[github-actions]

Auto-generated by the Vendor Sync workflow after Pipfile.lock changed on main (e.g. a merged Dependabot PR). Regenerates vendor/ via pipenv run vendor per vendor/README.md.

Warning

This PR was opened with the default GITHUB_TOKEN, so GitHub will not auto-trigger the required status checks (run (3.9), run (3.10), run (3.11), e2e-tests). A maintainer needs to manually re-run them (or push an empty commit) before merging. See the TODO(#94) note in .github/workflows/vendor-sync.yml for the long-term fix.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[felickz]

@copilot this broke 3.9 ... is that a dependency that stopped supporting this version of python?

https://github.com/advanced-security/policy-as-code/actions/runs/32197496048/job/95905233858?pr=211

is 3.9 python EOL?

[Copilot]

@copilot this broke 3.9 ... is that a dependency that stopped supporting this version of python?

https://github.com/advanced-security/policy-as-code/actions/runs/32197496048/job/95905233858?pr=211...

Yes on both counts.

Why 3.9 broke: the failure is not in our code, it is the vendored urllib3 2.7.0 using PEP 604 union syntax at import time:

File "vendor/urllib3/_base_connection.py", line 10, in <module>
    bytes, typing.IO[typing.Any], typing.Iterable[bytes | str], str
TypeError: unsupported operand type(s) for |: 'type' and 'type'

X | Y on types only works at runtime from Python 3.10 onward. From Pipfile.lock, three of our resolved deps now declare python_version >= '3.10':

• ghastoolkit==0.18.3
• requests==2.34.2
• urllib3==2.7.0

Pipenv resolved and vendored them on 3.11 (the vendor-sync job pins 3.11), so vendor/ now contains 3.10+ only code. The unit test jobs still pass on 3.9 because they use the pipenv-installed deps, but anything running with PYTHONPATH=vendor (the CLI/e2e jobs and the composite action) fails on 3.9.

Is 3.9 EOL: yes, Python 3.9 reached end of life on 2025-10-31, which is why upstream projects have been dropping it.

Suggested fix (happy to push it here or in a separate PR, your call, since run (3.9) is currently a required status check and removing it from the matrix means that check will never report):

1. Drop "3.9" from the matrices in .github/workflows/main.yml and .github/workflows/cli.yml.
2. Bump .github/workflows/docs.yml from 3.9 to 3.10+.
3. Update README.md from Python >= 3.9 to Python >= 3.10.
4. Update branch protection to require run (3.10) / run (3.11) instead of run (3.9).

The alternative, pinning the vendored deps back to 3.9 compatible versions, means holding ghastoolkit, requests, and urllib3 back indefinitely and missing security updates, so I would not recommend it.