Skip to content

chore: bump minimum Python to 3.10 and upgrades Black to 26.3.1#269

Merged
danielmeppiel merged 2 commits intomainfrom
chore/bump-python-310-fix-black
Mar 12, 2026
Merged

chore: bump minimum Python to 3.10 and upgrades Black to 26.3.1#269
danielmeppiel merged 2 commits intomainfrom
chore/bump-python-310-fix-black

Conversation

@danielmeppiel
Copy link
Collaborator

@danielmeppiel danielmeppiel commented Mar 12, 2026

Summary

Raises the minimum Python version from 3.9 to 3.10 and upgrades Black to 26.3.1.

Why Dependabot couldn't fix this

Black 26.3.1 (the patched version) requires Python >=3.10. Since the project declared requires-python = ">=3.9", Dependabot couldn't find a single version satisfying both constraints — it was capped at 25.11.0.

Changes

  • pyproject.toml: requires-python bumped from >=3.9 to >=3.10
  • uv.lock: Black upgraded 25.1.0 → 26.3.1 (also simplified — no more multi-fork resolution needed)
  • Docs: Updated Python version references in key-concepts.md and agent-workflows.md

Justification

  • Python 3.9 reached end-of-life in October 2025 (5 months ago)
  • CI already targets Python 3.12 exclusively
  • No known users running on 3.9

Resolves #17

- Raise requires-python from >=3.9 to >=3.10 (3.9 is EOL since Oct 2025)
- Upgrade black from 25.1.0 to 26.3.1 (fixes CVE for arbitrary file
  writes via unsanitized --python-cell-magics cache file name)
- Update docs references from 3.9+ to 3.10+
- Resolves dependabot alert #17

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings March 12, 2026 21:47
@danielmeppiel danielmeppiel changed the title chore: bump minimum Python to 3.10, fix Black CVE (dependabot #17) chore: bump minimum Python to 3.10 Mar 12, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR raises the project’s minimum supported Python version to enable upgrading Black to a patched release that requires Python >=3.10, and updates docs to reflect the new baseline.

Changes:

  • Bump requires-python from >=3.9 to >=3.10 in packaging metadata.
  • Update documentation references from Python 3.9+ to 3.10+.
  • (Per PR description) Upgrade Black in the lockfile to address Dependabot alert #17.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File Description
pyproject.toml Raises declared minimum Python version to 3.10+.
docs/src/content/docs/introduction/key-concepts.md Updates “Key Technologies” Python version reference to 3.10+.
docs/src/content/docs/guides/agent-workflows.md Updates runtime requirements table to Python 3.10+ for the LLM runtime.
Comments suppressed due to low confidence (2)

pyproject.toml:10

  • Package classifiers still include "Programming Language :: Python :: 3.9" even though requires-python is now >=3.10. This makes the published metadata inconsistent/misleading. Remove the 3.9 classifier (and ensure classifiers reflect the supported versions).
requires-python = ">=3.10"

pyproject.toml:10

  • The project now declares support for Python >=3.10, but CI and dev tooling are still hard-pinned to Python 3.12 (GitHub Actions PYTHON_VERSION=3.12; [tool.black].target-version = ["py312"]; [tool.mypy].python_version = "3.12"). If 3.10/3.11 are intended to be supported, add CI coverage for those versions and align tooling targets accordingly; otherwise consider bumping requires-python to match what is actually tested.
requires-python = ">=3.10"

description = "MCP configuration tool"
readme = "README.md"
requires-python = ">=3.9"
requires-python = ">=3.10"
Copy link

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requires-python is now >=3.10, but the installer script still checks for and advertises Python 3.9+ (install.sh sets REQUIRED_VERSION="3.9" and prints "Python 3.9+ detected"). On systems with only Python 3.9, the installer may route to pip install apm-cli and then fail due to the new package requirement. Update install.sh (version check + user-facing messages) to require 3.10+ to match this change.

This issue also appears in the following locations of the same file:

  • line 10
  • line 10

Copilot uses AI. Check for mistakes.
@danielmeppiel danielmeppiel changed the title chore: bump minimum Python to 3.10 chore: bump minimum Python to 3.10 and fix Black CVE Mar 12, 2026
@danielmeppiel danielmeppiel changed the title chore: bump minimum Python to 3.10 and fix Black CVE chore: bump minimum Python to 3.10 Mar 12, 2026
@danielmeppiel danielmeppiel changed the title chore: bump minimum Python to 3.10 chore: bump minimum Python to 3.10 and upgrades Black to 26.3.1 Mar 12, 2026
@danielmeppiel danielmeppiel merged commit 5f5cb7f into main Mar 12, 2026
33 checks passed
@danielmeppiel danielmeppiel deleted the chore/bump-python-310-fix-black branch March 12, 2026 22:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Future] Design community template ecosystem via create-apm-* packages

2 participants