diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9e84c873..79927d5c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -262,3 +262,18 @@ jobs:
           path: temporalio/tmp/cloud-test.log
           if-no-files-found: warn
           retention-days: 14
+
+  # The single required status check for merging: a PR can merge only if every job in
+  # `needs` passed.
+  required-pr-checks:
+    name: Required PR Checks
+    # Without always(), this job would be skipped when a dependency fails, and GitHub
+    # treats a skipped required check as passing.
+    if: always()
+    needs:
+      - build-lint-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if any check failed or was cancelled
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: exit 1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index af1c0dce..fe32151b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.10.1] - 2026-10-30
+
+### Security
+
+- Update the bridge's zip dependency to 9.1.3 to address a security vulnerability in zip.
+
 ## [1.10.0] - 2026-10-19
 
 ### Added
diff --git a/temporalio/Cargo.lock b/temporalio/Cargo.lock
index f5a6d9c4..cd7c81d2 100644
--- a/temporalio/Cargo.lock
+++ b/temporalio/Cargo.lock
@@ -3671,7 +3671,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -4434,9 +4434,9 @@ dependencies = [
 
 [[package]]
 name = "typed-path"
-version = "0.12.3"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
 
 [[package]]
 name = "typeid"
@@ -5578,17 +5578,19 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "9.0.4"
+version = "9.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
 dependencies = [
  "bzip2",
  "crc32fast",
  "flate2",
+ "getrandom 0.4.3",
  "indexmap",
  "memchr",
  "nix",
  "typed-path",
+ "windows-sys 0.61.2",
  "zopfli",
  "zstd 0.14.3",
 ]
diff --git a/temporalio/Gemfile.lock b/temporalio/Gemfile.lock
index e000d504..ff2c0316 100644
--- a/temporalio/Gemfile.lock
+++ b/temporalio/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    temporalio (1.10.0)
+    temporalio (1.10.1)
       google-protobuf (>= 3.25.0)
       json (< 3)
       logger
@@ -286,7 +286,7 @@ CHECKSUMS
   steep (1.10.0) sha256=1b295b55f9aaff1b8d3ee42453ee55bc2a1078fda0268f288edb2dc014f4d7d1
   stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
   strscan (3.1.8) sha256=aae2db611a225559f21ffbb71765c9a4e60fd262534a9ea84f4f11c7f32f679e
-  temporalio (1.10.0)
+  temporalio (1.10.1)
   terminal-table (4.0.0) sha256=f504793203f8251b2ea7c7068333053f0beeea26093ec9962e62ea79f94301d2
   timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
   tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
diff --git a/temporalio/lib/temporalio/version.rb b/temporalio/lib/temporalio/version.rb
index 3b594004..7cc192fc 100644
--- a/temporalio/lib/temporalio/version.rb
+++ b/temporalio/lib/temporalio/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Temporalio
-  VERSION = '1.10.0'
+  VERSION = '1.10.1'
 end