fix(ci): pin PY_VER build-arg so PR docker builds use Python 3.11+

supersetbot's "dev"/"lean" presets hardcode --build-arg PY_VER=3.10-slim-bookworm,
which lands ahead of our --extra-flags and overrides the Dockerfile's own
3.11 default. Now that requires-python is >=3.11, that stale pin makes uv
resolve apache-superset-core against Python 3.10 and fail. Append our own
PY_VER override, which wins as the last occurrence of the flag.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -50,9 +50,8 @@ body:
     attributes:
       label: Python version
       options:
-        - "3.9"
-        - "3.10"
         - "3.11"
+        - "3.12"
         - Not applicable
         - I don't know
     validations:

.github/actions/setup-backend/action.yml

@@ -32,8 +32,6 @@ runs:
         elif [ "$INPUT_PYTHON_VERSION" = "next" ]; then
           # currently disabled in GHA matrixes because of library compatibility issues
           RESOLVED_VERSION="3.12"
-        elif [ "$INPUT_PYTHON_VERSION" = "previous" ]; then
-          RESOLVED_VERSION="3.10"
         elif printf '%s' "$INPUT_PYTHON_VERSION" | grep -Eq '^[0-9]+\.[0-9]+(\.[0-9]+)?$'; then
           RESOLVED_VERSION="$INPUT_PYTHON_VERSION"
         else

.github/workflows/bump-python-package.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Set up Python ${{ inputs.python-version }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Install uv
         run: pip install uv

.github/workflows/docker.yml

@@ -47,7 +47,7 @@ jobs:
     steps:
       - id: set_matrix
         run: |
-          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]'; fi)
+          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "websocket", "dockerize", "py311", "py312"]'; fi)
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
@@ -123,13 +123,20 @@ jobs:
           # pull timeouts, 504/401 on push, ECONNRESET) that otherwise fail
           # the whole job. buildx reuses the buildkit layer cache from the
           # failed attempt, so a retry mostly re-does just the failed push.
+          #
+          # supersetbot's "dev"/"lean" presets pin their own --build-arg
+          # PY_VER, which lands ahead of --extra-flags on the assembled
+          # buildx command line; docker/buildx keeps the last value for a
+          # repeated --build-arg key, so appending PY_VER here overrides
+          # supersetbot's pin and keeps the build on the Dockerfile's own
+          # supported Python version.
           for attempt in 1 2 3; do
             if supersetbot docker \
               $PUSH_OR_LOAD \
               --preset "$BUILD_PRESET" \
               --context "$EVENT" \
               --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
+              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
               $PLATFORM_ARG; then
               break
             fi

.github/workflows/pre-commit.yml

@@ -25,7 +25,7 @@ jobs:
         # Run the full version spread on push (master/release) and nightly,
         # but only the current version on PRs — lint/format/type results
         # rarely differ across patch versions, so 3x per PR is wasteful.
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "previous", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/scheduled-docker-image-refresh.yml

@@ -98,7 +98,7 @@ jobs:
       # Mirror the same matrix the release publisher uses so every variant
       # operators consume from Docker Hub gets the refreshed base.
       matrix:
-        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
+        build_preset: ["dev", "lean", "websocket", "dockerize", "py311", "py312"]
       fail-fast: false
     steps:
       - name: "Checkout release tag: ${{ needs.config.outputs.latest-release }}"

.github/workflows/superset-extensions-cli.yml

@@ -25,7 +25,7 @@ jobs:
       matrix:
         # Full version spread on push (master/release) + nightly; current only
         # on PRs to cut runner cost (cross-version breaks are caught at merge).
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["previous", "current", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     defaults:
       run:
         working-directory: superset-extensions-cli

.github/workflows/superset-frontend.yml

@@ -51,7 +51,7 @@ jobs:
           git show -s --format=raw HEAD
           docker buildx build \
             -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.10-slim-trixie \
+            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
             --target superset-node-ci \
             .
 

.github/workflows/superset-python-integrationtest.yml

@@ -135,7 +135,7 @@ jobs:
       matrix:
         # Full version spread on push (master/release) + nightly; current only
         # on PRs to cut runner cost (cross-version breaks are caught at merge).
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "previous", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config

.github/workflows/superset-python-unittest.yml

@@ -50,7 +50,7 @@ jobs:
       matrix:
         # Full version spread on push (master/release) + nightly; current only
         # on PRs to cut runner cost (cross-version breaks are caught at merge).
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["previous", "current", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     env:
       PYTHONPATH: ${{ github.workspace }}
       # Promotes the SQLAlchemy 2.0 deprecation warnings already locked in as

.github/workflows/tag-release.yml

@@ -56,7 +56,7 @@ jobs:
     strategy:
       matrix:
         build_preset:
-          ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
+          ["dev", "lean", "websocket", "dockerize", "py311", "py312"]
       fail-fast: false
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"

RELEASING/Dockerfile.from_local_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 
 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset
 

RELEASING/Dockerfile.from_svn_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 
 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset
 

RELEASING/Dockerfile.make_docs

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 ARG VERSION
 
 RUN git clone --depth 1 --branch ${VERSION} https://github.com/apache/superset.git /superset

RELEASING/Dockerfile.make_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 
 RUN apt-get update -y
 RUN apt-get install -y \

UPDATING.md

@@ -24,6 +24,13 @@ assists people when migrating to a new version.
 
 ## Next
 
+### Python 3.10 support removed
+
+Python 3.10 is no longer supported. Superset now requires **Python 3.11 or higher**.
+Update your environment (virtualenv, Docker base image, CI configuration, etc.) to
+Python 3.11+ before upgrading. The `apache/superset-cache:3.10-slim-trixie` and
+`py310` Docker image variants are no longer published.
+
 ### Owners, dashboard roles, and RLS roles replaced by Subjects
 
 Superset now uses subject-based access assignments for dashboards, charts, datasets,

docker-compose-light.yml

@@ -71,7 +71,7 @@ x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
   cache_from:
-    - apache/superset-cache:3.10-slim-trixie
+    - apache/superset-cache:3.11-slim-trixie
   args:
     DEV_MODE: "true"
     INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}

docker-compose-non-dev.yml

@@ -33,7 +33,7 @@ x-common-build: &common-build
   context: .
   target: dev
   cache_from:
-    - apache/superset-cache:3.10-slim-trixie
+    - apache/superset-cache:3.11-slim-trixie
 
 services:
   redis:

docker-compose.yml

@@ -38,7 +38,7 @@ x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
   cache_from:
-    - apache/superset-cache:3.10-slim-trixie
+    - apache/superset-cache:3.11-slim-trixie
   args:
     DEV_MODE: "true"
     INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}

docs/admin_docs/configuration/mcp-server.mdx

@@ -99,7 +99,7 @@ See [Connecting AI Clients](#connecting-ai-clients) for Claude Code, Claude Web,
 ## Prerequisites
 
 - Apache Superset 5.0+ running and accessible
-- Python 3.10+
+- Python 3.11+
 - The `fastmcp` package (`pip install fastmcp`)
 
 ---

docs/developer_docs/contributing/development-setup.md

@@ -379,7 +379,7 @@ functioning across environments.
 Make sure your machine meets the [OS dependencies](https://superset.apache.org/docs/installation/pypi#os-dependencies) before following these steps.
 You also need to install MySQL.
 
-Ensure that you are using Python version 3.9, 3.10 or 3.11, then proceed with:
+Ensure that you are using Python version 3.11 or 3.12, then proceed with:
 
 ```bash
 # Create a virtual environment and activate it (recommended)

docs/developer_docs/contributing/issue-reporting.md

@@ -82,7 +82,7 @@ If applicable, add screenshots or recordings.
 
 ### Environment
 - Superset version: [e.g., 3.0.0]
-- Python version: [e.g., 3.9.7]
+- Python version: [e.g., 3.11.7]
 - Node version: [e.g., 18.17.0]
 - Database: [e.g., PostgreSQL 14]
 - Browser: [e.g., Chrome 120]
@@ -125,7 +125,7 @@ No error messages in browser console or server logs.
 
 ### Environment
 - Superset version: 3.0.0
-- Python version: 3.9.16
+- Python version: 3.11.16
 - Database: PostgreSQL 14.9
 - Browser: Chrome 120.0.6099.71
 - OS: macOS 14.2

docs/developer_docs/index.md

@@ -52,7 +52,7 @@ Everything you need to contribute to the Apache Superset project. This section i
 ## Development Resources
 
 ### Prerequisites
-- **Python**: 3.9, 3.10, or 3.11
+- **Python**: 3.11 or 3.12
 - **Node.js**: 18.x or 20.x
 - **npm**: 9.x or 10.x
 - **Git**: Basic understanding

pyproject.toml

@@ -24,13 +24,12 @@ name = "apache_superset"
 description = "A modern, enterprise-ready business intelligence web application"
 readme = "README.md"
 dynamic = ["version", "scripts", "entry-points"]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 license = { file="LICENSE.txt" }
 authors = [
     { name = "Apache Software Foundation", email = "dev@superset.apache.org" },
 ]
 classifiers = [
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
 ]
@@ -167,7 +166,6 @@ gevent = ["gevent>=26.4.0"]
 gsheets = ["shillelagh[gsheetsapi]>=1.4.4, <2"]
 hana = ["hdbcli==2.28.21", "sqlalchemy_hana==3.0.3"]
 hive = [
-    "pyhive[hive]>=0.6.5;python_version<'3.11'",
     "pyhive[hive_pure_sasl]>=0.7.0",
     "tableschema",
     "thrift>=0.23.0, <1.0.0",
@@ -201,7 +199,6 @@ singlestore = ["sqlalchemy-singlestoredb>=1.2.1, <2"]
 snowflake = ["snowflake-sqlalchemy>=1.10.2, <2"]
 sqlite = ["syntaqlite>=0.6.0,<0.7.0"]
 spark = [
-    "pyhive[hive]>=0.6.5;python_version<'3.11'",
     "pyhive[hive_pure_sasl]>=0.7",
     "tableschema",
     "thrift>=0.23.0, <1",
@@ -344,8 +341,8 @@ exclude = [
 line-length = 88
 indent-width = 4
 
-# Assume Python 3.10
-target-version = "py310"
+# Assume Python 3.11
+target-version = "py311"
 
 [tool.ruff.lint]
 # Enable Pyflakes (`F`) and a subset of the pycodestyle (`E`)  codes by default.

scripts/check-env.py

@@ -133,8 +133,8 @@ def main(docker: bool, frontend: bool, backend: bool) -> None:  # noqa: C901
     requirements = [
         Requirement(
             "python",
-            (Version("3.10.0"), Version("3.10.999")),
-            (Version("3.9.0"), Version("3.11.999")),
+            (Version("3.11.0"), Version("3.11.999")),
+            (Version("3.11.0"), Version("3.12.999")),
             "backend",
             "python --version",
         ),

superset-core/README.md

@@ -21,7 +21,7 @@ under the License.
 
 [![PyPI version](https://badge.fury.io/py/apache-superset-core.svg)](https://badge.fury.io/py/apache-superset-core)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 
 The official core package for building Apache Superset backend extensions and integrations. This package provides essential building blocks including base classes, API utilities, type definitions, and decorators for both the host application and extensions.
 

superset-core/pyproject.toml

@@ -26,7 +26,7 @@ authors = [
 ]
 license = "Apache-2.0"
 license-files = ["LICENSE.txt"]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 keywords = ["superset", "apache", "analytics", "business-intelligence", "extensions", "visualization"]
 classifiers = [
     "Development Status :: 3 - Alpha",
@@ -34,7 +34,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Topic :: Database",

superset-extensions-cli/README.md

@@ -21,7 +21,7 @@ under the License.
 
 [![PyPI version](https://badge.fury.io/py/apache-superset-extensions-cli.svg)](https://badge.fury.io/py/apache-superset-extensions-cli)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 
 Official command-line interface for building, bundling, and managing Apache Superset extensions. This CLI tool provides developers with everything needed to create, develop, and package extensions for the Superset ecosystem.
 

superset-extensions-cli/pyproject.toml

@@ -25,7 +25,7 @@ authors = [
 ]
 license = "Apache-2.0"
 license-files = ["LICENSE.txt"]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 keywords = ["superset", "apache", "cli", "extensions", "analytics", "business-intelligence", "development-tools"]
 classifiers = [
     "Development Status :: 3 - Alpha",
@@ -33,7 +33,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Topic :: Database",

superset/app.py

@@ -18,21 +18,12 @@ from __future__ import annotations
 
 import logging
 import os
-import sys
 from typing import cast, Iterable, Optional
+from wsgiref.types import StartResponse, WSGIApplication, WSGIEnvironment
 
 from alembic.config import Config
 from alembic.runtime.migration import MigrationContext
 from alembic.script import ScriptDirectory
-
-if sys.version_info >= (3, 11):
-    from wsgiref.types import StartResponse, WSGIApplication, WSGIEnvironment
-else:
-    from typing import TYPE_CHECKING
-
-    if TYPE_CHECKING:
-        from _typeshed.wsgi import StartResponse, WSGIApplication, WSGIEnvironment
-
 from flask import Flask, Response
 from werkzeug.exceptions import NotFound
 

superset/mcp_service/README.md

@@ -84,7 +84,7 @@ If Docker is not available, you can set up manually:
 git clone https://github.com/apache/superset.git
 cd superset
 
-# 2. Set up Python environment (Python 3.10 or 3.11 required)
+# 2. Set up Python environment (Python 3.11 or 3.12 required)
 python3 -m venv venv
 source venv/bin/activate
 

superset/middleware/legacy_prefix_redirect.py

@@ -58,20 +58,12 @@ closed-set discipline.
 from __future__ import annotations
 
 import re
-import sys
 from typing import Iterable, Optional
 from urllib.parse import quote
+from wsgiref.types import StartResponse, WSGIApplication, WSGIEnvironment
 
 from werkzeug.wrappers import Response
 
-if sys.version_info >= (3, 11):
-    from wsgiref.types import StartResponse, WSGIApplication, WSGIEnvironment
-else:
-    from typing import TYPE_CHECKING
-
-    if TYPE_CHECKING:
-        from _typeshed.wsgi import StartResponse, WSGIApplication, WSGIEnvironment
-
 #: The legacy URL token the shim recognises. Hard-coded — not configurable.
 _LEGACY_PREFIX: str = "/superset"
 

superset/utils/backports.py

@@ -14,13 +14,4 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-import sys
-from enum import Enum
-
-if sys.version_info >= (3, 11):
-    # pylint: disable=unused-import
-    from enum import StrEnum  # nopycln: import
-else:
-
-    class StrEnum(str, Enum):
-        pass
+from enum import StrEnum  # noqa: F401