From 9cf4d5b93e01e2828b459ddb3bbc371d4866228b Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 08:05:19 +0100
Subject: [PATCH 01/14] Delete python-keyczar==0.716

Keyczar is deprecated.
See:
https://github.com/google/keyczar

Critical Vunability:
https://www.cve.org/CVERecord?id=CVE-2013-7459
---
 fixed-requirements.txt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index 21f93c6f91..6ce842af5b 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -49,7 +49,6 @@ zstandard==0.15.2
 # pyOpenSSL 23.1.0 supports cryptography up to 40.0.x
 pyOpenSSL==23.1.0
 python-editor==1.0.4
-python-keyczar==0.716
 pytz==2021.1
 pywinrm==0.4.1
 pyyaml==5.4.1

From c23327299fd7d9dc45c2a645844793ec05839186 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 08:48:14 +0100
Subject: [PATCH 02/14] Update CHANGELOG.rst

---
 CHANGELOG.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 7a1bfa4e8e..23017875fe 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -82,6 +82,9 @@ Changed
 * Remove `distutils` dependencies across the project. #5992
   Contributed by @AndroxxTraxxon
 
+* Remove deprecated not use dependencie `python-keyczar`. #6078
+  Contributed by (@philipphomberger Schwarz IT KG)
+
 3.8.0 - November 18, 2022
 -------------------------
 

From 4d0bfb05d79fab5fd33224b931bd960cd0ca07dc Mon Sep 17 00:00:00 2001
From: Philipp Homberger <Philipp.Homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 10:49:18 +0000
Subject: [PATCH 03/14] add support for mongodb 5,6,7

---
 conf/st2.conf.sample                          |  2 -
 contrib/packs/actions/pack_mgmt/unload.py     |  1 -
 fixed-requirements.txt                        |  4 +-
 requirements.txt                              |  4 +-
 st2api/requirements.txt                       |  4 +-
 st2auth/requirements.txt                      |  2 +-
 st2common/requirements.txt                    |  4 +-
 st2common/st2common/config.py                 |  5 --
 st2common/st2common/database_setup.py         |  1 -
 st2common/st2common/models/db/__init__.py     | 13 +---
 st2common/st2common/persistence/cleanup.py    |  2 -
 st2common/st2common/persistence/db_init.py    |  2 -
 st2common/tests/unit/test_db.py               | 66 -------------------
 .../st2reactor/container/sensor_wrapper.py    |  1 -
 st2stream/requirements.txt                    |  4 +-
 15 files changed, 12 insertions(+), 103 deletions(-)

diff --git a/conf/st2.conf.sample b/conf/st2.conf.sample
index 5450a9e4d1..4c9279224c 100644
--- a/conf/st2.conf.sample
+++ b/conf/st2.conf.sample
@@ -153,8 +153,6 @@ ssl_cert_reqs = None
 ssl_certfile = None
 # Private keyfile used to identify the local connection against MongoDB.
 ssl_keyfile = None
-# If True and `ssl_cert_reqs` is not None, enables hostname verification
-ssl_match_hostname = True
 # username for db login
 username = None
 # Compression level when compressors is set to zlib. Valid values are -1 to 9. Defaults to 6.
diff --git a/contrib/packs/actions/pack_mgmt/unload.py b/contrib/packs/actions/pack_mgmt/unload.py
index b26182329d..63d12d26d0 100644
--- a/contrib/packs/actions/pack_mgmt/unload.py
+++ b/contrib/packs/actions/pack_mgmt/unload.py
@@ -65,7 +65,6 @@ def initialize(self):
             ssl_cert_reqs=cfg.CONF.database.ssl_cert_reqs,
             ssl_ca_certs=cfg.CONF.database.ssl_ca_certs,
             authentication_mechanism=cfg.CONF.database.authentication_mechanism,
-            ssl_match_hostname=cfg.CONF.database.ssl_match_hostname,
         )
 
     def run(self, packs):
diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index 6ce842af5b..b8bdd954c4 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -27,7 +27,7 @@ lockfile==0.12.2
 # Fix MarkupSafe to < 2.1.0 as 2.1.0 removes soft_unicode
 # >=0.23 was from jinja2
 MarkupSafe<2.1.0,>=0.23
-mongoengine==0.23.0
+mongoengine==0.27.0
 # required by orquesta (networkx<2.6 for py3.6, networkx<3 for py3.8)
 networkx<3
 # networkx requires decorator>=4.3,<5 which should resolve to version 4.4.2
@@ -43,7 +43,7 @@ paramiko==2.11.0
 passlib==1.7.4
 prompt-toolkit==1.0.15
 pyinotify==0.9.6 ; platform_system=="Linux"
-pymongo==3.11.3
+pymongo==4.6.1
 pyparsing<3
 zstandard==0.15.2
 # pyOpenSSL 23.1.0 supports cryptography up to 40.0.x
diff --git a/requirements.txt b/requirements.txt
index b0b44eda39..1496800604 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -31,7 +31,7 @@ kombu==5.0.2
 lockfile==0.12.2
 logshipper@ git+https://github.com/StackStorm/logshipper.git@stackstorm_patched ; platform_system=="Linux"
 mock==4.0.3
-mongoengine==0.23.0
+mongoengine==0.27.0
 networkx<3
 nose
 nose-parallel==0.4.0
@@ -47,7 +47,7 @@ prompt-toolkit==1.0.15
 psutil==5.8.0
 pyOpenSSL==23.1.0
 pyinotify==0.9.6 ; platform_system=="Linux"
-pymongo==3.11.3
+pymongo==4.6.1
 pyparsing<3
 pyrabbit
 pysocks
diff --git a/st2api/requirements.txt b/st2api/requirements.txt
index 07aac607e9..ea514e975b 100644
--- a/st2api/requirements.txt
+++ b/st2api/requirements.txt
@@ -9,10 +9,10 @@ eventlet==0.33.3
 gunicorn==21.2.0
 jsonschema==2.6.0
 kombu==5.0.2
-mongoengine==0.23.0
+mongoengine==0.27.0
 oslo.config>=1.12.1,<1.13
 oslo.utils<5.0,>=4.0.0
-pymongo==3.11.3
+pymongo==4.6.1
 pyparsing<3
 simplejson
 six==1.13.0
diff --git a/st2auth/requirements.txt b/st2auth/requirements.txt
index e4d7f91fb9..b0197f1702 100644
--- a/st2auth/requirements.txt
+++ b/st2auth/requirements.txt
@@ -10,7 +10,7 @@ eventlet==0.33.3
 gunicorn==21.2.0
 oslo.config>=1.12.1,<1.13
 passlib==1.7.4
-pymongo==3.11.3
+pymongo==4.6.1
 six==1.13.0
 st2-auth-backend-flat-file@ git+https://github.com/StackStorm/st2-auth-backend-flat-file.git@master
 st2-auth-ldap@ git+https://github.com/StackStorm/st2-auth-ldap.git@master
diff --git a/st2common/requirements.txt b/st2common/requirements.txt
index 575b251177..3273909e3e 100644
--- a/st2common/requirements.txt
+++ b/st2common/requirements.txt
@@ -24,14 +24,14 @@ jsonpath-rw==1.4.0
 jsonschema==2.6.0
 kombu==5.0.2
 lockfile==0.12.2
-mongoengine==0.23.0
+mongoengine==0.27.0
 networkx<3
 orjson==3.5.2
 orquesta@ git+https://github.com/StackStorm/orquesta.git@v1.6.0
 oslo.config>=1.12.1,<1.13
 paramiko==2.11.0
 pyOpenSSL==23.1.0
-pymongo==3.11.3
+pymongo==4.6.1
 python-dateutil==2.8.1
 python-statsd==2.1.0
 pyyaml==5.4.1
diff --git a/st2common/st2common/config.py b/st2common/st2common/config.py
index c88955e4bb..9baad08c12 100644
--- a/st2common/st2common/config.py
+++ b/st2common/st2common/config.py
@@ -231,11 +231,6 @@ def register_opts(ignore_errors=False):
             help="ca_certs file contains a set of concatenated CA certificates, which are "
             "used to validate certificates passed from MongoDB.",
         ),
-        cfg.BoolOpt(
-            "ssl_match_hostname",
-            default=True,
-            help="If True and `ssl_cert_reqs` is not None, enables hostname verification",
-        ),
         cfg.StrOpt(
             "authentication_mechanism",
             default=None,
diff --git a/st2common/st2common/database_setup.py b/st2common/st2common/database_setup.py
index 2e2e7d2a17..3f1b57a326 100644
--- a/st2common/st2common/database_setup.py
+++ b/st2common/st2common/database_setup.py
@@ -42,7 +42,6 @@ def db_config():
         "ssl_cert_reqs": cfg.CONF.database.ssl_cert_reqs,
         "ssl_ca_certs": cfg.CONF.database.ssl_ca_certs,
         "authentication_mechanism": cfg.CONF.database.authentication_mechanism,
-        "ssl_match_hostname": cfg.CONF.database.ssl_match_hostname,
     }
 
 
diff --git a/st2common/st2common/models/db/__init__.py b/st2common/st2common/models/db/__init__.py
index 1cecf3a247..24b28f4ad6 100644
--- a/st2common/st2common/models/db/__init__.py
+++ b/st2common/st2common/models/db/__init__.py
@@ -132,8 +132,7 @@ def _db_connect(
     ssl_certfile=None,
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
-    authentication_mechanism=None,
-    ssl_match_hostname=True,
+    authentication_mechanism=None
 ):
 
     if "://" in db_host:
@@ -168,7 +167,6 @@ def _db_connect(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         authentication_mechanism=authentication_mechanism,
-        ssl_match_hostname=ssl_match_hostname,
     )
 
     compressor_kwargs = {}
@@ -237,7 +235,6 @@ def db_setup(
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
     authentication_mechanism=None,
-    ssl_match_hostname=True,
 ):
 
     connection = _db_connect(
@@ -252,7 +249,6 @@ def db_setup(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         authentication_mechanism=authentication_mechanism,
-        ssl_match_hostname=ssl_match_hostname,
     )
 
     # Create all the indexes upfront to prevent race-conditions caused by
@@ -403,7 +399,6 @@ def db_cleanup(
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
     authentication_mechanism=None,
-    ssl_match_hostname=True,
 ):
 
     connection = _db_connect(
@@ -418,7 +413,6 @@ def db_cleanup(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         authentication_mechanism=authentication_mechanism,
-        ssl_match_hostname=ssl_match_hostname,
     )
 
     LOG.info(
@@ -440,7 +434,6 @@ def _get_ssl_kwargs(
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
     authentication_mechanism=None,
-    ssl_match_hostname=True,
 ):
     # NOTE: In pymongo 3.9.0 some of the ssl related arguments have been renamed -
     # https://api.mongodb.com/python/current/changelog.html#changes-in-version-3-9-0
@@ -468,10 +461,6 @@ def _get_ssl_kwargs(
     if authentication_mechanism:
         ssl_kwargs["ssl"] = True
         ssl_kwargs["authentication_mechanism"] = authentication_mechanism
-    if ssl_kwargs.get("ssl", False):
-        # pass in ssl_match_hostname only if ssl is True. The right default value
-        # for ssl_match_hostname in almost all cases is True.
-        ssl_kwargs["ssl_match_hostname"] = ssl_match_hostname
     return ssl_kwargs
 
 
diff --git a/st2common/st2common/persistence/cleanup.py b/st2common/st2common/persistence/cleanup.py
index 06c48dec86..38bf7f637e 100644
--- a/st2common/st2common/persistence/cleanup.py
+++ b/st2common/st2common/persistence/cleanup.py
@@ -50,7 +50,6 @@ def db_cleanup_with_retry(
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
     authentication_mechanism=None,
-    ssl_match_hostname=True,
 ):
     """
     This method is a retry version of db_cleanup.
@@ -68,7 +67,6 @@ def db_cleanup_with_retry(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         authentication_mechanism=authentication_mechanism,
-        ssl_match_hostname=ssl_match_hostname,
     )
 
 
diff --git a/st2common/st2common/persistence/db_init.py b/st2common/st2common/persistence/db_init.py
index ed6d080423..06bb377343 100644
--- a/st2common/st2common/persistence/db_init.py
+++ b/st2common/st2common/persistence/db_init.py
@@ -71,7 +71,6 @@ def db_setup_with_retry(
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
     authentication_mechanism=None,
-    ssl_match_hostname=True,
 ):
     """
     This method is a retry version of db_setup.
@@ -90,5 +89,4 @@ def db_setup_with_retry(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         authentication_mechanism=authentication_mechanism,
-        ssl_match_hostname=ssl_match_hostname,
     )
diff --git a/st2common/tests/unit/test_db.py b/st2common/tests/unit/test_db.py
index 0ae1ee79f1..fc988503fa 100644
--- a/st2common/tests/unit/test_db.py
+++ b/st2common/tests/unit/test_db.py
@@ -21,7 +21,6 @@
 
 monkey_patch()
 
-import ssl
 import time
 
 import jsonschema
@@ -231,80 +230,16 @@ def test_get_ssl_kwargs(self):
         ssl_kwargs = _get_ssl_kwargs()
         self.assertEqual(ssl_kwargs, {"ssl": False})
 
-        # 2. ssl kwarg provided
-        ssl_kwargs = _get_ssl_kwargs(ssl=True)
-        self.assertEqual(ssl_kwargs, {"ssl": True, "ssl_match_hostname": True})
-
         # 2. authentication_mechanism kwarg provided
         ssl_kwargs = _get_ssl_kwargs(authentication_mechanism="MONGODB-X509")
         self.assertEqual(
             ssl_kwargs,
             {
                 "ssl": True,
-                "ssl_match_hostname": True,
                 "authentication_mechanism": "MONGODB-X509",
             },
         )
 
-        # 3. ssl_keyfile provided
-        ssl_kwargs = _get_ssl_kwargs(ssl_keyfile="/tmp/keyfile")
-        self.assertEqual(
-            ssl_kwargs,
-            {"ssl": True, "ssl_keyfile": "/tmp/keyfile", "ssl_match_hostname": True},
-        )
-
-        # 4. ssl_certfile provided
-        ssl_kwargs = _get_ssl_kwargs(ssl_certfile="/tmp/certfile")
-        self.assertEqual(
-            ssl_kwargs,
-            {"ssl": True, "ssl_certfile": "/tmp/certfile", "ssl_match_hostname": True},
-        )
-
-        # 5. ssl_ca_certs provided
-        ssl_kwargs = _get_ssl_kwargs(ssl_ca_certs="/tmp/ca_certs")
-        self.assertEqual(
-            ssl_kwargs,
-            {"ssl": True, "ssl_ca_certs": "/tmp/ca_certs", "ssl_match_hostname": True},
-        )
-
-        # 6. ssl_ca_certs and ssl_cert_reqs combinations
-        ssl_kwargs = _get_ssl_kwargs(ssl_ca_certs="/tmp/ca_certs", ssl_cert_reqs="none")
-        self.assertEqual(
-            ssl_kwargs,
-            {
-                "ssl": True,
-                "ssl_ca_certs": "/tmp/ca_certs",
-                "ssl_cert_reqs": ssl.CERT_NONE,
-                "ssl_match_hostname": True,
-            },
-        )
-
-        ssl_kwargs = _get_ssl_kwargs(
-            ssl_ca_certs="/tmp/ca_certs", ssl_cert_reqs="optional"
-        )
-        self.assertEqual(
-            ssl_kwargs,
-            {
-                "ssl": True,
-                "ssl_ca_certs": "/tmp/ca_certs",
-                "ssl_cert_reqs": ssl.CERT_OPTIONAL,
-                "ssl_match_hostname": True,
-            },
-        )
-
-        ssl_kwargs = _get_ssl_kwargs(
-            ssl_ca_certs="/tmp/ca_certs", ssl_cert_reqs="required"
-        )
-        self.assertEqual(
-            ssl_kwargs,
-            {
-                "ssl": True,
-                "ssl_ca_certs": "/tmp/ca_certs",
-                "ssl_cert_reqs": ssl.CERT_REQUIRED,
-                "ssl_match_hostname": True,
-            },
-        )
-
     @mock.patch("st2common.models.db.mongoengine")
     def test_db_setup(self, mock_mongoengine):
         db_setup(
@@ -331,7 +266,6 @@ def test_db_setup(self, mock_mongoengine):
                 "tz_aware": True,
                 "authentication_mechanism": "MONGODB-X509",
                 "ssl": True,
-                "ssl_match_hostname": True,
                 "connectTimeoutMS": 3000,
                 "serverSelectionTimeoutMS": 3000,
             },
diff --git a/st2reactor/st2reactor/container/sensor_wrapper.py b/st2reactor/st2reactor/container/sensor_wrapper.py
index 951052b7e3..dc01fc078d 100644
--- a/st2reactor/st2reactor/container/sensor_wrapper.py
+++ b/st2reactor/st2reactor/container/sensor_wrapper.py
@@ -235,7 +235,6 @@ def __init__(
             ssl_cert_reqs=cfg.CONF.database.ssl_cert_reqs,
             ssl_ca_certs=cfg.CONF.database.ssl_ca_certs,
             authentication_mechanism=cfg.CONF.database.authentication_mechanism,
-            ssl_match_hostname=cfg.CONF.database.ssl_match_hostname,
         )
 
         # 3. Instantiate the watcher
diff --git a/st2stream/requirements.txt b/st2stream/requirements.txt
index 8a9e422f04..f7a722d419 100644
--- a/st2stream/requirements.txt
+++ b/st2stream/requirements.txt
@@ -9,9 +9,9 @@ eventlet==0.33.3
 gunicorn==21.2.0
 jsonschema==2.6.0
 kombu==5.0.2
-mongoengine==0.23.0
+mongoengine==0.27.0
 oslo.config>=1.12.1,<1.13
 oslo.utils<5.0,>=4.0.0
-pymongo==3.11.3
+pymongo==4.6.1
 pyparsing<3
 six==1.13.0

From c77d4928afbcceec000d477b55c95398b0240fef Mon Sep 17 00:00:00 2001
From: Philipp Homberger <Philipp.Homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 11:32:40 +0000
Subject: [PATCH 04/14] black

---
 st2common/st2common/models/db/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/st2common/st2common/models/db/__init__.py b/st2common/st2common/models/db/__init__.py
index 24b28f4ad6..65f709ea00 100644
--- a/st2common/st2common/models/db/__init__.py
+++ b/st2common/st2common/models/db/__init__.py
@@ -132,7 +132,7 @@ def _db_connect(
     ssl_certfile=None,
     ssl_cert_reqs=None,
     ssl_ca_certs=None,
-    authentication_mechanism=None
+    authentication_mechanism=None,
 ):
 
     if "://" in db_host:

From 6995ab56279a3c1a1ab7bae63f7887c890aff554 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 12:35:53 +0100
Subject: [PATCH 05/14] Update CHANGELOG.rst

---
 CHANGELOG.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 23017875fe..ec9e647420 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -82,8 +82,6 @@ Changed
 * Remove `distutils` dependencies across the project. #5992
   Contributed by @AndroxxTraxxon
 
-* Remove deprecated not use dependencie `python-keyczar`. #6078
-  Contributed by (@philipphomberger Schwarz IT KG)
 
 3.8.0 - November 18, 2022
 -------------------------

From fb31134ad43e73a5a9df34e9ea1801d43f167c44 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 12:37:35 +0100
Subject: [PATCH 06/14] Update fixed-requirements.txt

---
 fixed-requirements.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index b8bdd954c4..1983a3afe0 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -49,6 +49,7 @@ zstandard==0.15.2
 # pyOpenSSL 23.1.0 supports cryptography up to 40.0.x
 pyOpenSSL==23.1.0
 python-editor==1.0.4
+python-keyczar==0.716
 pytz==2021.1
 pywinrm==0.4.1
 pyyaml==5.4.1

From da73a4d3f5e83daecee9e3b8f227fbddf4da2c35 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <Philipp.Homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 12:54:19 +0000
Subject: [PATCH 07/14] black

---
 st2common/tests/unit/test_db.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/st2common/tests/unit/test_db.py b/st2common/tests/unit/test_db.py
index fc988503fa..df4905fc43 100644
--- a/st2common/tests/unit/test_db.py
+++ b/st2common/tests/unit/test_db.py
@@ -505,7 +505,7 @@ def test_cleanup(self):
         """
         Tests dropping the database. Requires the db server to be running.
         """
-        self.assertIn(cfg.CONF.database.db_name, self.db_connection.database_names())
+        self.assertIn(cfg.CONF.database.db_name, self.db_connection.list_database_names())
 
         connection = db_cleanup()
 

From 06d6546b1a8c48f907e52aa5ca77af762af56088 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <Philipp.Homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 13:01:01 +0000
Subject: [PATCH 08/14] test fix unit

---
 st2tests/st2tests/base.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/st2tests/st2tests/base.py b/st2tests/st2tests/base.py
index c8a480fdb6..c9f567be5e 100644
--- a/st2tests/st2tests/base.py
+++ b/st2tests/st2tests/base.py
@@ -273,7 +273,6 @@ def _drop_db(cls):
             cls.db_connection.drop_database(cfg.CONF.database.db_name)
 
         db_teardown()
-        cls.db_connection = None
 
     @classmethod
     def _drop_collections(cls):

From 6f6d8e494f0348049e5932eac6d61de39a4850f5 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <Philipp.Homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 13:31:25 +0000
Subject: [PATCH 09/14] circleci python 3.8

---
 .circleci/config.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 83caf83010..d5b078070d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -43,7 +43,7 @@ jobs:
   # Run st2 Integration tests
   integration:
     docker:
-      - image: circleci/python:3.6
+      - image: circleci/python:3.8
       - image: mongo:4.0
       - image: rabbitmq:3
     working_directory: ~/st2
@@ -79,7 +79,7 @@ jobs:
   # Run st2 Lint Checks
   lint:
     docker:
-      - image: circleci/python:3.6
+      - image: circleci/python:3.8
       - image: mongo:4.0
       - image: rabbitmq:3
     working_directory: ~/st2
@@ -113,7 +113,7 @@ jobs:
     resource_class: large
     docker:
       # The primary container is an instance of the first list image listed. Your build commands run in this container.
-      - image: circleci/python:3.6
+      - image: circleci/python:3.8
     working_directory: ~/st2
     environment:
       - DISTROS: "bionic focal el7 el8"

From ab028929e91f5ca0049af13c626a6067af52ecfc Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 15:08:54 +0100
Subject: [PATCH 10/14] drop python 3.6

---
 .github/workflows/ci.yaml | 38 --------------------------------------
 1 file changed, 38 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3087324189..b8c66cb025 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -54,14 +54,6 @@ jobs:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         include:
-          - name: 'Lint Checks (black, flake8, etc.)'
-            task: 'ci-checks'
-            python-version-short: '3.6'
-            python-version: '3.6.13'
-          - name: 'Compile (pip deps, pylint, etc.)'
-            task: 'ci-compile'
-            python-version-short: '3.6'
-            python-version: '3.6.13'
           - name: 'Lint Checks (black, flake8, etc.)'
             task: 'ci-checks'
             python-version-short: '3.8'
@@ -312,18 +304,6 @@ jobs:
         # NOTE: To speed the CI run, we split unit and integration tests into multiple jobs where
         # each job runs subset of tests.
         include:
-          - name: 'Unit Tests (chunk 1)'
-            task: 'ci-unit'
-            nosetests_node_total: 2
-            nosetests_node_index: 0
-            python-version-short: '3.6'
-            python-version: '3.6.13'
-          - name: 'Unit Tests (chunk 2)'
-            task: 'ci-unit'
-            nosetests_node_total: 2
-            nosetests_node_index: 1
-            python-version-short: '3.6'
-            python-version: '3.6.13'
           - name: 'Unit Tests (chunk 1)'
             task: 'ci-unit'
             nosetests_node_total: 2
@@ -499,24 +479,6 @@ jobs:
         include:
           # We run pack tests here since they rely on some integration tests set
           # up (aka stanley user being present, etc.)
-          - name: 'Pack Tests'
-            task: 'ci-packs-tests'
-            nosetests_node_total: 1
-            nosetests_node_index: 0
-            python-version-short: '3.6'
-            python-version: '3.6.13'
-          - name: 'Integration Tests (chunk 1)'
-            task: 'ci-integration'
-            nosetests_node_total: 2
-            nosetests_node_index: 0
-            python-version-short: '3.6'
-            python-version: '3.6.13'
-          - name: 'Integration Tests (chunk 2)'
-            task: 'ci-integration'
-            nosetests_node_total: 2
-            nosetests_node_index: 1
-            python-version-short: '3.6'
-            python-version: '3.6.13'
           - name: 'Pack Tests'
             task: 'ci-packs-tests'
             nosetests_node_total: 1

From 4eec818c672d96e0a77a7afb2599dd92c6c5227d Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 15:09:56 +0100
Subject: [PATCH 11/14] drop python 3.6

---
 .github/workflows/microbenchmarks.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/microbenchmarks.yaml b/.github/workflows/microbenchmarks.yaml
index 9477b256f8..c44deb6ac3 100644
--- a/.github/workflows/microbenchmarks.yaml
+++ b/.github/workflows/microbenchmarks.yaml
@@ -34,12 +34,6 @@ jobs:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         include:
-          - name: 'Microbenchmarks'
-            task: 'micro-benchmarks'
-            nosetests_node_total: 1
-            nosetests_node_index: 0
-            python-version-short: '3.6'
-            python-version: '3.6.13'
           - name: 'Microbenchmarks'
             task: 'micro-benchmarks'
             nosetests_node_total: 1

From 18b4ffc179983067da0b3b98ec1061870aede44e Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 15:10:53 +0100
Subject: [PATCH 12/14] drop python 3.6 support

---
 .github/workflows/orquesta-integration-tests.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/orquesta-integration-tests.yaml b/.github/workflows/orquesta-integration-tests.yaml
index b45dd5fb84..0b9f8cd360 100644
--- a/.github/workflows/orquesta-integration-tests.yaml
+++ b/.github/workflows/orquesta-integration-tests.yaml
@@ -55,12 +55,6 @@ jobs:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         include:
-          - name: 'Integration Tests (Orquesta)'
-            task: 'ci-orquesta'
-            nosetests_node_total: 1
-            nosetests_node_index: 0
-            python-version: '3.6.13'
-            python-version-short: '3.6'
           - name: 'Integration Tests (Orquesta)'
             task: 'ci-orquesta'
             nosetests_node_total: 1

From 72aa17d9f28fdd183ea201e28ba2f024571dc4b4 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 15:11:56 +0100
Subject: [PATCH 13/14] drop python3.6 support

---
 .github/workflows/test.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 172c0cd64d..a7b28a88d9 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -32,9 +32,6 @@ jobs:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         include:
-          - name: 'Test (pants runs: pytest)'
-            python-version-short: '3.6'
-            python-version: '3.6.13'
           - name: 'Test (pants runs: pytest)'
             python-version-short: '3.8'
             python-version: '3.8.10'

From e27cc6a2c5e131b1ca78aaeab7698c754bf08651 Mon Sep 17 00:00:00 2001
From: Philipp Homberger <philipp.homberger@mail.schwarz>
Date: Fri, 1 Dec 2023 15:22:06 +0100
Subject: [PATCH 14/14] Update config.yml

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index d5b078070d..c1f84d7fa8 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -219,7 +219,7 @@ jobs:
   deploy:
     docker:
       # The primary container is an instance of the first list image listed. Your build commands run in this container.
-      - image: circleci/ruby:2.7
+      - image: circleci/ruby:3.2.2
     working_directory: /tmp/deploy
     environment:
       - DISTROS: "bionic focal el7 el8"