feat: require Python 3.10 and automate version reviews#3537
Conversation
There was a problem hiding this comment.
Pull request overview
This PR raises the SDK’s minimum supported Python runtime to 3.10 and adds policy + automation to keep Python-version support, metadata, documentation, and CI coverage synchronized over time.
Changes:
- Bump
Requires-Python/classifiers/tooling targets to Python 3.10+ and remove now-redundant Python-version dependency markers. - Add deterministic policy checks and wheel/SDist metadata validation (including verifying Python 3.9 rejects the new wheel).
- Expand CI to test min/current runtimes per PR, run a scheduled full-matrix smoke suite, and add a monthly least-privilege Codex-based version review workflow.
Reviewed changes
Copilot reviewed 17 out of 20 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Updates lock resolution and markers for the new minimum Python (3.10+). |
tests/lib/test_bedrock_auth_conformance.py |
Uses zip(..., strict=True) now that Python 3.10+ is required. |
scripts/utils/validate-python-version-wheel.py |
New script to validate Requires-Python in built artifacts and prove Python 3.9 rejects the wheel. |
scripts/utils/validate-httpx2-wheel.py |
Updates metadata assertions and runtime behaviors now that Python 3.10+ is the floor. |
scripts/utils/validate-bedrock-wheel.py |
Updates Bedrock extra validation for the unified supported Botocore requirement. |
scripts/check-python-version-policy.py |
New deterministic check ensuring docs/metadata/CI/tooling agree on Python support policy. |
requirements.lock |
Regenerated Rye lock output for the updated dependency surface. |
requirements-dev.lock |
Regenerated dev lock output for the updated dependency surface. |
README.md |
Updates stated minimum Python version and documents SemVer treatment for floor raises. |
PYTHON_VERSION_POLICY.md |
New policy doc describing support windows, testing expectations, and release treatment. |
pyproject.toml |
Raises requires-python, removes 3.9 classifier, and removes redundant Python markers on extras. |
examples/realtime/push_to_talk_app.py |
Updates inline script metadata to require Python 3.10+. |
CONTRIBUTING.md |
Links to the new Python version policy and documents floor-change requirements. |
AGENTS.md |
Adds repository guidance and a consolidated checklist for Python floor changes. |
.python-version |
Pins the contributor toolchain to Python 3.10.x. |
.github/workflows/python-version-review.yml |
New monthly workflow that snapshots lifecycle/usage data and runs a least-privilege Codex assessment. |
.github/workflows/ci.yml |
Adds per-PR min/current testing, scheduled compatibility smoke matrix, and metadata/rejection validations. |
.github/codex/python-version-review-config.toml |
New least-privilege Codex permission profile for the scheduled review. |
.github/codex/prompts/python-version-review.md |
New Codex prompt defining policy criteria and required output format. |
.github/CODEOWNERS |
Requires SDK team review for Python floor/policy and related automation files. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59fe6ea218
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Can we remove workflow_dispatch from the Codex workflow and make it cron-only? Scheduled workflows already run exclusively on the default branch (main). Otherwise LGMT |
|
@apcha-oai Fixed in 6922777: I removed |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 69227778fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06fe88d81d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8406132629
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41ac9de0ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
Reviewed 26090d3 with a thermonuclear maintainability pass. I inspected the complete diff, repository policy and packaging surfaces, monthly automation trust boundary, prior review threads, and current CI. The latest head closes the lockfile synchronization gap; I found no remaining substantive correctness, security, compatibility, or structural-maintainability issues. CI is green for lint, build plus wheel/sdist metadata and Python 3.9 rejection, Bedrock/HTTPX2 validators, Python 3.10/3.14 tests, HTTPX2, examples, CodeQL, breaking-change detection, and Agents SDK integration.
Summary
Why
Python 3.9 reached upstream end of life, while Python 3.10 remains supported through October 2026. Internal usage analysis estimates Python 3.9 at 2.09% of identifiable SDK downloads over 30 days and 2.44% over 90 days. The support policy, decision rationale, and rollout analysis are documented in the Python SDK version support PRD.
The automation follows the existing openai-go design: lifecycle and public usage inputs are snapshotted before Codex runs; the pinned agent runs as an unprivileged user with no command network access or repository writes; and a separate job without the OpenAI credential may publish an advisory issue. It never changes
Requires-Pythonautomatically.User impact
Python 3.9 users remain on
openai==2.48.0, the final compatible release. Installing the next minor release on Python 3.9 is rejected by standard package metadata rather than producing an import-time failure. Python 3.10 through 3.14 remain supported, with Python 3.15 tested as allowed-failure prerelease coverage.A runtime-floor increase is treated as an SDK minor release rather than a patch or major release when documented APIs remain compatible on supported runtimes and
Requires-Pythonprotects unsupported installers.Validation
rye build./scripts/lint./scripts/test: 7,079 passed, 29 skippedRequires-PythonvalidationRelease note
The OpenAI Python SDK now requires Python 3.10 or later.
openai==2.48.0is the final release installable on Python 3.9. Previously published versions remain available, but unsupported runtimes and older SDK releases do not receive guaranteed fixes or security backports.