Summary

Follow-up to DRIVERS-3727. The weekly Dependabot job that manages uv.lock exits red since that change merged: uv resolves the lockfile across the whole requires-python range, and current releases of seven dependencies (boto3, pymongo, azure-identity, azure-keyvault-secrets, azure-mgmt-compute, azure-mgmt-network, cryptography) dropped Python 3.9 or 3.10, so each per-package probe fails with dependency_file_not_resolvable. Rather than add an ignore entry each time a package drops a Python version, this work sets the minimum version requires-python declares to follow CPython's end-of-life dates.

Motivation

Who is the affected end user?

Drivers teams that consume this repository and the maintainers who watch its CI.

How does this affect the end user?

A scheduled job is red every week, so a real regression in it no longer stands out. Hosts on Python 3.9 or 3.10 silently stop receiving dependency updates, because uv forks the lockfile and pins old versions to the old-Python splits.

How likely is it that this problem or use case will occur?

Main path: every weekly Dependabot run until the minimum supported version moves. The failure class is not new: hatchling needed a version pin for the same reason in October (PR #895), and seven packages failed together on 2026-11-09 (the Dependabot run).

If the problem does occur, what are the consequences and how severe are they?

Seven resolution errors per run (job 1691594074). No outage, but updates for the affected packages stall and the permanent red erodes trust in CI.

Is this issue urgent?

No, but it should land before more releases breach the minimum supported version.

Is this ticket required by a downstream team?

No.

Is this ticket only for tests?

No. It changes the Python support policy and how hosts obtain interpreters.

Acceptance Criteria

• The repository supports only CPython versions that have not reached end of life; as of November 2026 the minimum supported version is 3.11, and it is reviewed each October.
• requires-python is declared exactly once, in the workspace root pyproject.toml; workspace members may not declare it.
• ensure_uv reuses a host interpreter that satisfies the minimum, including the Python toolchain, and bootstraps a uv-managed interpreter only when none qualifies.
• The weekly Dependabot uv job runs green against the new minimum.