Merge pull request #1229 from vespa-engine/thomasht86/bump-deps-security

Bump pillow, cryptography for security fixes and drop Python 3.9

Author: thomasht86

.github/workflows/feed.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: "3.9"
+          python-version: "3.10"
 
       - name: Install Sphinx
         run: |

.github/workflows/integration-except-cloud.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: "3.9"
+          python-version: "3.10"
           cache: "pip"
           cache-dependency-path: |
             pyproject.toml

.github/workflows/pyvespa-unit-tests.yml

@@ -15,7 +15,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-14]
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 

pyproject.toml

@@ -15,7 +15,7 @@ dependencies = [
     "httpr>=0.4.0",
     "docker",
     "jinja2",
-    "cryptography",
+    "cryptography>=46.0.5",
     "aiohttp",
     "tenacity>=8.4.1",
     "typing_extensions",
@@ -29,7 +29,7 @@ dependencies = [
     "httpx[http2]",
 ]
 
-requires-python = ">=3.9,<3.14"
+requires-python = ">=3.10,<3.14"
 
 [[project.authors]]
 name = "Thiago G. Martins"
@@ -174,3 +174,8 @@ docstring-code-line-length = "dynamic"
 "*.ipynb" = [
     "E402",
 ] # Ignore module level import not at top of file for notebooks
+
+[tool.uv]
+constraint-dependencies = [
+    "pillow>=12.1.1",
+]