Drop Python 3.7 support (implicit 3.11 now) (#1857)

However, pyupgrade is still targeting 3.7 to avoid typing syntax changes until other major PRs are merged.

.github/workflows/pytest.yml

@@ -34,7 +34,7 @@ jobs:
  fail-fast: false
  matrix:
  os: [ubuntu-latest] # TODO: Figure out macos-latest and Docker
- python-version: ['3.7', '3.11']
+ python-version: ['3.11']
 
  services:
  redis:
@@ -77,11 +77,7 @@ jobs:
  path: ${{ env.pythonLocation }}
  key: ${{ matrix.os }}-${{ env.pythonLocation }}-${{ hashFiles('requirements/base.txt') }}-${{ hashFiles('requirements.txt/test.txt') }}
  - name: Install Python dependencies
- if: ${{ matrix.python-version != '3.7' }}
  run: make install-python-test
- - name: Install Python dependencies (3.7)
- if: ${{ matrix.python-version == '3.7' }}
- run: make install-python-test-37
  - name: Install Node
  uses: actions/setup-node@v3
  with:

.pre-commit-config.yaml

@@ -2,8 +2,8 @@
 # See https://pre-commit.com/hooks.html for more hooks
 default_stages: [commit]
 # Enable this to enforce a common Python version:
-# default_language_version:
-# python: python3.9
+default_language_version:
+ python: python3.11
 ci:
  skip: [
  'pip-audit',

Makefile

@@ -1,5 +1,5 @@
 all:
- @echo "You must have an active Python virtualenv (3.7+) before using any of these."
+ @echo "You must have an active Python virtualenv (3.11+) before using any of these."
  @echo
  @echo "For production deployment:"
  @echo " make install # For first time setup and after dependency upgrades"
@@ -75,11 +75,6 @@ deps-python: deps-editable
  pip install --upgrade pip pip-tools pip-compile-multi
  pip-compile-multi --backtracking --use-cache
 
-deps-python-37: deps-editable
- # pip 23.2 breaks pip-tools 6, but pip-tools 7 doesn't support Python 3.7
- pip install --upgrade 'pip<23.2' pip-tools pip-compile-multi
- pip-compile-multi --backtracking --use-cache -o py37.txt
-
 deps-python-noup:
  pip-compile-multi --backtracking --use-cache --no-upgrade
 
@@ -123,15 +118,6 @@ install-python-test: install-python-pip deps-editable
 install-python: install-python-pip deps-editable
  pip install --use-pep517 -r requirements/base.txt
 
-install-python-dev-37: install-python-pip deps-editable
- pip install --use-pep517 -r requirements/dev.py37.txt
-
-install-python-test-37: install-python-pip deps-editable
- pip install --use-pep517 -r requirements/test.py37.txt
-
-install-python-37: install-python-pip deps-editable
- pip install --use-pep517 -r requirements/base.py37.txt
-
 install-dev: deps-editable install-python-dev install-npm assets
 
 install-test: deps-editable install-python-test install-npm assets

funnel/forms/account.py

@@ -112,8 +112,7 @@ def __call__(self, form, field) -> None:
 
 def pwned_password_validator(_form, field) -> None:
  """Validate password against the pwned password API."""
- # Add usedforsecurity=False when migrating to Python 3.9+
- phash = sha1(field.data.encode()).hexdigest().upper() # nosec
+ phash = sha1(field.data.encode(), usedforsecurity=False).hexdigest().upper()
  prefix, suffix = phash[:5], phash[5:]
 
  try:

funnel/models/email_address.py

@@ -338,10 +338,9 @@ def email_hash(self) -> str:
  @with_roles(call={'all'})
  def md5(self) -> Optional[str]:
  """MD5 hash of :property:`email_normalized`, for legacy use only."""
- # TODO: After upgrading to Python 3.9, use usedforsecurity=False
  return (
- hashlib.md5( # nosec # skipcq: PTC-W1003
- self.email_normalized.encode('utf-8')
+ hashlib.md5(
+ self.email_normalized.encode('utf-8'), usedforsecurity=False
  ).hexdigest()
  if self.email_normalized
  else None

funnel/models/phone_number.py

@@ -399,11 +399,8 @@ def phone_hash(self) -> str:
  @with_roles(call={'all'})
  def md5(self) -> Optional[str]:
  """MD5 hash of :attr:`phone`, for legacy use only."""
- # TODO: After upgrading to Python 3.9, use usedforsecurity=False
  return (
- hashlib.md5( # nosec # skipcq: PTC-W1003
- self.number.encode('utf-8')
- ).hexdigest()
+ hashlib.md5(self.number.encode('utf-8'), usedforsecurity=False).hexdigest()
  if self.number
  else None
  )