github.com/BANANASJIM/rdc-cli"
 license=('MIT')
 depends=(
-  'python'
+  'python>=3.11'
   'python-click'
-  'python-pillow'
+  'python-pillow>=13.0.0'
   'python-numpy'
   'libx11'
   'libxcb'

docs-astro/astro.config.mjs

@@ -1,10 +1,8 @@
 import { defineConfig } from 'astro/config';
-import tailwind from '@astrojs/tailwind';
 
 export default defineConfig({
   site: 'https://bananasjim.github.io',
   base: '/rdc-cli/',
-  integrations: [tailwind()],
   output: 'static',
   outDir: 'dist',
 });