From 3d8be0c3b220b461b0ae2469d7062758e10d7e40 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@users.noreply.github.com>
Date: Mon, 4 Aug 2025 14:14:09 -0700
Subject: [PATCH] deprecate python 3.9 (#10390)

i based this PR on https://github.com/certbot/certbot/pull/10034/

this is maybe a little early since [python 3.9's EOL is in
october](https://devguide.python.org/versions/#supported-versions), but
i thought this would be good to do now to ensure we didn't forget, help
keep us on schedule when we're not releasing every month, allow us to
fix the security alert those with access can see at
https://github.com/certbot/certbot/security/dependabot which is caused
by [us (transitively) needing an old version of urllib3 with python
3.9](https://github.com/certbot/certbot/blob/d80b1d395a146ceef361664640f97c6db2ae47de/tools/requirements.txt#L195),
and simplify development ever so slightly as discussed at
https://github.com/certbot/certbot/pull/10179

i created https://github.com/certbot/certbot/issues/10389 to track
dropping support entirely
---
 acme/src/acme/__init__.py             |  8 ++++++++
 certbot/src/certbot/__init__.py       | 10 ++++++++++
 certbot/src/certbot/_internal/main.py |  4 ++++
 newsfragments/10390.changed           |  1 +
 pytest.ini                            |  2 ++
 5 files changed, 25 insertions(+)
 create mode 100644 newsfragments/10390.changed

diff --git a/acme/src/acme/__init__.py b/acme/src/acme/__init__.py
index 1e21b5896..9a0f5d6e0 100644
--- a/acme/src/acme/__init__.py
+++ b/acme/src/acme/__init__.py
@@ -6,6 +6,7 @@ This module is an implementation of the `ACME protocol`_.
 
 """
 import sys
+import warnings
 
 # This code exists to keep backwards compatibility with people using acme.jose
 # before it became the standalone josepy package.
@@ -19,3 +20,10 @@ for mod in list(sys.modules):
     # preserved (acme.jose.* is josepy.*)
     if mod == 'josepy' or mod.startswith('josepy.'):
         sys.modules['acme.' + mod.replace('josepy', 'jose', 1)] = sys.modules[mod]
+
+if sys.version_info[:2] == (3, 9):
+    warnings.warn(
+            "Python 3.9 support will be dropped in the next planned release of "
+            "acme. Please upgrade your Python version.",
+            DeprecationWarning,
+    )  # pragma: no cover
diff --git a/certbot/src/certbot/__init__.py b/certbot/src/certbot/__init__.py
index 19465f97c..b8ac7c9d6 100644
--- a/certbot/src/certbot/__init__.py
+++ b/certbot/src/certbot/__init__.py
@@ -1,4 +1,14 @@
 """Certbot client."""
+import sys
+import warnings
 
 # version number like 1.2.3a0, must have at least 2 parts, like 1.2
 __version__ = '4.2.0.dev0'
+
+
+if sys.version_info[:2] == (3, 9):
+    warnings.warn(
+            "Python 3.9 support will be dropped in the next planned release of "
+            "certbot. Please upgrade your Python version.",
+            DeprecationWarning,
+    )  # pragma: no cover
diff --git a/certbot/src/certbot/_internal/main.py b/certbot/src/certbot/_internal/main.py
index 84175b6a4..c6e80fbc5 100644
--- a/certbot/src/certbot/_internal/main.py
+++ b/certbot/src/certbot/_internal/main.py
@@ -1867,6 +1867,10 @@ def main(cli_args: Optional[List[str]] = None) -> Optional[Union[str, int]]:
         if config.func != plugins_cmd:  # pylint: disable=comparison-with-callable
             raise
 
+    if sys.version_info[:2] == (3, 9):
+        logger.warning("Python 3.9 support will be dropped in the next planned release "
+                       "of Certbot - please upgrade your Python version.")
+
     with make_displayer(config) as displayer:
         display_obj.set_display(displayer)
 
diff --git a/newsfragments/10390.changed b/newsfragments/10390.changed
new file mode 100644
index 000000000..37a988e3b
--- /dev/null
+++ b/newsfragments/10390.changed
@@ -0,0 +1 @@
+Support for Python 3.9 was deprecated and will be removed in our next planned release.
diff --git a/pytest.ini b/pytest.ini
index 4785e2097..1edd7444a 100644
--- a/pytest.ini
+++ b/pytest.ini
@@ -29,6 +29,7 @@
 #     See https://github.com/certbot/certbot/issues/10291.
 # 13) Removing probe_sni from public acme, since it's only used in certbot-compatibility-test
 #     after TLS-ALPN support is removed.
+# 14) Ignore our own DeprecationWarning about Python 3.9 soon to be dropped.
 filterwarnings =
     error
     ignore:.*rsyncdir:DeprecationWarning
@@ -44,3 +45,4 @@ filterwarnings =
     ignore:TLSServer is deprecated:DeprecationWarning
     ignore:enforce_openssl_binary_usage parameter is deprecated:DeprecationWarning
     ignore:probe_sni is deprecated:DeprecationWarning
+    ignore:Python 3.9 support will be dropped:DeprecationWarning