fix: Drop Python 3.8 from dev resolution and CI test matrix

[workos-sdk-automation]

Summary

All 7 failing Renovate PRs (#528, #529, #531, #534, #545, #546) share the same root cause: requires-python = ">=3.8" forces uv to resolve dependencies for ALL Python versions including 3.8. When Renovate bumps a dev dependency (pytest, mypy, pytest-asyncio) to a version that dropped Python 3.8 support, uv sync --locked --dev fails.

Python 3.8 reached EOL in October 2024. This fix:

• Adds environments = ["python_version >= '3.9'"] to [tool.uv] so the lockfile only resolves for Python 3.9+, unblocking Renovate PRs
• Removes 3.8 from the CI test matrix and nox PYTHON_VERSIONS
• Keeps requires-python = ">=3.8" so end users on 3.8 can still install via pip (which resolves independently)
• Keeps 3.8 in the smoke-test matrix (no lockfile needed)
• Adds renovate packageRule to prevent Renovate from bumping the pyjwt 3.8 marker line in the future

Test plan

• uv lock succeeds without 3.8 resolution splits
• uv sync --dev installs all dev dependencies
• All 527 tests pass with uv run pytest
• CI goes green on this PR
• After merge, merge main into each failing Renovate PR branch + uv lock to unblock them

🤖 Generated with Claude Code

[gjtorikian]

can't really do this without a major version bump of the SDK

[greptile-apps]

Greptile Summary

This PR drops Python 3.8 from the development environment and CI test matrix while preserving backward compatibility for end users. Python 3.8 reached EOL in October 2024, and dev dependencies (pytest, mypy, pytest-asyncio) are dropping 3.8 support, causing all Renovate PRs to fail.

Key Changes:

• Added environments = ["python_version >= '3.9'"] to [tool.uv] in pyproject.toml to restrict lockfile resolution to Python 3.9+
• Removed 3.8 from CI test matrix and nox PYTHON_VERSIONS list
• Regenerated uv.lock without Python 3.8 resolution splits (removes 689 lines)
• Added Renovate package rule to prevent bumping pyjwt beyond 2.9.x (which would break the Python 3.8 environment marker)
• Preserved requires-python = ">=3.8" so end users on Python 3.8 can still install via pip (pip resolves dependencies independently from the lockfile)

Impact:

• Unblocks 7 failing Renovate PRs that were trying to bump dev dependencies incompatible with Python 3.8
• Development and testing now only happens on Python 3.9-3.14
• Python 3.8 users can still install the package via PyPI, but won't get dev environment support
• Smoke tests still include Python 3.8 (no lockfile needed for those)

Confidence Score: 5/5

• This PR is safe to merge with minimal risk - it's a well-designed configuration change that maintains backward compatibility
• The changes are surgical and well-reasoned: restricting dev environment to 3.9+ while keeping requires-python = ">=3.8" preserves pip compatibility for end users. The approach correctly distinguishes between lockfile resolution (dev) and package installation (end users). All changes are consistent across CI, nox, pyproject.toml, and the lockfile. The Renovate rule prevents future issues with the pyjwt version marker.
• No files require special attention - all changes are straightforward configuration updates

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Removed Python 3.8 from test matrix to align with new uv.lock resolution strategy
pyproject.toml	Added [tool.uv] environments constraint to restrict lockfile resolution to Python 3.9+
renovate.json	Added package rule to prevent Renovate from bumping pyjwt 2.9.x (Python 3.8 constraint)

Flowchart

flowchart TD
    A[Python 3.8 EOL Oct 2024] --> B{Problem: Dev dependencies<br/>dropping 3.8 support}
    B --> C[Renovate PRs failing:<br/>pytest, mypy, etc.]
    C --> D[uv resolves for ALL versions<br/>including 3.8]
    D --> E[Solution: Add environments filter<br/>to pyproject.toml]
    E --> F[tool.uv environments =<br/>python_version >= 3.9]
    F --> G[Remove 3.8 from<br/>CI test matrix]
    F --> H[Remove 3.8 from<br/>nox PYTHON_VERSIONS]
    F --> I[Regenerate uv.lock<br/>without 3.8 splits]
    F --> J[Add Renovate rule to<br/>freeze pyjwt 2.9.x]
    G --> K[Tests run on 3.9-3.14 only]
    H --> K
    I --> L[Lockfile only resolves<br/>for Python 3.9+]
    J --> M[Keep pyjwt marker for<br/>3.8 pip users]
    K --> N{Result}
    L --> N
    M --> N
    N --> O[Dev dependencies work<br/>Renovate PRs unblocked]
    N --> P[3.8 users can still<br/>pip install via PyPI]
    
    style A fill:#ffcccc
    style E fill:#ccffcc
    style N fill:#cceeff
    style O fill:#ccffcc
    style P fill:#ccffcc

Loading

_{Last reviewed commit: f6210d5}

[greptile-apps]

_{5 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}