Drop support for Python 3.6

[jeffwidman]

Python 3.6 was EOL'd in Dec 2021. However, we've continued to support it because the Ubuntu LTS 18.04 release installed it by default and 18.04 isn't EOL until April 2023:

dependabot-core/python/lib/dependabot/python/python_versions.rb

Lines 18 to 19 in cf448a9

	3.6.15 3.6.14 3.6.13 3.6.12 3.6.11 3.6.10 3.6.9 3.6.8 3.6.7 3.6.6 3.6.5 3.6.4 3.6.3
	3.6.2 3.6.1 3.6.0 3.5.10 3.5.8 3.5.7 3.5.6 3.5.5 3.5.4 3.5.3

But we're starting to run into various issues where 3.6 is forcing us to include hacky workarounds:

• latest versions of most of the python package managers break on 3.6, including poetry, pip, pipenv and pip-tools.
• Bumping to 22.04 is blocked because 3.6 conflicts with its openssl version

So this is a placeholder ticket to track any discussions around timing, things that we'll need to update/remove, etc.

If you're a user of Dependabot who is still on Python 3.6 and you cannot upgrade for some reason, please chime in here explaining your use case.

[jeffwidman]

Before we commit to a timeline on this, we'd like to measure how frequently users are running Dependabot against python 3.6 repos.

However, the new "pause for inactivity" feature is still gradually rolling out... and that will impact these metrics pretty drastically because abandoned repos that are still running Dependabot are the most likely to have never moved beyond 3.6.

We expect that rollout to finish in the next few weeks, after which our metrics will only include "active" users of Dependabot so we can gather accurate metrics and then work with some other internal stakeholders to decide on the actual date we'll drop support.

[edgarrmondragon]

Are there any updates on this? I think this is blocking support for Poetry 1.4.x

[grski]

This is a necessary change for #6758 AFAIK, or updating Poetry to 1.4.x
ANy update here or how can one help to make it move faster?

[jeffwidman]

Thanks for letting us know you want it, we've been a little hesitant to drop it because we know some users are probably still on 3.6 and we haven't yet had time to pull metrics to see how many users will get left behind when we drop it... so knowing we've got users that are blocked on us upgrading is good to know as a counterpoint.

What we're actually planning to do very soon is try to formalize some deprecation policies for our different ecosystems. That way we not only fix this immediate problem, but also have clear timelines for everyone to see of when we will be deprecating and/or completely dropping support for old versions so there's no surprises for anyone. This is a priority for us this quarter.

Anyway, hope to have you unblocked soonish.

[MDziwny]

While not dropping the python 3.6 is a nice intent, it's a bit problematic because it requires to pin some package managers versions (pip, pipenv, pip-tools, ...) in dependabot and the latest python versions are not well supported by dependabot (eg: on few of my projects, dependabot fails to upgrade a bunch of packages with extras requirements)

Anyway, if it's unblocked soon, we can wait 👍

[phillipuniverse]

@jeffwidman where are we on those metrics?

Poetry 1.5.1 is out and 1.5.0 has new options for different sources that are not backwards-compatible with Poetry 1.3.x. Plus the lock file can change (the header) when a developer might add a new dependency locally with Poetry 1.5 and Dependabot uses 1.3 - they just keep flip-flopping back and forth. There also isn't a great way I know of to lint contributions to ensure local Poetry usage is the same as Dependabot.

[MDziwny]

@jeffwidman , any news on this topic ? Can we help somehow ?

[jeffwidman]

You'll be happy to know I've got some time booked the next few weeks to work on this... we'll need to post a note on our blog with a deprecation date, so actually merging it may take a little longer. But expect to see PR's from me arriving in the next few weeks to make this happen.

[jeffwidman]

We are currently planning to drop support for 3.6 later this month, we'll post an official announcement on the GitHub changelog when we do, but you'll also see it here because once that goes out I'll start merging PR's to remove support for it and then close this issue.

We will also be dropping 3.7 soon after as it's also now EOL:

• Drop support for Python 3.7 #7677

[jeffwidman]

Deprecation date is August 17th: https://github.blog/changelog/2023-08-02-deprecation-notice-dependabot-to-drop-support-for-python-3-6-and-3-7/

[grski]

Thank you!