feat!: require Python 3.13

[mbruzda-splunk]

What

Adds official Python 3.13 support and makes Python 3.13 the minimum supported runtime.

Breaking change

Python 3.7 through 3.12 are no longer supported. Consumers must run Python 3.13 or newer.

The package metadata now declares python = "^3.13", and all build, test, documentation, and release jobs run on Python 3.13.

Why

Supporting urllib3's security-fixed 2.7 release requires a newer Python runtime. Removing the legacy runtime constraint also allows stale direct and transitive dependencies to be refreshed to versions without the vulnerabilities reported by FOSSA.

Changes

• require Python 3.13 and remove older Python versions from CI
• require urllib3 >=2.7.0,<3
• require pytest >=9.0.3,<10
• update development tooling constraints for Black, mypy, and pre-commit
• regenerate poetry.lock with Poetry 1.5.1
• update Renovate's urllib3 policy
• pass the source branch explicitly to fossa analyze so PR reports do not fall back to master
• retain the Python 3.13 flake8 compatibility configuration

Security result

The refreshed project dependency environment reports no known vulnerable packages in an independent audit. The environment's standalone pip executable is not part of the package dependency graph or poetry.lock.

Notable resolved versions include:

• urllib3 2.7.0
• requests 2.34.2
• pytest 9.1.1
• Black 26.5.1
• Pygments 2.20.0
• pymdown-extensions 11.0.1
• virtualenv 21.7.4

Verification

Python 3.13:

• 17 unit tests passed
• 5 functional flow tests passed
• 1 functional feature test passed
• pip check passed
• poetry check passed
• poetry lock --check passed
• poetry build passed
• all pre-commit hooks passed
• workflow YAML and Renovate JSON parsed successfully

BREAKING CHANGE: Python 3.7 through 3.12 are no longer supported.

[mbruzda-splunk]

Downstream Python 3.13 validation status

• Okta Identity Cloud — validation PR #459, Actions run 31699584392. Unit tests passed; the three UCC modinput jobs (Splunk 9.4.10, 10.0.5, and 10.2.2) are still running.
• Box — validation PR #826, Actions run 31699590850. Unit tests passed; the three UCC modinput jobs are still running.
• Google Workspace — validation PR #704, Actions run 31699597913. CI reached Python 3.13.15 but failed during unit-test collection because the TA pins freezegun==1.2.2, which accesses private uuid APIs removed in Python 3.13. The dependent UCC modinput job was therefore skipped. This is a TA test-dependency impact, not a UCC framework failure.

PSA dependency compatibility finding

Latest PSA PR #962 requires both urllib3 >=2.5,<3 and pytest >=9.0.3,<10. The UCC helper currently requires urllib3 <2 and pytest <8, so both constraints must be widened; changing urllib3 alone is insufficient.

A local Python 3.13 compatibility experiment with UCC ranges urllib3 >=1.21.1,<3 and pytest >=7.4.4,<10, running urllib3 2.7.0 and pytest 9.1.1, passed:

• unit: 17 passed
• functional flow: 5 passed
• functional feature: 1 passed
• pip check: passed
• poetry build: passed

MSCS/O365 also need their direct dependency pins aligned with PSA and PSA restricted to the Python 3.13 branch of their dual Python range. Their SmartX dependency still pins urllib3 1.x; SmartX PR #465 already contains the compatible >=1.26,<3 change.

Status captured 2026-08-13; active run results will be followed up separately.

[mbruzda-splunk]

Sequencing clarification

PSA's final dependency change will be handled separately and may differ from the current PSA PR head inspected above. For ADDON-89516, keep this PR UCC-first and scoped to demonstrating Python 3.13 compatibility, including compatibility with urllib3 2.x while retaining urllib3 1.x support where required. The pytest 9 resolver experiment above is informational and should not be treated as a requirement for this PR unless the final PSA dependency contract requires it.

[mbruzda-splunk]

urllib3 2.x compatibility update pushed

The UCC dependency range is now urllib3 >=1.21.1,<3, and poetry.lock was regenerated with the repository's Poetry 1.5.1 format in signed commit a574f42.

Local Python 3.13 validation:

• locked urllib3 1.26.20: 17 unit + 5 functional-flow + 1 functional-feature passed
• explicit urllib3 2.7.0 with pytest 7.4.4: pip check clean; the same 23 tests passed
• full pre-commit: passed
• Poetry build: passed

Fresh CI runs pinned to a574f42:

• UCC framework CI
• Okta validation (PR #459)
• Google Workspace validation (PR #704)
• Box validation (PR #826)

The three downstream PRs now pin the exact updated UCC commit.