diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 5dbfda76..bcf29c0b 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -22,7 +22,9 @@ jobs:
           disable-sudo: true
           egress-policy: block
           allowed-endpoints: >
+            api.deps.dev:443
             api.github.com:443
+            api.securityscorecards.dev:443
             github.com:443
       - name: 'Checkout Repository'
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
index adab381d..2901f5f3 100644
--- a/.github/workflows/unit.yml
+++ b/.github/workflows/unit.yml
@@ -42,6 +42,7 @@ jobs:
           github.com:443
           objects.githubusercontent.com:443
           production.cloudflare.docker.com:443
+          production.cloudfront.docker.com:443
           pypi.org:443
           registry-1.docker.io:443
           release-assets.githubusercontent.com:443
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 14e609c4..20d13326 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.10.2](https://github.com/GoogleCloudPlatform/functions-framework-python/compare/v3.10.1...v3.10.2) (2026-06-17)
+
+
+### Bug Fixes
+
+* **ci:** update allowed endpoints for harden-runner ([#427](https://github.com/GoogleCloudPlatform/functions-framework-python/issues/427)) ([715ba9a](https://github.com/GoogleCloudPlatform/functions-framework-python/commit/715ba9a4a8075eed73d78c28209763a7eb67f01f))
+* **deps:** bump starlette to >=1.0.1 on Python 3.10+ to fix PYSEC-2026-161 ([#423](https://github.com/GoogleCloudPlatform/functions-framework-python/issues/423)) ([c650171](https://github.com/GoogleCloudPlatform/functions-framework-python/commit/c6501715bb57348ead817ee90c18622b3c1c31ab))
+* remove macos-13 from test matrix (runner retired) ([#414](https://github.com/GoogleCloudPlatform/functions-framework-python/issues/414)) ([b41ee77](https://github.com/GoogleCloudPlatform/functions-framework-python/commit/b41ee77d6fb61a9e0a76f17d561a221e50fe788a))
+
 ## [3.10.1](https://github.com/GoogleCloudPlatform/functions-framework-python/compare/v3.10.0...v3.10.1) (2026-02-17)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 972e7e52..cb6549fd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "functions-framework"
-version = "3.10.1"
+version = "3.10.2"
 description = "An open source FaaS (Function as a service) framework for writing portable Python functions -- brought to you by the Google Cloud Functions team."
 readme = "README.md"
 requires-python = ">=3.7, <4"
@@ -29,7 +29,8 @@ dependencies = [
   "gunicorn>=22.0.0; platform_system!='Windows'",
   "cloudevents>=1.11.0,<=1.12.0",                   # Must support python 3.8
   "Werkzeug>=0.14,<4.0.0",
-  "starlette>=0.37.0,<1.0.0; python_version>='3.8'",
+  "starlette>=0.37.0,<1.0.0; python_version>='3.8' and python_version<'3.10'",
+  "starlette>=1.0.1,<2.0.0; python_version>='3.10'",
   "uvicorn>=0.18.0,<1.0.0; python_version>='3.8'",
   "uvicorn-worker>=0.2.0,<1.0.0; python_version>='3.8'",
 ]
diff --git a/setup.py b/setup.py
index db6479ea..10dfee0d 100644
--- a/setup.py
+++ b/setup.py
@@ -25,7 +25,7 @@
 
 setup(
     name="functions-framework",
-    version="3.10.1",
+    version="3.10.2",
     description="An open source FaaS (Function as a service) framework for writing portable Python functions -- brought to you by the Google Cloud Functions team.",
     long_description=long_description,
     long_description_content_type="text/markdown",
@@ -58,7 +58,10 @@
         "Werkzeug>=0.14,<4.0.0",
     ],
     extras_require={
-        "async": ["starlette>=0.37.0,<1.0.0"],
+        "async": [
+            "starlette>=0.37.0,<1.0.0; python_version<'3.10'",
+            "starlette>=1.0.1,<2.0.0; python_version>='3.10'",
+        ],
     },
     entry_points={
         "console_scripts": [