fix(google-auth): Drop support for Python 3.8 and 3.9 (#16946)

chalmerlowe · web-flow · commit dcbdd3b40eef · 2026-05-05T14:53:15.000-04:00
This PR updates `google-auth` to establish Python 3.10 as the minimum
supported version, dropping support for Python 3.9 and below.

### Changes
* Configuration: Updated `setup.py` and `noxfile.py` to require Python
3.10+ and remove references to Python 3.7, 3.8, and 3.9.
* Documentation: Updated `README.rst` and `CONTRIBUTING.rst` to state
that Python 3.10 is the minimum.
* Cleanup: Removed EOL warning code from source and tests.
* Constraints: Transferred lower bounds to `constraints-3.10.txt` and
dropped 3.8/3.9 files.

&gt; [!NOTE]
&gt; During local testing with Docker, 7 async tests failed on Python 3.10
inside `tests_async/transport/test_aiohttp_requests.py` (though all
tests passed successfully on 3.11 - 3.14). We are pushing to see if
these failures replicate on GitHub Actions or if they are just a local
environment quirk.

Fixes internal issue: http://b/482126936 🦕
diff --git a/packages/google-auth/CONTRIBUTING.rst b/packages/google-auth/CONTRIBUTING.rst
@@ -19,7 +19,7 @@ A few notes on making changes to ``google-auth-library-python``.
   using ``nox -s docs``.
 
 - The change must work fully on the following CPython versions:
-  3.8, 3.9, 3.10, 3.11, 3.12, 3.13 and 3.14 across macOS, Linux, and Windows.
+  3.10, 3.11, 3.12, 3.13 and 3.14 across macOS, Linux, and Windows.
 
 - The codebase *must* have 100% test statement coverage after each commit.
   You can test coverage via ``nox -e cover``.
diff --git a/packages/google-auth/README.rst b/packages/google-auth/README.rst
@@ -35,18 +35,7 @@ Note that the extras pyopenssl and enterprise_cert should not be used together b
 
 Supported Python Versions
 ^^^^^^^^^^^^^^^^^^^^^^^^^
-Python >= 3.8
-
-**NOTE**:
-Python 3.8 and Python 3.9 were marked as `unsupported`_ by the python community in 
-October 2024 and October 2025, respectively.
-We recommend that all developers upgrade to Python 3.10 and newer as soon as
-they can. Support for end-of-life Python runtimes will be removed from this
-library in future updates.
-Previous releases that support end-of-life Python versions will continue to be available
-for download, but future releases will only target supported versions.
-
-.. _unsupported: https://devguide.python.org/versions/#unsupported-versions
+Python >= 3.10
 
 Unsupported Python Versions
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/packages/google-auth/google/auth/__init__.py b/packages/google-auth/google/auth/__init__.py
@@ -15,8 +15,6 @@
 """Google Auth Library for Python."""
 
 import logging
-import sys
-import warnings
 
 from google.auth import version as google_auth_version
 from google.auth._default import (
@@ -32,26 +30,5 @@
 __all__ = ["default", "load_credentials_from_file", "load_credentials_from_dict"]
 
 
-class Python37DeprecationWarning(DeprecationWarning):  # pragma: NO COVER
-    """
-    Deprecation warning raised when Python 3.7 runtime is detected.
-    Python 3.7 support will be dropped after January 1, 2024.
-    """
-
-    pass
-
-
-# Raise warnings for deprecated versions
-eol_message = (
-    "You are using a Python version {} past its end of life. Google will update "
-    "google-auth with critical bug fixes on a best-effort basis, but not "
-    "with any other fixes or features. Please upgrade your Python version, "
-    "and then update google-auth."
-)
-if sys.version_info.major == 3 and sys.version_info.minor == 8:  # pragma: NO COVER
-    warnings.warn(eol_message.format("3.8"), FutureWarning)
-elif sys.version_info.major == 3 and sys.version_info.minor == 9:  # pragma: NO COVER
-    warnings.warn(eol_message.format("3.9"), FutureWarning)
-
 # Set default logging handler to avoid "No handler found" warnings.
 logging.getLogger(__name__).addHandler(logging.NullHandler())
diff --git a/packages/google-auth/google/oauth2/__init__.py b/packages/google-auth/google/oauth2/__init__.py
@@ -13,28 +13,3 @@
 # limitations under the License.
 
 """Google OAuth 2.0 Library for Python."""
-
-import sys
-import warnings
-
-
-class Python37DeprecationWarning(DeprecationWarning):  # pragma: NO COVER
-    """
-    Deprecation warning raised when Python 3.7 runtime is detected.
-    Python 3.7 support will be dropped after January 1, 2024.
-    """
-
-    pass
-
-
-# Raise warnings for deprecated versions
-eol_message = (
-    "You are using a Python version {} past its end of life. Google will update "
-    "google-auth with critical bug fixes on a best-effort basis, but not "
-    "with any other fixes or features. Please upgrade your Python version, "
-    "and then update google-auth."
-)
-if sys.version_info.major == 3 and sys.version_info.minor == 8:  # pragma: NO COVER
-    warnings.warn(eol_message.format("3.8"), FutureWarning)
-elif sys.version_info.major == 3 and sys.version_info.minor == 9:  # pragma: NO COVER
-    warnings.warn(eol_message.format("3.9"), FutureWarning)
diff --git a/packages/google-auth/noxfile.py b/packages/google-auth/noxfile.py
@@ -34,16 +34,13 @@
 
 DEFAULT_PYTHON_VERSION = "3.14"
 UNIT_TEST_PYTHON_VERSIONS = [
-    "3.8",
-    "3.9",
     "3.10",
     "3.11",
     "3.12",
     "3.13",
     "3.14",
 ]
 ALL_PYTHON = UNIT_TEST_PYTHON_VERSIONS.copy()
-ALL_PYTHON.extend(["3.7"])
 
 # Error if a python version is missing
 nox.options.error_on_missing_interpreters = True
@@ -151,8 +148,6 @@ def mypy(session):
 def unit(session, install_deprecated_extras):
     # Install all test dependencies, then install this package in-place.
 
-    if session.python in ("3.7",):
-        session.skip("Python 3.7 is no longer supported")
     min_py, max_py = UNIT_TEST_PYTHON_VERSIONS[0], UNIT_TEST_PYTHON_VERSIONS[-1]
     if not install_deprecated_extras and session.python not in (min_py, max_py):
         # only run double tests on first and last supported versions
diff --git a/packages/google-auth/setup.py b/packages/google-auth/setup.py
@@ -29,7 +29,7 @@
 
 requests_extra_require = ["requests >= 2.20.0, < 3.0.0"]
 
-aiohttp_extra_require = ["aiohttp >= 3.6.2, < 4.0.0", *requests_extra_require]
+aiohttp_extra_require = ["aiohttp >= 3.8.0, < 4.0.0", *requests_extra_require]
 
 pyjwt_extra_require = ["pyjwt>=2.0"]
 
@@ -112,13 +112,11 @@
     package_data={"google.auth": ["py.typed"], "google.oauth2": ["py.typed"]},
     install_requires=DEPENDENCIES,
     extras_require=extras,
-    python_requires=">=3.8",
+    python_requires=">=3.10",
     license="Apache 2.0",
     keywords="google auth oauth client",
     classifiers=[
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.8",
-        "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",
diff --git a/packages/google-auth/testing/constraints-3.10.txt b/packages/google-auth/testing/constraints-3.10.txt
@@ -1 +1,13 @@
-urllib3<2.0.0
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List *all* library dependencies and extras in this file.
+# Pin the version to the lower bound.
+#
+# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have foo==1.14.0
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.8.0
+requests==2.20.0
+pyjwt==2.0
diff --git a/packages/google-auth/testing/constraints-3.8.txt b/packages/google-auth/testing/constraints-3.8.txt
diff --git a/packages/google-auth/testing/constraints-3.9.txt b/packages/google-auth/testing/constraints-3.9.txt
diff --git a/packages/google-auth/tests/test_version_warnings.py b/packages/google-auth/tests/test_version_warnings.py
