[mattludwigs]

Context

• Resolves CORE-5247

Upgrades urllib3 from 1.26.18 to 2.8.0 in the dev/test lockfiles to resolve the open Dependabot urllib3 advisories. Every botocore release caps urllib3 at <1.27 on Python 3.8/3.9, and urllib3 2.7+ itself requires Python 3.10+, so this also drops support for Python 3.8 and 3.9 (both end-of-life). The packaging changes follow upstream aws/chalice's "Drop support for Python 3.9" commit.

• requirements-dev.txt / requirements-test.txt: urllib3==2.8.0, botocore/boto3==1.34.162 (first 1.34.x allowing urllib3 <3), s3transfer==0.10.4. No other pins changed.
• setup.py: add python_requires='>=3.10', drop 3.8/3.9 classifiers
• .github/workflows/run-tests.yml: drop 3.8/3.9 from both matrices
• .python-version: 3.10
• Add .changes/next-release entry

Additional notes & discussion

• urllib3 is not a runtime dependency of chalice (setup.py doesn't list it), so this only affects this repo's dev/test environments. Projects that install chalice resolve urllib3 through their own dependencies.
• urllib3 2.x changelog review: the only direct use is Retry(allowed_methods=[...]) in tests/functional/test_local.py, which already uses the 2.x API and passes a non-empty list. 2.8.0's breaking changes only affect HTTPS-proxy TLS configuration, which chalice doesn't use. Deploy error handling uses botocore.vendored.requests exceptions, which don't depend on urllib3.
• Validation on Python 3.10 and 3.12: make check, make pylint and make typecheck pass. tests/unit + tests/functional: 1360 passed, 17 failed. The same 17 fail on main's current pins with urllib3 1.26.18: 15 sdist tests break with unpinned setuptools 84, and 2 failed from a local port conflict. tests/functional/test_local.py (urllib3 Retry via requests) passes.
• run-tests.yml only triggers on master and feature/**, so CI likely won't run on this pull request against main.
• Follow-ups not included here: chalice/config.py still falls back to the python3.8 Lambda runtime (unreachable now), README/CONTRIBUTING still mention Python 3.7, and the lockfile headers still say "compiled with Python 3.8/3.7" because the pins were edited by hand instead of regenerated.

---

Note

Medium Risk
Breaking packaging change (python_requires>=3.10) blocks installs on Python 3.8/3.9; urllib3 2.x is limited to dev/test pins but bumps AWS client stack versions used in CI.

Overview
Drops support for Python 3.8 and 3.9 and requires Python 3.10+ for installing Chalice (python_requires, trove classifiers, .python-version, and CI matrices in run-tests.yml now only test 3.10–3.12).

Dev/test lockfiles move to urllib3==2.8.0 with matching boto3/botocore==1.34.162 and s3transfer==0.10.4 so botocore allows urllib3 2.x (addressing Dependabot advisories tied to urllib3 1.x on older Python). A next-release changelog entry records the enhancement.

urllib3 is not listed in setup.py runtime deps—this pin change affects this repo’s dev/test environments, not Chalice’s published dependency set.

^{Reviewed by Cursor Bugbot for commit be18bf9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

CORE-5247