Bump minimum Python version to 3.10

jku · jku · commit 8513f46c2b04 · 2026-01-08T13:08:47.000+02:00
We could just stop testing with 3.9... but I think this will lead to
unintentionally breaking 3.9 anyway sooner or later.

Signed-off-by: Jussi Kukkonen &lt;jkukkonen@google.com&gt;
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Set up Python (oldest supported version)
         uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
-          python-version: "3.9"
+          python-version: "3.10"
           cache: 'pip'
           cache-dependency-path: |
             requirements/*.txt
@@ -38,7 +38,7 @@ jobs:
     needs: lint-test
     strategy:
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         os: [ubuntu-latest]
         include:
           - python-version: "3.x"
diff --git a/pyproject.toml b/pyproject.toml
@@ -8,7 +8,7 @@ description = "A secure updater framework for Python"
 readme = "README.md"
 license = "Apache-2.0 OR MIT"
 license-files = ["LICENSE", "LICENSE-MIT"]
-requires-python = ">=3.8"
+requires-python = ">=3.10"
 authors = [
   { email = "theupdateframework@googlegroups.com" },
 ]
@@ -31,11 +31,11 @@ classifiers = [
   "Operating System :: POSIX :: Linux",
   "Programming Language :: Python",
   "Programming Language :: Python :: 3",
-  "Programming Language :: Python :: 3.9",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
   "Programming Language :: Python :: Implementation :: CPython",
   "Topic :: Security",
   "Topic :: Software Development",
diff --git a/tests/test_trusted_metadata_set.py b/tests/test_trusted_metadata_set.py
@@ -6,8 +6,9 @@
 import os
 import sys
 import unittest
+from collections.abc import Callable
 from datetime import datetime, timezone
-from typing import Callable, ClassVar
+from typing import ClassVar
 
 from securesystemslib.signer import Signer
 
diff --git a/tests/test_updater_ng.py b/tests/test_updater_ng.py
@@ -11,8 +11,8 @@
 import sys
 import tempfile
 import unittest
-from collections.abc import Iterable
-from typing import TYPE_CHECKING, Callable, ClassVar
+from collections.abc import Callable, Iterable
+from typing import TYPE_CHECKING, ClassVar
 from unittest.mock import MagicMock, patch
 
 from securesystemslib.signer import Signer
diff --git a/tests/utils.py b/tests/utils.py
@@ -31,8 +31,9 @@
 import threading
 import time
 import warnings
+from collections.abc import Callable
 from contextlib import contextmanager
-from typing import IO, TYPE_CHECKING, Any, Callable
+from typing import IO, TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
     import unittest
@@ -111,7 +112,7 @@ def wait_for_server(
             sock.settimeout(remaining_timeout)
             sock.connect((host, port))
             succeeded = True
-        except socket.timeout:
+        except TimeoutError:
             pass
         except OSError as e:
             # ECONNREFUSED is expected while the server is not started
diff --git a/tuf/api/_payload.py b/tuf/api/_payload.py
@@ -396,19 +396,15 @@ def verified(self) -> bool:
     def signed(self) -> dict[str, Key]:
         """Dictionary of all signing keys that have signed, from both
         VerificationResults.
-        return a union of all signed (in python<3.9 this requires
-        dict unpacking)
         """
-        return {**self.first.signed, **self.second.signed}
+        return self.first.signed | self.second.signed
 
     @property
     def unsigned(self) -> dict[str, Key]:
         """Dictionary of all signing keys that have not signed, from both
         VerificationResults.
-        return a union of all unsigned (in python<3.9 this requires
-        dict unpacking)
         """
-        return {**self.first.unsigned, **self.second.unsigned}
+        return self.first.unsigned | self.second.unsigned
 
 
 class _DelegatorMixin(metaclass=abc.ABCMeta):
