Require Python 3.11 and release it as 1.2.0

.github/workflows/dev.yml

@@ -30,10 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { os: windows-2022, python-version: "3.10" }
+          - { os: windows-2022, python-version: "3.11" }
           - { os: windows-2022, python-version: "3.14" }
           - { os: ubuntu-22.04, python-version: "3.14" }
-          - { os: macos-15, python-version: "3.10" }
+          - { os: macos-15, python-version: "3.11" }
     steps:
       - uses: actions/checkout@v5
         with:

.github/workflows/platform-smoke.yml

@@ -43,12 +43,7 @@ jobs:
         #
         # When both resolve, drop the markers from pyproject.toml.
         os: [windows-2022, ubuntu-22.04, macos-15, ubuntu-22.04-arm, windows-11-arm]
-        python-version: ["3.10", "3.14"]
-        exclude:
-          # CPython's official Windows arm64 builds start at 3.11, so
-          # setup-python has no 3.10 interpreter to fetch on this runner.
-          - os: windows-11-arm
-            python-version: "3.10"
+        python-version: ["3.14"]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v5

.github/workflows/quality.yml

@@ -68,20 +68,19 @@ jobs:
     # systems the project also claims to support. Linux and macOS are
     # here to measure them; they carry the two ends of the supported
     # Python range rather than all five, because what differs between
-    # 3.10 and 3.14 is Python and what differs here is the OS.
+    # 3.11 and 3.14 is Python and what differs here is the OS.
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { os: windows-2022, python-version: "3.10" }
           - { os: windows-2022, python-version: "3.11" }
           - { os: windows-2022, python-version: "3.12" }
           - { os: windows-2022, python-version: "3.13" }
           - { os: windows-2022, python-version: "3.14" }
-          - { os: ubuntu-22.04, python-version: "3.10" }
+          - { os: ubuntu-22.04, python-version: "3.11" }
           - { os: ubuntu-22.04, python-version: "3.14" }
-          - { os: macos-15, python-version: "3.10" }
+          - { os: macos-15, python-version: "3.11" }
           - { os: macos-15, python-version: "3.14" }
     steps:
       - uses: actions/checkout@v5

.github/workflows/stable.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14" ]
+        python-version: [ "3.11", "3.12", "3.13", "3.14" ]
 
     steps:
       - uses: actions/checkout@v5

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [1.2.0] - 2026-11-02
+
+Python 3.11 is now the minimum. Pillow 13.0.0 and dnspython 2.9.0, the releases that fix the advisories
+Dependabot reports, need 3.11. While 3.10 was supported, the package had to pin Pillow 12.3.0 for it, and the
+lock kept dnspython 2.8.0. `pip` on Python 3.10 keeps installing 1.1.0.
+
+- `requires-python` is `>=3.11`. The dependency is a single `pillow==13.0.0`, and the dnspython constraint
+  applies on every interpreter.
+- The CI cells that ran 3.10 to cover Windows, Ubuntu and macOS now run 3.11, and mypy checks against 3.11.
+- `je_auto_control.api` is unchanged.
+
 ## [1.1.0] - 2026-11-02
 
 1.1.0 merges the development line into the release line. The development line re-implemented several

CLAUDE.md

@@ -4,7 +4,7 @@
 
 AutoControl (`je_auto_control`) is a cross-platform GUI automation framework: mouse and keyboard control, image recognition, OCR, accessibility-tree and VLM element location, action scripting, and report generation behind one API. Backends: Windows (Win32 ctypes), macOS (pyobjc/Quartz), Linux X11 (python-Xlib), Linux Wayland (libei / ydotool), Android (adb), iOS (WebDriverAgent).
 
-- **Package**: `je_auto_control` · **Python** ≥ 3.10 · **License**: MIT · **Author**: JE-Chen
+- **Package**: `je_auto_control` · **Python** ≥ 3.11 · **License**: MIT · **Author**: JE-Chen
 - **[architecture_explore.md](architecture_explore.md)** is the per-module map — read it before changing structure; it lists all 312 `utils/` subpackages, every GUI tab, and file-level tables for the large subsystems.
 
 ## Architecture

Progress.md

@@ -561,6 +561,7 @@ U-20261009-18 的每一個裝置面呼叫都只對假的 ADB／uiautomator2／WD
 `TODO` — `test/unit_test/headless/test_usb_acl_prompt.py::test_bridge_remember_persists_acl_rule`
 在 Python 3.10 的 Linux／macOS `coverage run -m pytest` 中仍有間歇 SIGSEGV（exit 139）紀錄。
 需在對應環境開啟 `faulthandler` 重跑並定位原生呼叫；單次重跑通過不足以證明已修復。
+2026-11-02 起不再支援 Python 3.10，CI 不再跑 3.10；同一機制（分配時觸發循環回收）在 3.11 也存在，改看 3.11 的方格。
 
 ---
 

README.md

@@ -786,8 +786,7 @@ management, the accessibility tree, the action executor, the MCP/REST/TCP
 servers and the GUI all work — measured, not assumed. Every other platform
 is unaffected.
 
-**Requirements:** Python ≥ 3.10 (≥ 3.11 on Windows arm64, which is where
-CPython's official builds for it start). On Linux, install build
+**Requirements:** Python ≥ 3.11. On Linux, install build
 prerequisites first:
 
 ```bash

README/README_zh-CN.md

@@ -634,7 +634,7 @@ ACME／TLS 与加密录影会抛出指名缺哪个 wheel 的错误，而不是
 鼠标、键盘、屏幕尺寸、窗口管理、无障碍树、动作执行器、MCP／REST／TCP 服务器
 与 GUI 都正常——这是实测的，不是推论的。其他平台不受影响。
 
-**系统需求：** Python ≥ 3.10（Windows arm64≥ 3.11，CPython 官方构建从那里开始）。
+**系统需求：** Python ≥ 3.11。
 Linux 请先安装构建依赖：
 
 ```bash

README/README_zh-TW.md

@@ -633,7 +633,7 @@ ACME／TLS 與加密錄影會拋出指名缺哪個 wheel 的錯誤，而不是
 滑鼠、鍵盤、螢幕尺寸、視窗管理、無障礙樹、動作執行器、MCP／REST／TCP 伺服器
 與 GUI 都正常——這是實測的，不是推論的。其他平台不受影響。
 
-**系統需求：** Python ≥ 3.10（Windows arm64≥ 3.11，CPython 官方建置從那裡開始）。
+**系統需求：** Python ≥ 3.11。
 Linux 請先安裝建置前置套件：
 
 ```bash

Third_Party_License.md

@@ -11,7 +11,7 @@ Full copies of the upstream license texts are archived under `LICENSEs/`.
 | Package | Version | License | Purpose |
 |---|---|---|---|
 | [je_open_cv](https://pypi.org/project/je-open-cv/) | 0.0.22 | MIT | OpenCV-based image recognition helpers (`locate_all_image`, template match) |
-| [Pillow](https://pypi.org/project/Pillow/) | 13.0.0 (12.3.0 on Python 3.10) | MIT-CMU (HPND) | Screenshot encoding, image I/O |
+| [Pillow](https://pypi.org/project/Pillow/) | 13.0.0 | MIT-CMU (HPND) | Screenshot encoding, image I/O |
 | [mss](https://pypi.org/project/mss/) | 10.1.0 | MIT | Fast multi-monitor screenshot backend |
 | [pyobjc-core](https://pypi.org/project/pyobjc-core/) | 12.1 | MIT | macOS backend — Python/Objective-C bridge *(Darwin only)* |
 | [pyobjc](https://pypi.org/project/pyobjc/) | 12.1 | MIT | macOS backend — Cocoa / Quartz bindings *(Darwin only)* |

architecture_explore.md

@@ -34,7 +34,7 @@ iOS（WebDriverAgent）。核心能力是滑鼠／鍵盤控制、影像辨識、
 | `test_*.py` 測試檔／測試函式 | 846 / 8,825 |
 | 範例腳本 | 45 |
 
-**技術基線**：Python ≥ 3.10、MIT 授權、必要相依只有 `je_open_cv`／`opencv-python`／`pillow`／`mss`／
+**技術基線**：Python ≥ 3.11、MIT 授權、必要相依只有 `je_open_cv`／`opencv-python`／`pillow`／`mss`／
 `defusedxml`／`cryptography`（加上各平台專屬的 pyobjc、python-Xlib）；其餘全部是選用 extras
 （`gui`、`webrtc`、`signaling`、`discovery`、`pdf`、`office`、`fuzzy`、`s3`、`locale`、`audio`）。
 大量子系統刻意只用標準庫實作（REST 伺服器、JSON Schema、JWT、TOTP、WebSocket 框架、ACME、
@@ -1435,7 +1435,7 @@ GUI 是**選用 extra**（`pip install je_auto_control[gui]`，只需要 PySide6
 | 檔案 | 用途 |
 | --- | --- |
 | `stable.yml` | 每次 push／PR 到 `main` 與每日排程跑 Windows 五版本的示範腳本；合併到 main 後由 `scripts/stable_release.py` 決定版本（`pyproject.toml` 宣告的版本已有 tag 就加一個 patch，還沒有 tag 就照寫的發，minor／major 版就是這樣發的）並上傳 PyPI（使用 `PYPI_API_TOKEN`）。`publish` job 只安裝雜湊鎖定的 `.github/requirements/publish.txt`（`build`、`twine` 與建置後端 `setuptools`，由同目錄的 `publish.in` 用 `uv pip compile` 產生），並以 `python -m build --no-isolation` 建置，所以建置後端也是鎖定的那一版。 |
-| `dev.yml` | 每次 push／PR 到 `dev` 跑 headless pytest（四格：Windows 的 3.10 與 3.14、Ubuntu 3.14、macOS 3.10，都是 `quality.yml` 九格裡的格子，不量 coverage）。push 通過後由 `publish-dev` job 用 `dev.toml` 建置並上傳 `je_auto_control_dev`（同一個 `PYPI_API_TOKEN`）；只有這個 commit 仍是 `dev` 的最新一筆、而且 wheel 內容跟 PyPI 最新一版不同時才上傳，版本由 `scripts/dev_release.py` 向 PyPI 查，不回寫 repo。`publish-dev` 跟 `stable.yml` 的 `publish` 一樣只安裝 `.github/requirements/publish.txt` 並以 `python -m build --no-isolation` 建置；`test_publish_tooling_lock.py` 守住這兩個 job 的安裝行、建置指令，以及鎖定版本滿足 `pyproject.toml`／`dev.toml` 的 `build-system.requires`。 |
+| `dev.yml` | 每次 push／PR 到 `dev` 跑 headless pytest（四格：Windows 的 3.11 與 3.14、Ubuntu 3.14、macOS 3.11，都是 `quality.yml` 九格裡的格子，不量 coverage）。push 通過後由 `publish-dev` job 用 `dev.toml` 建置並上傳 `je_auto_control_dev`（同一個 `PYPI_API_TOKEN`）；只有這個 commit 仍是 `dev` 的最新一筆、而且 wheel 內容跟 PyPI 最新一版不同時才上傳，版本由 `scripts/dev_release.py` 向 PyPI 查，不回寫 repo。`publish-dev` 跟 `stable.yml` 的 `publish` 一樣只安裝 `.github/requirements/publish.txt` 並以 `python -m build --no-isolation` 建置；`test_publish_tooling_lock.py` 守住這兩個 job 的安裝行、建置指令，以及鎖定版本滿足 `pyproject.toml`／`dev.toml` 的 `build-system.requires`。 |
 | `release.yml` | 發佈流程（上傳步驟目前關閉）。 |
 | `quality.yml` | ruff、bandit、dependency review、九格矩陣的 headless pytest（含 coverage 地板）與 mypy。 |
 | `platform-smoke.yml` | 跨平台煙霧測試。 |

autocontrol-lsp/pyproject.toml

@@ -11,7 +11,7 @@ authors = [
 ]
 readme = "README.md"
 license = { text = "MIT" }
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 dependencies = [
   # Only stdlib — but discovery imports je_auto_control at runtime
   # to pull the AC_* command list out of the executor. So a working

dev.toml

@@ -17,16 +17,14 @@ authors = [
     { name = "JE-Chen", email = "jechenmailman@gmail.com" },
 ]
 description = "GUI Automation Framework"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 license-files = ["LICENSE"]
 dependencies = [
     "je_open_cv==0.0.22; sys_platform != 'win32' or platform_machine != 'ARM64'",
     "opencv-python>=4.8,<6; sys_platform != 'win32' or platform_machine != 'ARM64'",
     # Pillow 13.0.0 fixes the 12.x advisories (critical: GHSA-v9pv-5gc8-w2m6,
-    # GHSA-5x8w-8jj5-q52h) but needs Python >=3.11; 3.10 keeps 12.3.0, the
-    # newest release it can install.
-    "pillow==12.3.0; python_version < '3.11'",
-    "pillow==13.0.0; python_version >= '3.11'",
+    # GHSA-5x8w-8jj5-q52h).
+    "pillow==13.0.0",
     "pyobjc-core==12.2.2;platform_system=='Darwin'",
     "pyobjc==12.2.2;platform_system=='Darwin'",
     "python-Xlib==0.33;platform_system=='Linux' or platform_system=='FreeBSD' or platform_system=='OpenBSD' or platform_system=='NetBSD'",
@@ -35,7 +33,6 @@ dependencies = [
     "cryptography>=50.0.0; sys_platform != 'win32' or platform_machine != 'ARM64'"
 ]
 classifiers = [
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",

docs/source/Eng/doc/installation/installation_doc.rst

@@ -12,7 +12,7 @@ Install from PyPI
 Requirements
 ============
 
-* Python 3.10 or higher
+* Python 3.11 or higher
 * pip 19.3 or higher
 
 With GUI Support

docs/source/Eng/doc/operations_layer/usb_passthrough_operator_guide.rst

@@ -23,7 +23,7 @@ Prerequisites
 
 On the **host** (the machine with the physical USB device):
 
-- Python 3.10+ with AutoControl installed.
+- Python 3.11+ with AutoControl installed.
 - The optional ``webrtc`` extra: ``pip install je_auto_control[webrtc]``.
 - ``pyusb`` installed if you want the libusb backend:
   ``pip install pyusb``.
@@ -32,7 +32,7 @@ On the **host** (the machine with the physical USB device):
 
 On the **viewer** (the remote machine that will use the device):
 
-- Python 3.10+ with AutoControl installed.
+- Python 3.11+ with AutoControl installed.
 - Network reach to the host's REST API port (default 9939) **and** to
   the WebRTC signalling / TURN endpoints if the viewer is behind NAT.
 - The host's bearer token (operator hands it over out-of-band).

docs/source/Zh/doc/installation/installation_doc.rst

@@ -12,7 +12,7 @@
 系統需求
 ========
 
-* Python 3.10 以上
+* Python 3.11 以上
 * pip 19.3 以上
 
 安裝 GUI 支援

docs/source/Zh/doc/operations_layer/usb_passthrough_operator_guide.rst

@@ -21,7 +21,7 @@ production。``default_passthrough_backend()`` 會依當前 OS 自動挑 backend
 
 在 **host**\ （有實體 USB 裝置的機器）上：
 
-- Python 3.10+ 並安裝 AutoControl。
+- Python 3.11+ 並安裝 AutoControl。
 - 選用的 ``webrtc`` 套件：``pip install je_auto_control[webrtc]``\ 。
 - 如要使用 libusb backend 需安裝 ``pyusb``\ ：
   ``pip install pyusb``\ 。
@@ -30,7 +30,7 @@ production。``default_passthrough_backend()`` 會依當前 OS 自動挑 backend
 
 在 **viewer**\ （將使用該裝置的遠端機器）上：
 
-- Python 3.10+ 並安裝 AutoControl。
+- Python 3.11+ 並安裝 AutoControl。
 - 能連到 host 的 REST API port（預設 9939），**且** 在 NAT 後方時
   能連到 WebRTC signalling / TURN 端點。
 - host 的 bearer token（操作員以帶外管道交付）。

docs/source/getting_started/installation.rst

@@ -5,7 +5,7 @@ Installation
 Requirements
 ============
 
-* **Python** >= 3.10
+* **Python** >= 3.11
 * **pip** >= 19.3
 
 Basic Installation

docs/updates/2026-11.md

@@ -620,4 +620,12 @@ Index and query commands: [README.md](README.md). New entries go at the end.
 - **Verification**: ruff, bandit, `radon cc -nc`, `generate_facade_exports.py
   --check`, `typing_contract_verify.py` (both modes) and the doc-count and
   budget tests pass; `architecture_explore.md` line counts re-measured.
+
+## U-20261102-03 · 2026-11-02 · Require Python 3.11; stop supporting 3.10 · #migration #deps #ci
+
+- **Why**: every package in the workspace moves its floor to Python 3.11 together. Security releases such as Pillow 13.0.0 need 3.11, and supporting 3.10 kept older, vulnerable versions in the locks.
+- **What**: `requires-python` is `>=3.11` and the 3.10 classifier is gone; the CI matrices start at 3.11; the docs that gave 3.10 as the floor now give 3.11.
+- **Locks**:
+  - `uv.lock`: the 3.10-only branches are gone; removed: `exceptiongroup`, `tomli`; one version left instead of a 3.10 one beside it: `dnspython`, `numpy`, `pillow`.
+- **Also**: The Pillow dependency is a single `pillow==13.0.0`, and the dnspython constraint applies on every interpreter. The Pillow and dnspython Dependabot alerts were open only because of the 3.10 entries. The CI cells that ran 3.10 to cover Windows, Ubuntu and macOS now run 3.11, and mypy targets 3.11. The version is declared as 1.2.0, and CHANGELOG.md says what changed.
 - **Open items**: none.

docs/updates/README.md

@@ -58,7 +58,9 @@ In the same commit: delete the item from `Progress.md`, add a `#done` entry here
 
 | ID | Date | Title | Tags | Batch |
 |---|---|---|---|---|
+| U-20261102-03 | 2026-11-02 | Require Python 3.11; stop supporting 3.10 | #migration #deps #ci | [2026-11](2026-11.md) |
 | U-20261102-02 | 2026-11-02 | Clear the SonarCloud findings the 1.1.0 release PR reported | #ci #test #quality | [2026-11](2026-11.md) |
+| U-20261102-01 | 2026-11-02 | Merge the release line into dev for 1.1.0 | #release #migration | [2026-11](2026-11.md) |
 | U-20261101-17 | 2026-11-01 | Patch the dependencies named in Dependabot security alerts | #bugfix #deps #security #ci | [2026-11](2026-11.md) |
 | U-20261101-16 | 2026-11-01 | Accept either refusal when a revocation races the lease watch | #incident #ci #test | [2026-11](2026-11.md) |
 | U-20261101-15 | 2026-11-01 | Observe only the maintenance call's own writes in the receipt test | #incident #ci #test | [2026-11](2026-11.md) |
@@ -605,7 +607,7 @@ In the same commit: delete the item from `Progress.md`, add a `#done` entry here
 
 | File | Period | Entries |
 |---|---|---:|
-| [2026-11.md](2026-11.md) | 2026-11 | 17 |
+| [2026-11.md](2026-11.md) | 2026-11 | 20 |
 | [2026-10-f.md](2026-10-f.md) | 2026-10 | 5 |
 | [2026-10-e.md](2026-10-e.md) | 2026-10 | 91 |
 | [2026-10-d.md](2026-10-d.md) | 2026-10 | 15 |

pyproject.toml

@@ -6,12 +6,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "je_auto_control"
-version = "1.1.0"
+version = "1.2.0"
 authors = [
     { name = "JE-Chen", email = "jechenmailman@gmail.com" },
 ]
 description = "GUI Automation Framework"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 license-files = ["LICENSE"]
 dependencies = [
     # Three requirements below carry the same marker, and it excludes exactly
@@ -45,10 +45,8 @@ dependencies = [
     # OpenCV release cannot silently change cv2 return shapes under us.
     "opencv-python>=4.8,<6; sys_platform != 'win32' or platform_machine != 'ARM64'",
     # Pillow 13.0.0 fixes the 12.x advisories (critical: GHSA-v9pv-5gc8-w2m6,
-    # GHSA-5x8w-8jj5-q52h) but needs Python >=3.11; 3.10 keeps 12.3.0, the
-    # newest release it can install.
-    "pillow==12.3.0; python_version < '3.11'",
-    "pillow==13.0.0; python_version >= '3.11'",
+    # GHSA-5x8w-8jj5-q52h).
+    "pillow==13.0.0",
     "pyobjc-core==12.2.2;platform_system=='Darwin'",
     "pyobjc==12.2.2;platform_system=='Darwin'",
     # The BSDs run the same X11 stack, and platform_system is the kernel
@@ -60,7 +58,6 @@ dependencies = [
     "cryptography>=50.0.0; sys_platform != 'win32' or platform_machine != 'ARM64'"
 ]
 classifiers = [
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -129,10 +126,9 @@ locale = ["babel>=2.12"]
 audio = ["pycaw>=20240210"]
 
 # Lock-only security floor for a transitive dependency (uv.lock; the wheel
-# metadata is unchanged). dnspython 2.9.0 fixes the advisory in 2.8.0 but
-# needs Python >=3.11, so 3.10 keeps 2.8.0.
+# metadata is unchanged). dnspython 2.9.0 fixes the advisory in 2.8.0.
 [tool.uv]
-constraint-dependencies = ["dnspython>=2.9.0; python_version >= '3.11'"]
+constraint-dependencies = ["dnspython>=2.9.0"]
 
 # CLAUDE.md's 120-character line limit. Without this table CI's `ruff check`
 # ran the default rule set, which has no E501, so the documented limit was
@@ -246,7 +242,7 @@ precision = 2
 fail_under = 81
 
 [tool.mypy]
-python_version = "3.10"
+python_version = "3.11"
 warn_redundant_casts = true
 check_untyped_defs = true
 no_implicit_optional = true
@@ -334,7 +330,7 @@ ignore_missing_imports = true
 
 [[tool.mypy.overrides]]
 # numpy's stubs use `type` statements, which mypy rejects while parsing under
-# python_version 3.10 — skip them; the stable API does not expose numpy types.
+# python_version below 3.12 — skip them; the stable API does not expose numpy types.
 # The top-level `numpy` module must be listed explicitly: `numpy.*` only matches
 # submodules, so numpy>=2.5's PEP 695 statements in numpy/__init__.pyi would leak.
 # `follow_imports_for_stubs` is required — otherwise `follow_imports = skip` is