drop support for python 3.8

[baywet]

Python 3.8 has fallen out of support 2 days ago, which means it's not getting anymore security updates.
This also has consequences for dependency management since an increasing number of dependencies have moved away from it, and we're not able to get the new versions anymore.
Consider making this change at the same time as #341, and after #302 has been implemented.

TODO:

• remove 3.8 from the toml file
• remove 3.8 from the matrix of the workflows
• remove 3.8 from the policy definition if add github branch policy definition #327 has been implemented.

IMPORTANT: this is a source breaking change for 3.8 users (they'll need to upgrade to a newer version of python), make sure to include a bang in your message commit (e.g. feat!:) so a major version bump is made.

We do not need to major bump kiota itself since the generator will emit for the same API surface and we're within our support policy.

After the PR for this is merged but BEFORE the changes are released we also need to go back to any closed (not merged) dependabot PR and ask the bot to recreate the pull requests (@dependabot recreate) so we upgrade to the latest version of the dependencies.

[baywet]

additionally this documentation needs to be updated https://learn.microsoft.com/en-us/openapi/kiota/quickstarts/python#required-tools

[baywet]

And this one https://learn.microsoft.com/en-us/openapi/kiota/tutorials/python-azure?tabs=portal

[baywet]

to add data points for this one: it seems that libraries are perfectly fine with bumping the required minor version of python in a patch/minor release.
Here are some examples:

• chore(deps-dev): bump portalocker from 2.10.1 to 3.0.0 microsoftgraph/msgraph-sdk-python-core#723
• chore(deps-dev): bump aiohttp from 3.10.5 to 3.11.9 microsoftgraph/msgraph-sdk-python-core#730
• chore(deps-dev): bump coverage[toml] from 7.6.1 to 7.6.8 microsoftgraph/msgraph-sdk-python-core#729
• chore(deps-dev): bump pylint from 3.2.6 to 3.2.7 in the pylint group microsoftgraph/msgraph-sdk-python-core#722
• chore(deps-dev): bump aiohttp from 3.10.5 to 3.10.11 microsoftgraph/msgraph-sdk-python-core#720

Which means this is most likely was the eco-system expects, and it should be fine to follow that practice on our end.

[andrueastman]

Seeing the same in changelogs such as

• https://github.com/agronholm/anyio/releases/tag/4.6.0
• https://setuptools.pypa.io/en/stable/history.html#v75-4-0
• https://github.com/pylint-dev/pylint/releases/tag/v3.3.0

[baywet]

Looking at the Azure SDK guidelines, they are just providing a (outdated?) target version. No upgrade guidance. I have asked a question in the internal channels to see if any Python architect tells us following what the ecosystem is doing here is a bad idea for some reason.

[Ndiritu]

We could also consider dropping the deprecated type hint aliases in favor of the recommended types for Python 3.9+

[baywet]

I did get a first reply, Azure does drop support 6 months after the python version EOL, see their calendar

Looking at azure identity they dropped support for 3.7 without a major bump. And their guidelines indicate they do follow semver

I think that with all the evidence we've collected, it'd be ok to remove support for 3.8 in a minor bump. What do you think @andrueastman @Ndiritu ? If we're in agreement, we can probably proceed with the work.

In addition to the type hint improvement, we should also look at all the ignored dependabot PRs and make sure we update all dependencies before release the version that drops support for 3.8

[andrueastman]

I think that with all the evidence we've collected, it'd be ok to remove support for 3.8 in a minor bump. What do you think @andrueastman @Ndiritu ? If we're in agreement, we can probably proceed with the work.

Agree. We can drop the version with a minor bump given the evidence collected.

[baywet]

We should now expedite this, dependabot (and most likely the associated security features) is dropping 3.8 support in less than a month
https://github.blog/changelog/2025-01-06-closing-down-notice-dependabot-will-no-longer-support-python-version-3-8

[andrueastman]

Taking a look into this.

[andrueastman]

I believe #433 should be okay to review now.

On investigating, it looks like we are also emitting the deprecated type hints in the generated code, so I've also authored a generator PR at microsoft/kiota#5974.

My suggestion for review/release order here would be to

• - Review and merge in feat: drop support for python 3.8 #433
• - Validate needed dependabot updates then release next minor (tentatively v1.7.0)
• - Review and merge Generation PR [Python] Remove deprecated type aliases from generated code for python 3.9+. kiota#5974 with updated dependency of 1.7.0
• - Review and merge Updated validation client at Update validation project with typing updates #434 (updated with any feedback from above)
• - Review and merge docs PR at chore: update minimum python version MicrosoftDocs/openapi-docs#141