feat!: add Python 3.13 support and drop Python 3.9 support (#522)

This change accounts for the release of Python 3.13, which happened
07 OCT 2024. Anyone tracking this repository and this change should
update their use of `pyenv` locally, to include py3.13.x.

Changes made to add Python 3.13 support include:

* Update the Docker base image version
* Update the CONTRIBUTING documentation
* Update the testing environments in `tox`, workflows, and unit tests
* Update `pyproject.toml` and generate an updated `poetry.lock` lockfile
  * The existing `poetry-core` specified minimum requirement still works

Changes made to remove Python 3.9 support include:

* Update `pyproject.toml` and regenerate `poetry.lock`
  * Upgrade target version for QA tools
* Use the `--fix` option of `ruff` to automatically update code
  * Use the pipe (`|`) operator for type annotations everywhere possible
* Use `collections.abc.Callable` instead of `typing.Callable`
* Make use of parenthesized context managers
* Make use of match statement when parsing analysis results
* Update tests
  * Remove Python 3.9 from `tox` config
  * Update the test workflow
  * Update the test for supported Python versions
* Update documentation and remove references to Python 3.9

Closes: #488
Closes: #357

BREAKING CHANGE: Support for Python 3.9 was removed.

.github/workflows/auto_updates.yml

@@ -15,7 +15,7 @@ jobs:
     name: Update dependencies and hooks
     runs-on: ubuntu-latest
     env:
-      PYTHON_VERSION: "3.12"
+      PYTHON_VERSION: "3.13"
       POETRY_VERSION: "1.8.5"
     defaults:
       run:

.github/workflows/preview.yml

@@ -25,7 +25,7 @@ on:
       - main
 
 env:
-  PYTHON_VERSION: "3.12"
+  PYTHON_VERSION: "3.13"
   POETRY_VERSION: "1.8.5"
 
 jobs:

.github/workflows/release.yml

@@ -28,7 +28,7 @@ on:
         default: false
 
 env:
-  PYTHON_VERSION: "3.12"
+  PYTHON_VERSION: "3.13"
   POETRY_VERSION: "1.8.5"
 
 jobs:

.github/workflows/test.yml

@@ -15,7 +15,7 @@ defaults:
     shell: bash
 
 env:
-  PYTHON_VERSION: "3.12"
+  PYTHON_VERSION: "3.13"
   POETRY_VERSION: "1.8.5"
 
 jobs:
@@ -64,7 +64,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - name: Checkout the repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

CONTRIBUTING.md

@@ -104,26 +104,26 @@ Here's how to set up `phylum-ci` for local development.
 3. Ensure all supported Python versions are installed locally
    1. The strategy is to support the current/latest release plus the previous three minor versions of Python
    2. The current list
-      1. at the time of this writing is 3.9, 3.10, 3.11, and 3.12
+      1. at the time of this writing is 3.10, 3.11, 3.12, and 3.13
       2. can be inferred with the Python Developer's Guide, which maintains the
          [status of active Python releases](https://devguide.python.org/versions/)
    3. It is recommended to use [`pyenv`](https://github.com/pyenv/pyenv) to manage multiple Python installations
 
     ```sh
     # Use `pyenv install --list` to get available versions and usually install the
-    # latest patch version. For example, use `pyenv install --list |grep 3.9.` to
-    # show latest patch version for the cpython 3.9 minor release.
+    # latest patch version. For example, use `pyenv install --list |grep 3.10.` to
+    # show latest patch version for the cpython 3.10 minor release.
 
     # NOTE: These versions are examples; the latest patch version available from
     #       pyenv should be used in place of `.x`.
-    pyenv install 3.9.x
     pyenv install 3.10.x
     pyenv install 3.11.x
     pyenv install 3.12.x
+    pyenv install 3.13.x
     pyenv rehash
 
     # Ensure all environments are available globally (helps tox to find them)
-    pyenv global 3.12.x 3.11.x 3.10.x 3.9.x
+    pyenv global 3.13.x 3.12.x 3.11.x 3.10.x
     ```
 
 4. Ensure [poetry v1.7+](https://python-poetry.org/docs/) is installed
@@ -217,7 +217,7 @@ Before you submit a pull request, check that it meets these guidelines:
 * Have you created sufficient tests?
 * Have you updated all affected documentation?
 
-The pull request should work for Python 3.9, 3.10, 3.11, and 3.12.
+The pull request should work for Python 3.10, 3.11, 3.12 and 3.13.
 Check <https://github.com/phylum-dev/phylum-ci/actions> and make sure that the tests
 pass for all supported Python versions.
 
@@ -254,10 +254,10 @@ poetry run -- tox run -e py310 -- --help
 poetry run -- tox run-parallel -- tests/unit/test_package_metadata.py
 
 # run a specific test module across a specific test environment
-poetry run -- tox run -e py39 -- tests/unit/test_package_metadata.py
+poetry run -- tox run -e py310 -- tests/unit/test_package_metadata.py
 
 # run a specific test function within a test module, in a specific test environment
-poetry run -- tox run -e py310 -- tests/unit/test_package_metadata.py::test_python_version
+poetry run -- tox run -e py311 -- tests/unit/test_package_metadata.py::test_python_version
 ```
 
 To run a script entry point with the local checkout of the code (in develop mode), use `poetry`:

Dockerfile

@@ -69,7 +69,7 @@
 # $ scripts/docker_tests.sh --image phylum-ci
 ##########################################################################################
 
-FROM python:3.12-slim-bookworm AS builder
+FROM python:3.13-slim-bookworm AS builder
 
 # PKG_SRC is the path to a built distribution/wheel and PKG_NAME is the name of the built
 # distribution/wheel. Both can optionally be specified in glob form. When not defined,
@@ -121,7 +121,7 @@ RUN find ${PHYLUM_VENV} -type f -name '*.pyc' -delete
 # in the final layer and also known to be part of the $PATH
 COPY entrypoint.sh ${PHYLUM_VENV}/bin/
 
-FROM python:3.12-slim-bookworm
+FROM python:3.13-slim-bookworm
 
 # CLI_VER specifies the Phylum CLI version to install in the image.
 # Values should be provided in a format acceptable to the `phylum-init` script.

Dockerfile.slim

@@ -77,7 +77,7 @@
 # $ scripts/docker_tests.sh --image phylum-ci --slim
 ##########################################################################################
 
-FROM python:3.12-slim-bookworm AS builder
+FROM python:3.13-slim-bookworm AS builder
 
 # PKG_SRC is the path to a built distribution/wheel and PKG_NAME is the name of the built
 # distribution/wheel. Both can optionally be specified in glob form. When not defined,
@@ -129,7 +129,7 @@ RUN find ${PHYLUM_VENV} -type f -name '*.pyc' -delete
 # in the final layer and also known to be part of the $PATH
 COPY entrypoint.sh ${PHYLUM_VENV}/bin/
 
-FROM python:3.12-slim-bookworm
+FROM python:3.13-slim-bookworm
 
 # CLI_VER specifies the Phylum CLI version to install in the image.
 # Values should be provided in a format acceptable to the `phylum-init` script.

README.md

@@ -47,7 +47,7 @@ pipx run --spec phylum phylum-init <options>
 pipx run --spec phylum phylum-ci <options>
 ```
 
-These installation methods require Python 3.9+ to run.
+These installation methods require Python 3.10+ to run.
 For a self contained environment, consider using the Docker image as described below.
 
 Windows binaries are offered as [release artifacts][latest_rels] for a "standalone" solution that does not require

pyproject.toml

@@ -27,10 +27,10 @@ classifiers = [
     "Topic :: Software Development",
     "Topic :: Software Development :: Quality Assurance",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
 ]
 packages = [
     { include = "phylum", from = "src" },
@@ -46,7 +46,7 @@ phylum-init = "phylum.init.cli:main"
 phylum-ci = "phylum.ci.cli:script_main"
 
 [tool.poetry.dependencies]
-python = ">=3.9,<3.13"
+python = ">=3.10,<3.14"
 requests = "*"
 cryptography = "*"
 packaging = "*"
@@ -103,7 +103,7 @@ paths = ["src", "tests"]
 exclude = ["conftest.py"]
 
 [tool.refurb]
-python_version = "3.9"
+python_version = "3.10"
 format = "github"
 # FURB184 (use-fluent-interface) is ignored because the benefits of "chaining" calls identified by this rule are not
 # outweighed by the type checking based autocompletion and syntax highlighting provided by the IDE with the calls split.
@@ -112,7 +112,7 @@ ignore = [184]
 [tool.ruff]
 # Reference: https://docs.astral.sh/ruff/configuration/
 line-length = 120
-target-version = "py39"
+target-version = "py310"
 force-exclude = true
 src = ["src", "tests"]