💡 Update Python to 3.11

[AndyRae]

Is there an existing issue for this?

• [X] I have searched the existing issues

Is your proposal related to a problem or functionality gap?

Python 3.8 will be 5 years old this year, and will no longer be supported.

It's also frustrating to work with 3.8 - as MacOS with M chips don't support it.

Describe your proposal

Update the workers and Django app to use 3.12

Describe alternatives you've considered

No response

I'm part of a Project Team

Yes - DRS

Anything else?

There shouldn't be many problems in going from 3.8 - 3.12. We should update other dependencies also - like Django is now on 5.0, at least a move to the LTS of 4.2

Are you willing to contribute to developing this feature?

✅ Yes, me or my team intend to do the development.

Progress

• [x] Functions Updated 3.11 #657
• [x] Webapp Updated 3.11

[spco]

+1 from me, as well as for Django. This package isn't for use within a general user's environment, only within a containerised environment, so it's totally reasonable to enforce a higher Python version.

Note that Azure Functions only support up to 3.11 currently. https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference-python?tabs=asgi%2Capplication-level&pivots=python-mode-configuration#python-version

So should we use 3.11 across the board for consistency/clarity, or use 3.11 in Functions while using python-3.12-slim base image for the main app?

For reference, 3.11 is supported until 2027, 3.12 until 2028. https://devguide.python.org/versions/.

Similarly for Django https://en.wikipedia.org/wiki/Django_(web_framework)#Version_history, 4.2 is already out of main support, under LTS until April 2026. 5.0 is only in support until April 2025, as it's not LTS.

[AndyRae]

Perfect - good spot on the Functions, in that case I think we should use 3.11 for consistency. We should definitely take the longer term view on Django, so 4.2 would buy us 2 years. A quick look through the Django package dependencies all look fine to support 4.2/5 also

[spco]

Dependabot has pointed out that our current Django (3.1.14) is vulnerable to https://ubuntu.com/security/CVE-2024-24680. Fix is to bump Django to >=3.2.24.

We don't use the template filter that's vulnerable, so it's not an immediate issue, but worth noting, another +1 to upgrading Django soon.