feat: require Python 3.10 and automate version reviews - #3537
Conversation
There was a problem hiding this comment.
Pull request overview
This PR raises the SDK’s minimum supported Python runtime to 3.10 and adds policy + automation to keep Python-version support, metadata, documentation, and CI coverage synchronized over time.
Changes:
- Bump
Requires-Python/classifiers/tooling targets to Python 3.10+ and remove now-redundant Python-version dependency markers. - Add deterministic policy checks and wheel/SDist metadata validation (including verifying Python 3.9 rejects the new wheel).
- Expand CI to test min/current runtimes per PR, run a scheduled full-matrix smoke suite, and add a monthly least-privilege Codex-based version review workflow.
Reviewed changes
Copilot reviewed 17 out of 20 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Updates lock resolution and markers for the new minimum Python (3.10+). |
tests/lib/test_bedrock_auth_conformance.py |
Uses zip(..., strict=True) now that Python 3.10+ is required. |
scripts/utils/validate-python-version-wheel.py |
New script to validate Requires-Python in built artifacts and prove Python 3.9 rejects the wheel. |
scripts/utils/validate-httpx2-wheel.py |
Updates metadata assertions and runtime behaviors now that Python 3.10+ is the floor. |
scripts/utils/validate-bedrock-wheel.py |
Updates Bedrock extra validation for the unified supported Botocore requirement. |
scripts/check-python-version-policy.py |
New deterministic check ensuring docs/metadata/CI/tooling agree on Python support policy. |
requirements.lock |
Regenerated Rye lock output for the updated dependency surface. |
requirements-dev.lock |
Regenerated dev lock output for the updated dependency surface. |
README.md |
Updates stated minimum Python version and documents SemVer treatment for floor raises. |
PYTHON_VERSION_POLICY.md |
New policy doc describing support windows, testing expectations, and release treatment. |
pyproject.toml |
Raises requires-python, removes 3.9 classifier, and removes redundant Python markers on extras. |
examples/realtime/push_to_talk_app.py |
Updates inline script metadata to require Python 3.10+. |
CONTRIBUTING.md |
Links to the new Python version policy and documents floor-change requirements. |
AGENTS.md |
Adds repository guidance and a consolidated checklist for Python floor changes. |
.python-version |
Pins the contributor toolchain to Python 3.10.x. |
.github/workflows/python-version-review.yml |
New monthly workflow that snapshots lifecycle/usage data and runs a least-privilege Codex assessment. |
.github/workflows/ci.yml |
Adds per-PR min/current testing, scheduled compatibility smoke matrix, and metadata/rejection validations. |
.github/codex/python-version-review-config.toml |
New least-privilege Codex permission profile for the scheduled review. |
.github/codex/prompts/python-version-review.md |
New Codex prompt defining policy criteria and required output format. |
.github/CODEOWNERS |
Requires SDK team review for Python floor/policy and related automation files. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59fe6ea218
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Can we remove workflow_dispatch from the Codex workflow and make it cron-only? Scheduled workflows already run exclusively on the default branch (main). Otherwise LGMT |
|
@apcha-oai Fixed in 6922777: I removed |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 69227778fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06fe88d81d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8406132629
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41ac9de0ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
Reviewed 26090d3 with a thermonuclear maintainability pass. I inspected the complete diff, repository policy and packaging surfaces, monthly automation trust boundary, prior review threads, and current CI. The latest head closes the lockfile synchronization gap; I found no remaining substantive correctness, security, compatibility, or structural-maintainability issues. CI is green for lint, build plus wheel/sdist metadata and Python 3.9 rejection, Bedrock/HTTPX2 validators, Python 3.10/3.14 tests, HTTPX2, examples, CodeQL, breaking-change detection, and Agents SDK integration.
Automated Release PR --- ## 2.49.0 (2026-07-27) Full Changelog: [v2.48.0...v2.49.0](v2.48.0...v2.49.0) ### Features * require Python 3.10 and automate version reviews ([#3537](#3537)) ([d4c151d](d4c151d)) --- This pull request is managed by Stainless's [GitHub App](https://github.com/apps/stainless-app). The [semver version number](https://semver.org/#semantic-versioning-specification-semver) is based on included [commit messages](https://www.conventionalcommits.org/en/v1.0.0/). Alternatively, you can manually set the version number in the title of this pull request. For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request. 🔗 Stainless [website](https://www.stainlessapi.com) 📚 Read the [docs](https://app.stainlessapi.com/docs) 🙋 [Reach out](mailto:support@stainlessapi.com) for help or questions Co-authored-by: stainless-app[bot] <142633134+stainless-app[bot]@users.noreply.github.com>
Summary
Why
Python 3.9 reached upstream end of life, while Python 3.10 remains supported through October 2026. Internal usage analysis estimates Python 3.9 at 2.09% of identifiable SDK downloads over 30 days and 2.44% over 90 days. The support policy, decision rationale, and rollout analysis are documented in the Python SDK version support PRD.
The automation follows the existing openai-go design: lifecycle and public usage inputs are snapshotted before Codex runs; the pinned agent runs as an unprivileged user with no command network access or repository writes; and a separate job without the OpenAI credential may publish an advisory issue. It never changes
Requires-Pythonautomatically.User impact
Python 3.9 users remain on
openai==2.48.0, the final compatible release. Installing the next minor release on Python 3.9 is rejected by standard package metadata rather than producing an import-time failure. Python 3.10 through 3.14 remain supported, with Python 3.15 tested as allowed-failure prerelease coverage.A runtime-floor increase is treated as an SDK minor release rather than a patch or major release when documented APIs remain compatible on supported runtimes and
Requires-Pythonprotects unsupported installers.Validation
rye build./scripts/lint./scripts/test: 7,079 passed, 29 skippedRequires-PythonvalidationRelease note
The OpenAI Python SDK now requires Python 3.10 or later.
openai==2.48.0is the final release installable on Python 3.9. Previously published versions remain available, but unsupported runtimes and older SDK releases do not receive guaranteed fixes or security backports.