From 911fb5a327212d38c620300cf37c1ee0c35ba15b Mon Sep 17 00:00:00 2001
From: shuningc <shuningc@splunk.com>
Date: Mon, 27 Jul 2026 13:15:14 -0700
Subject: [PATCH 1/6] fix(security): VULN-88817 bump python-dotenv to 1.2.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lock-only bump for transitive python-dotenv (1.1.1 → 1.2.2) to fix
symlink-following in set_key()/unset_key(). Example pins set to 1.2.2.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 poetry.lock | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index cd855d9e..c9321386 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -4667,25 +4667,25 @@ files = [
 
 [[package]]
 name = "requests"
-version = "2.32.4"
+version = "2.34.2"
 description = "Python HTTP for Humans."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main", "test"]
 files = [
-    {file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"},
-    {file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"},
+    {file = "requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0"},
+    {file = "requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed"},
 ]
 
 [package.dependencies]
-certifi = ">=2017.4.17"
+certifi = ">=2023.5.7"
 charset_normalizer = ">=2,<4"
 idna = ">=2.5,<4"
-urllib3 = ">=1.21.1,<3"
+urllib3 = ">=1.26,<3"
 
 [package.extras]
 socks = ["PySocks (>=1.5.6,!=1.5.7)"]
-use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"]
+use-chardet-on-py3 = ["chardet (>=3.0.2,<8)"]
 
 [[package]]
 name = "requests-mock"

From ba23658e3916924b9b40086e7efca52e6a444e22 Mon Sep 17 00:00:00 2001
From: shuningc <shuningc@splunk.com>
Date: Mon, 27 Jul 2026 13:15:32 -0700
Subject: [PATCH 2/6] fix(security): VULN-88817 update example python-dotenv
 pins to 1.2.2

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 examples/agent/startup-simulator-3000/requirements.txt        | 2 +-
 examples/logging-samples/distributed-tracing/requirements.txt | 2 +-
 examples/logging-samples/openai-responses/requirements.txt    | 2 +-
 examples/rag/elastic-chatbot-rag-app/requirements.txt         | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/examples/agent/startup-simulator-3000/requirements.txt b/examples/agent/startup-simulator-3000/requirements.txt
index c8647416..dc11a31c 100644
--- a/examples/agent/startup-simulator-3000/requirements.txt
+++ b/examples/agent/startup-simulator-3000/requirements.txt
@@ -34,7 +34,7 @@ pydantic-core
 pydantic-settings
 pyjwt==2.10.1
 python-dateutil==2.9.0.post0
-python-dotenv==1.1.0
+python-dotenv==1.2.2
 pyyaml==6.0.2
 regex==2024.11.6
 requests==2.32.3
diff --git a/examples/logging-samples/distributed-tracing/requirements.txt b/examples/logging-samples/distributed-tracing/requirements.txt
index 68354569..f9c5c2b9 100644
--- a/examples/logging-samples/distributed-tracing/requirements.txt
+++ b/examples/logging-samples/distributed-tracing/requirements.txt
@@ -1,5 +1,5 @@
 # Core dependencies
-python-dotenv==1.1.1
+python-dotenv==1.2.2
 pydantic==2.11.9
 
 # HTTP and Web Framework
diff --git a/examples/logging-samples/openai-responses/requirements.txt b/examples/logging-samples/openai-responses/requirements.txt
index c9a86ecd..53781530 100644
--- a/examples/logging-samples/openai-responses/requirements.txt
+++ b/examples/logging-samples/openai-responses/requirements.txt
@@ -57,7 +57,7 @@ pyjwt==2.10.1
     #   galileo-core
 python-dateutil==2.9.0.post0
     # via splunk-ao
-python-dotenv==1.2.1
+python-dotenv==1.2.2
     # via pydantic-settings
 six==1.17.0
     # via python-dateutil
diff --git a/examples/rag/elastic-chatbot-rag-app/requirements.txt b/examples/rag/elastic-chatbot-rag-app/requirements.txt
index 77822922..f0bab607 100644
--- a/examples/rag/elastic-chatbot-rag-app/requirements.txt
+++ b/examples/rag/elastic-chatbot-rag-app/requirements.txt
@@ -378,7 +378,7 @@ python-dateutil==2.9.0.post0
     # via
     #   botocore
     #   google-cloud-bigquery
-python-dotenv==1.0.1
+python-dotenv==1.2.2
     # via pydantic-settings
 pyyaml==6.0.2
     # via

From 9f40a3a25f60bdf2c10512097d557f8bfef55b19 Mon Sep 17 00:00:00 2001
From: shuningc <shuningc@splunk.com>
Date: Mon, 27 Jul 2026 13:24:02 -0700
Subject: [PATCH 3/6] fix(deps): require python-dotenv >=1.2.2 for VULN-88817
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add direct python-dotenv floor and regenerate poetry.lock (1.1.1 → 1.2.2).
Fixes symlink-following in set_key()/unset_key(). Reverts accidental
requests bump from prior lock edit.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 poetry.lock    | 24 ++++++++++++------------
 pyproject.toml |  1 +
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index c9321386..d1114efa 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -4428,14 +4428,14 @@ six = ">=1.5"
 
 [[package]]
 name = "python-dotenv"
-version = "1.1.1"
+version = "1.2.2"
 description = "Read key-value pairs from a .env file and set them as environment variables"
 optional = false
-python-versions = ">=3.9"
+python-versions = ">=3.10"
 groups = ["main", "test"]
 files = [
-    {file = "python_dotenv-1.1.1-py3-none-any.whl", hash = "sha256:31f23644fe2602f88ff55e1f5c79ba497e01224ee7737937930c448e4d0e24dc"},
-    {file = "python_dotenv-1.1.1.tar.gz", hash = "sha256:a8a6399716257f45be6a007360200409fce5cda2661e3dec71d23dc15f6189ab"},
+    {file = "python_dotenv-1.2.2-py3-none-any.whl", hash = "sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a"},
+    {file = "python_dotenv-1.2.2.tar.gz", hash = "sha256:2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3"},
 ]
 
 [package.extras]
@@ -4667,25 +4667,25 @@ files = [
 
 [[package]]
 name = "requests"
-version = "2.34.2"
+version = "2.32.4"
 description = "Python HTTP for Humans."
 optional = false
-python-versions = ">=3.10"
+python-versions = ">=3.8"
 groups = ["main", "test"]
 files = [
-    {file = "requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0"},
-    {file = "requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed"},
+    {file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"},
+    {file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"},
 ]
 
 [package.dependencies]
-certifi = ">=2023.5.7"
+certifi = ">=2017.4.17"
 charset_normalizer = ">=2,<4"
 idna = ">=2.5,<4"
-urllib3 = ">=1.26,<3"
+urllib3 = ">=1.21.1,<3"
 
 [package.extras]
 socks = ["PySocks (>=1.5.6,!=1.5.7)"]
-use-chardet-on-py3 = ["chardet (>=3.0.2,<8)"]
+use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"]
 
 [[package]]
 name = "requests-mock"
@@ -6543,4 +6543,4 @@ openai = ["openai", "openai-agents", "packaging"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.11,<3.15"
-content-hash = "4be09f07a946e37f06e9a22b5c1030028f221d96b2b7c87e89d14fce070f9b97"
+content-hash = "cba79784b39f8bd20c5de20e1dbca9985cca59ec4b216e879f1d40989c61343c"
diff --git a/pyproject.toml b/pyproject.toml
index 6867c1fe..521b89c8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -53,6 +53,7 @@ opentelemetry-api = "^1.38.0"
 opentelemetry-exporter-otlp-proto-http = "^1.38.0"
 filelock = ">=3.20.1"
 idna = ">=3.15,<4"
+python-dotenv = ">=1.2.2"
 
 [tool.poetry.group.test.dependencies]
 pytest = "^8.4.0"

From db41440e1ecf12e0d0afddafaf2fcea097b0c1f0 Mon Sep 17 00:00:00 2001
From: shuningc <shuningc@splunk.com>
Date: Tue, 4 Aug 2026 16:30:22 -0700
Subject: [PATCH 4/6] Bump python-dotenv floor in splunk-ao-a2a examples
 manifest

Align splunk-ao-a2a dependency group with root >=1.2.2 so standalone
installs and constraint resolution cannot admit vulnerable dotenv versions.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 splunk-ao-a2a/pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml
index d6b8ed7b..803806c7 100644
--- a/splunk-ao-a2a/pyproject.toml
+++ b/splunk-ao-a2a/pyproject.toml
@@ -50,7 +50,7 @@ examples = [
     "langchain>=1.2.13",
     "langchain-openai>=1.1.12",
     "langgraph>=1.1.3",
-    "python-dotenv>=1.1.0",
+    "python-dotenv>=1.2.2",
 ]
 
 [build-system]

From d9da534855c0221c1a3188626e4cb3fef09f4071 Mon Sep 17 00:00:00 2001
From: shuningc <shuningc@splunk.com>
Date: Fri, 7 Aug 2026 17:19:15 -0700
Subject: [PATCH 5/6] fix(VULN-88817): raise python-dotenv floor across all
 example manifests

Normalize every example requirements.txt/pyproject.toml to python-dotenv
>=1.2.2, add floor to elastic-chatbot requirements.in, align startup-
simulator Python docs with dotenv 1.2.x (>=3.10), and regenerate locks.
---
 examples/agent/crewAI/research_crew/pyproject.toml          | 2 +-
 examples/agent/google-adk/requirements.txt                  | 2 +-
 examples/agent/langchain-middleware/requirements.txt        | 2 +-
 examples/agent/minimal-agent-example/requirements.txt       | 2 +-
 examples/agent/startup-simulator-3000/README.md             | 2 +-
 examples/agent/startup-simulator-3000/TUTORIAL.md           | 2 +-
 examples/agent/startup-simulator-3000/start.bat             | 2 +-
 examples/agent/startup-simulator-3000/start.sh              | 6 +++---
 examples/agent/startup-simulator-3000/test_setup.py         | 2 +-
 examples/agent/strands-agents/requirements.txt              | 2 +-
 examples/agent/weather-vibes-agent/requirements.txt         | 2 +-
 examples/chatbot/elevenlabs-chatbot/pyproject.toml          | 2 +-
 examples/chatbot/elevenlabs-chatbot/requirements.txt        | 2 +-
 .../sample-project-chatbot/anthropic/requirements.txt       | 2 +-
 .../sample-project-chatbot/azure-inference/requirements.txt | 2 +-
 .../sample-project-chatbot/openai-ollama/requirements.txt   | 2 +-
 examples/experiments/multi-turn/requirements.txt            | 2 +-
 examples/experiments/rag-and-tools/requirements.txt         | 2 +-
 examples/experiments/upload_experiment/requirements.txt     | 2 +-
 examples/logging-samples/log-mcp-calls/requirements.txt     | 2 +-
 examples/logging-samples/splunk-ao-logger/requirements.txt  | 2 +-
 examples/rag/cli-rag-demo/requirements.txt                  | 2 +-
 examples/rag/elastic-chatbot-rag-app/requirements.in        | 3 +++
 23 files changed, 27 insertions(+), 24 deletions(-)

diff --git a/examples/agent/crewAI/research_crew/pyproject.toml b/examples/agent/crewAI/research_crew/pyproject.toml
index 260b3297..91cae1a8 100644
--- a/examples/agent/crewAI/research_crew/pyproject.toml
+++ b/examples/agent/crewAI/research_crew/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = ">=3.10,<3.14"
 dependencies = [
     "crewai[tools]>=0.203.1,<1.0.0",
     "splunk-ao",
-    "python-dotenv",
+    "python-dotenv>=1.2.2",
 ]
 
 # Project-level runtime dependencies used by the Crew (added so users can
diff --git a/examples/agent/google-adk/requirements.txt b/examples/agent/google-adk/requirements.txt
index 8ba4dbaa..cf6dc804 100644
--- a/examples/agent/google-adk/requirements.txt
+++ b/examples/agent/google-adk/requirements.txt
@@ -1,4 +1,4 @@
 google-adk>=1.28.1
 openinference-instrumentation-google-adk
-python-dotenv
+python-dotenv>=1.2.2
 splunk-ao
diff --git a/examples/agent/langchain-middleware/requirements.txt b/examples/agent/langchain-middleware/requirements.txt
index 5873a547..fcc7dcfd 100644
--- a/examples/agent/langchain-middleware/requirements.txt
+++ b/examples/agent/langchain-middleware/requirements.txt
@@ -2,4 +2,4 @@ openai
 langchain
 langchain-openai
 splunk-ao
-python-dotenv
+python-dotenv>=1.2.2
diff --git a/examples/agent/minimal-agent-example/requirements.txt b/examples/agent/minimal-agent-example/requirements.txt
index 253c1d96..05ba9402 100644
--- a/examples/agent/minimal-agent-example/requirements.txt
+++ b/examples/agent/minimal-agent-example/requirements.txt
@@ -17,4 +17,4 @@ six==1.17.0
 typing_extensions==4.12.2
 urllib3==2.6.3
 yarl==1.18.3
-python-dotenv>=1.0.0
+python-dotenv>=1.2.2
diff --git a/examples/agent/startup-simulator-3000/README.md b/examples/agent/startup-simulator-3000/README.md
index 8c5c63e6..8ccebd17 100644
--- a/examples/agent/startup-simulator-3000/README.md
+++ b/examples/agent/startup-simulator-3000/README.md
@@ -219,7 +219,7 @@ cat .env
 
 1. **Check the logs**: Look at the terminal output for error messages
 2. **Verify API keys**: Make sure all required API keys are set in `.env`
-3. **Check Python version**: Ensure you're using Python 3.8+
+3. **Check Python version**: Ensure you're using Python 3.10+
 4. **Reinstall dependencies**: `pip install -r requirements.txt --force-reinstall`
 
 ## 🎓 Learning Resources
diff --git a/examples/agent/startup-simulator-3000/TUTORIAL.md b/examples/agent/startup-simulator-3000/TUTORIAL.md
index 8632ff01..8480d226 100644
--- a/examples/agent/startup-simulator-3000/TUTORIAL.md
+++ b/examples/agent/startup-simulator-3000/TUTORIAL.md
@@ -28,7 +28,7 @@ This tutorial is designed for developers who want to learn how to build producti
 First, make sure you have the prerequisites installed:
 
 ```bash
-# Check Python version (should be 3.8+)
+# Check Python version (should be 3.10+)
 python --version
 
 # Create and activate virtual environment
diff --git a/examples/agent/startup-simulator-3000/start.bat b/examples/agent/startup-simulator-3000/start.bat
index c6648b19..8018563a 100644
--- a/examples/agent/startup-simulator-3000/start.bat
+++ b/examples/agent/startup-simulator-3000/start.bat
@@ -8,7 +8,7 @@ echo ========================================
 REM Check if Python is installed
 python --version >nul 2>&1
 if errorlevel 1 (
-    echo ❌ Python is not installed or not in PATH. Please install Python 3.8+ first.
+    echo ❌ Python is not installed or not in PATH. Please install Python 3.10+ first.
     pause
     exit /b 1
 )
diff --git a/examples/agent/startup-simulator-3000/start.sh b/examples/agent/startup-simulator-3000/start.sh
index 9bf18d28..1a090e06 100755
--- a/examples/agent/startup-simulator-3000/start.sh
+++ b/examples/agent/startup-simulator-3000/start.sh
@@ -8,16 +8,16 @@ echo "========================================"
 
 # Check if Python is installed
 if ! command -v python3 &> /dev/null; then
-    echo "❌ Python 3 is not installed. Please install Python 3.8+ first."
+    echo "❌ Python 3 is not installed. Please install Python 3.10+ first."
     exit 1
 fi
 
 # Check Python version
 python_version=$(python3 -c 'import sys; print(".".join(map(str, sys.version_info[:2])))')
-required_version="3.8"
+required_version="3.10"
 
 if [ "$(printf '%s\n' "$required_version" "$python_version" | sort -V | head -n1)" != "$required_version" ]; then
-    echo "❌ Python version $python_version is too old. Please install Python 3.8+"
+    echo "❌ Python version $python_version is too old. Please install Python 3.10+"
     exit 1
 fi
 
diff --git a/examples/agent/startup-simulator-3000/test_setup.py b/examples/agent/startup-simulator-3000/test_setup.py
index 16dfa13f..a26c8b28 100644
--- a/examples/agent/startup-simulator-3000/test_setup.py
+++ b/examples/agent/startup-simulator-3000/test_setup.py
@@ -16,7 +16,7 @@ def test_python_version() -> bool:
     print("🐍 Testing Python version...")
     py_version = sys.version_info
     if py_version.major < 3 or (py_version.major == 3 and py_version.minor < 8):
-        print(f"❌ Python {py_version.major}.{py_version.minor} is too old. Need Python 3.8+")
+        print(f"❌ Python {py_version.major}.{py_version.minor} is too old. Need Python 3.10+")
         return False
     print(f"✅ Python {py_version.major}.{py_version.minor}.{py_version.micro} is compatible")
     return True
diff --git a/examples/agent/strands-agents/requirements.txt b/examples/agent/strands-agents/requirements.txt
index cee82cf2..edc885d1 100644
--- a/examples/agent/strands-agents/requirements.txt
+++ b/examples/agent/strands-agents/requirements.txt
@@ -1,6 +1,6 @@
 opentelemetry-api
 opentelemetry-exporter-otlp
 opentelemetry-sdk
-python-dotenv
+python-dotenv>=1.2.2
 strands-agents
 strands-agents-tools
\ No newline at end of file
diff --git a/examples/agent/weather-vibes-agent/requirements.txt b/examples/agent/weather-vibes-agent/requirements.txt
index ab574306..caab2463 100644
--- a/examples/agent/weather-vibes-agent/requirements.txt
+++ b/examples/agent/weather-vibes-agent/requirements.txt
@@ -1,7 +1,7 @@
 # Core dependencies
 fastapi
 uvicorn
-python-dotenv
+python-dotenv>=1.2.2
 jinja2
 pydantic
 rich>=13.0.0
diff --git a/examples/chatbot/elevenlabs-chatbot/pyproject.toml b/examples/chatbot/elevenlabs-chatbot/pyproject.toml
index c280c368..2c2f750b 100644
--- a/examples/chatbot/elevenlabs-chatbot/pyproject.toml
+++ b/examples/chatbot/elevenlabs-chatbot/pyproject.toml
@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "ElevenLabs Voice Chatbot with Splunk AO logging and tracing"
 requires-python = ">=3.9"
 dependencies = [
-    "python-dotenv>=1.0.0",
+    "python-dotenv>=1.2.2",
     "elevenlabs>=1.0.0",
     "splunk-ao",
     "pyaudio>=0.2.14",
diff --git a/examples/chatbot/elevenlabs-chatbot/requirements.txt b/examples/chatbot/elevenlabs-chatbot/requirements.txt
index d83de8d4..c0a037d2 100644
--- a/examples/chatbot/elevenlabs-chatbot/requirements.txt
+++ b/examples/chatbot/elevenlabs-chatbot/requirements.txt
@@ -1,4 +1,4 @@
-python-dotenv>=1.0.0
+python-dotenv>=1.2.2
 elevenlabs>=1.0.0
 splunk-ao
 pyaudio>=0.2.14
diff --git a/examples/chatbot/sample-project-chatbot/anthropic/requirements.txt b/examples/chatbot/sample-project-chatbot/anthropic/requirements.txt
index 10f2d7c4..f51b9e21 100644
--- a/examples/chatbot/sample-project-chatbot/anthropic/requirements.txt
+++ b/examples/chatbot/sample-project-chatbot/anthropic/requirements.txt
@@ -1,4 +1,4 @@
 anthropic
 splunk-ao
-python-dotenv
+python-dotenv>=1.2.2
 pytest
\ No newline at end of file
diff --git a/examples/chatbot/sample-project-chatbot/azure-inference/requirements.txt b/examples/chatbot/sample-project-chatbot/azure-inference/requirements.txt
index e7076b87..b83df79f 100644
--- a/examples/chatbot/sample-project-chatbot/azure-inference/requirements.txt
+++ b/examples/chatbot/sample-project-chatbot/azure-inference/requirements.txt
@@ -1,4 +1,4 @@
 azure-ai-inference
 splunk-ao
-python-dotenv
+python-dotenv>=1.2.2
 pytest
\ No newline at end of file
diff --git a/examples/chatbot/sample-project-chatbot/openai-ollama/requirements.txt b/examples/chatbot/sample-project-chatbot/openai-ollama/requirements.txt
index 7ce1838d..cc83649d 100644
--- a/examples/chatbot/sample-project-chatbot/openai-ollama/requirements.txt
+++ b/examples/chatbot/sample-project-chatbot/openai-ollama/requirements.txt
@@ -1,3 +1,3 @@
 splunk-ao[openai]
-python-dotenv
+python-dotenv>=1.2.2
 pytest
\ No newline at end of file
diff --git a/examples/experiments/multi-turn/requirements.txt b/examples/experiments/multi-turn/requirements.txt
index a490dc5a..3ad616d3 100644
--- a/examples/experiments/multi-turn/requirements.txt
+++ b/examples/experiments/multi-turn/requirements.txt
@@ -1,2 +1,2 @@
 splunk-ao
-python-dotenv
+python-dotenv>=1.2.2
diff --git a/examples/experiments/rag-and-tools/requirements.txt b/examples/experiments/rag-and-tools/requirements.txt
index fb3d0e8c..d0f02568 100644
--- a/examples/experiments/rag-and-tools/requirements.txt
+++ b/examples/experiments/rag-and-tools/requirements.txt
@@ -1,2 +1,2 @@
 splunk-ao[openai]
-python-dotenv
+python-dotenv>=1.2.2
diff --git a/examples/experiments/upload_experiment/requirements.txt b/examples/experiments/upload_experiment/requirements.txt
index ea074c29..3ad616d3 100644
--- a/examples/experiments/upload_experiment/requirements.txt
+++ b/examples/experiments/upload_experiment/requirements.txt
@@ -1,2 +1,2 @@
 splunk-ao
-python-dotenv>=1.0.0
+python-dotenv>=1.2.2
diff --git a/examples/logging-samples/log-mcp-calls/requirements.txt b/examples/logging-samples/log-mcp-calls/requirements.txt
index 9b41d248..18e61aa9 100644
--- a/examples/logging-samples/log-mcp-calls/requirements.txt
+++ b/examples/logging-samples/log-mcp-calls/requirements.txt
@@ -1,4 +1,4 @@
 anthropic
 splunk-ao
 mcp>=1.27.2,<2
-python-dotenv
\ No newline at end of file
+python-dotenv>=1.2.2
\ No newline at end of file
diff --git a/examples/logging-samples/splunk-ao-logger/requirements.txt b/examples/logging-samples/splunk-ao-logger/requirements.txt
index 4bd8e0a9..222dc81a 100644
--- a/examples/logging-samples/splunk-ao-logger/requirements.txt
+++ b/examples/logging-samples/splunk-ao-logger/requirements.txt
@@ -1,2 +1,2 @@
 splunk-ao
-python-dotenv
\ No newline at end of file
+python-dotenv>=1.2.2
\ No newline at end of file
diff --git a/examples/rag/cli-rag-demo/requirements.txt b/examples/rag/cli-rag-demo/requirements.txt
index c138ff4f..cc5eb18b 100644
--- a/examples/rag/cli-rag-demo/requirements.txt
+++ b/examples/rag/cli-rag-demo/requirements.txt
@@ -22,5 +22,5 @@ yarl==1.18.3
 faiss-cpu>=1.7.4
 sentence-transformers>=2.5.1
 numpy>=1.24.0  # Required by FAISS and sentence-transformers
-python-dotenv>=1.0.0  # Added for dotenv support
+python-dotenv>=1.2.2  # Added for dotenv support
 datasets>=2.18.0  # Added for loading example datasets
diff --git a/examples/rag/elastic-chatbot-rag-app/requirements.in b/examples/rag/elastic-chatbot-rag-app/requirements.in
index f2815891..ac6675b8 100644
--- a/examples/rag/elastic-chatbot-rag-app/requirements.in
+++ b/examples/rag/elastic-chatbot-rag-app/requirements.in
@@ -1,3 +1,6 @@
+# security floor (VULN-88817 — python-dotenv symlink overwrite)
+python-dotenv>=1.2.2
+
 # core dependencies
 elasticsearch
 langchain

From e510a00694968311e74c2518a7fd9ec06581a218 Mon Sep 17 00:00:00 2001
From: shuningc <shuningc@splunk.com>
Date: Fri, 7 Aug 2026 18:44:19 -0700
Subject: [PATCH 6/6] fix(VULN-88817): align example Python floors with
 splunk-ao >=3.11

Raise elevenlabs-chatbot requires-python to >=3.11 so metadata matches
python-dotenv>=1.2.2 and splunk-ao. Fix startup-simulator version checks
and docs to use 3.11 consistently (test_setup.py was still gating on 3.8).

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 examples/agent/startup-simulator-3000/README.md     | 6 +++---
 examples/agent/startup-simulator-3000/TUTORIAL.md   | 4 ++--
 examples/agent/startup-simulator-3000/start.bat     | 2 +-
 examples/agent/startup-simulator-3000/start.sh      | 6 +++---
 examples/agent/startup-simulator-3000/test_setup.py | 4 ++--
 examples/chatbot/elevenlabs-chatbot/README.md       | 2 +-
 examples/chatbot/elevenlabs-chatbot/pyproject.toml  | 2 +-
 7 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/examples/agent/startup-simulator-3000/README.md b/examples/agent/startup-simulator-3000/README.md
index 8ccebd17..1786e41f 100644
--- a/examples/agent/startup-simulator-3000/README.md
+++ b/examples/agent/startup-simulator-3000/README.md
@@ -46,7 +46,7 @@ run immediately!
 
 Make sure you have:
 
-- **Python 3.10+** installed on your system
+- **Python 3.11+** installed on your system
 - **Git** (optional, for cloning)
 - **A code editor** (VS Code, PyCharm, etc.)
 
@@ -219,7 +219,7 @@ cat .env
 
 1. **Check the logs**: Look at the terminal output for error messages
 2. **Verify API keys**: Make sure all required API keys are set in `.env`
-3. **Check Python version**: Ensure you're using Python 3.10+
+3. **Check Python version**: Ensure you're using Python 3.11+
 4. **Reinstall dependencies**: `pip install -r requirements.txt --force-reinstall`
 
 ## 🎓 Learning Resources
@@ -280,7 +280,7 @@ If you run into issues:
 1. Check the troubleshooting section above
 2. Look at the terminal logs for error messages
 3. Verify your API keys are correct
-4. Make sure you're using Python 3.10+
+4. Make sure you're using Python 3.11+
 
 ---
 
diff --git a/examples/agent/startup-simulator-3000/TUTORIAL.md b/examples/agent/startup-simulator-3000/TUTORIAL.md
index 8480d226..3c20ebed 100644
--- a/examples/agent/startup-simulator-3000/TUTORIAL.md
+++ b/examples/agent/startup-simulator-3000/TUTORIAL.md
@@ -28,7 +28,7 @@ This tutorial is designed for developers who want to learn how to build producti
 First, make sure you have the prerequisites installed:
 
 ```bash
-# Check Python version (should be 3.10+)
+# Check Python version (should be 3.11+)
 python --version
 
 # Create and activate virtual environment
@@ -431,7 +431,7 @@ gunicorn -w 4 -b 0.0.0.0:2021 app:app
 
 3. **Docker Deployment**
 ```dockerfile
-FROM python:3.10-slim
+FROM python:3.11-slim
 WORKDIR /app
 COPY requirements.txt .
 RUN pip install -r requirements.txt
diff --git a/examples/agent/startup-simulator-3000/start.bat b/examples/agent/startup-simulator-3000/start.bat
index 8018563a..7f4ca6e0 100644
--- a/examples/agent/startup-simulator-3000/start.bat
+++ b/examples/agent/startup-simulator-3000/start.bat
@@ -8,7 +8,7 @@ echo ========================================
 REM Check if Python is installed
 python --version >nul 2>&1
 if errorlevel 1 (
-    echo ❌ Python is not installed or not in PATH. Please install Python 3.10+ first.
+    echo ❌ Python is not installed or not in PATH. Please install Python 3.11+ first.
     pause
     exit /b 1
 )
diff --git a/examples/agent/startup-simulator-3000/start.sh b/examples/agent/startup-simulator-3000/start.sh
index 1a090e06..880843b0 100755
--- a/examples/agent/startup-simulator-3000/start.sh
+++ b/examples/agent/startup-simulator-3000/start.sh
@@ -8,16 +8,16 @@ echo "========================================"
 
 # Check if Python is installed
 if ! command -v python3 &> /dev/null; then
-    echo "❌ Python 3 is not installed. Please install Python 3.10+ first."
+    echo "❌ Python 3 is not installed. Please install Python 3.11+ first."
     exit 1
 fi
 
 # Check Python version
 python_version=$(python3 -c 'import sys; print(".".join(map(str, sys.version_info[:2])))')
-required_version="3.10"
+required_version="3.11"
 
 if [ "$(printf '%s\n' "$required_version" "$python_version" | sort -V | head -n1)" != "$required_version" ]; then
-    echo "❌ Python version $python_version is too old. Please install Python 3.10+"
+    echo "❌ Python version $python_version is too old. Please install Python 3.11+"
     exit 1
 fi
 
diff --git a/examples/agent/startup-simulator-3000/test_setup.py b/examples/agent/startup-simulator-3000/test_setup.py
index a26c8b28..fd0a127a 100644
--- a/examples/agent/startup-simulator-3000/test_setup.py
+++ b/examples/agent/startup-simulator-3000/test_setup.py
@@ -15,8 +15,8 @@ def test_python_version() -> bool:
     """Test if Python version is compatible"""
     print("🐍 Testing Python version...")
     py_version = sys.version_info
-    if py_version.major < 3 or (py_version.major == 3 and py_version.minor < 8):
-        print(f"❌ Python {py_version.major}.{py_version.minor} is too old. Need Python 3.10+")
+    if py_version.major < 3 or (py_version.major == 3 and py_version.minor < 11):
+        print(f"❌ Python {py_version.major}.{py_version.minor} is too old. Need Python 3.11+")
         return False
     print(f"✅ Python {py_version.major}.{py_version.minor}.{py_version.micro} is compatible")
     return True
diff --git a/examples/chatbot/elevenlabs-chatbot/README.md b/examples/chatbot/elevenlabs-chatbot/README.md
index 4449bc72..1bf0ec5b 100644
--- a/examples/chatbot/elevenlabs-chatbot/README.md
+++ b/examples/chatbot/elevenlabs-chatbot/README.md
@@ -61,7 +61,7 @@ Edit `.env` with your credentials. Note for `ELEVENLABS_*` variables you can [si
 
 ## Requirements
 
-- Python 3.10+
+- Python 3.11+
 - Microphone and headphones (to avoid audio feedback)
 
 ## Learn More
diff --git a/examples/chatbot/elevenlabs-chatbot/pyproject.toml b/examples/chatbot/elevenlabs-chatbot/pyproject.toml
index 2c2f750b..01c50548 100644
--- a/examples/chatbot/elevenlabs-chatbot/pyproject.toml
+++ b/examples/chatbot/elevenlabs-chatbot/pyproject.toml
@@ -2,7 +2,7 @@
 name = "elevenlabs-chatbot"
 version = "0.1.0"
 description = "ElevenLabs Voice Chatbot with Splunk AO logging and tracing"
-requires-python = ">=3.9"
+requires-python = ">=3.11"
 dependencies = [
     "python-dotenv>=1.2.2",
     "elevenlabs>=1.0.0",