Should PyShp drop support for Python 2, and Pythons earlier than 3.8?

[JamesParrott]

Following issue #276, PyShp users and contributors, please let us know below how dropping support for older Pythons would impact you, especially if there would be negative impacts.

Note, there is no proposal to yank PyShp versions that support older Pythons. So this will not break anything that installs PyShp from PyPi using the pip for that version of Python. This would effectively be a feature freeze, not a mandatory upgrade for users. Unsupported does not imply unavailable.

Pros:

• Best practise for security. These Python versions are (or for 3.8 will soon be) no longer supported by the PSF. PyShp does process raw binary files, that could be maliciously constructed to contain anything.
• Not a breaking change. Version pinning is not even required from users, if PyShp is installed with a dropped Python's pip.
• Encourage more contributors, ensuring PyShp thrives as a healthy open source project, for the next 10 years. New contributors may prefer to write Python code using more recent, modern features, e.g. f-strings.
• Eliminates a whole class of possible future bugs, and reduces the attack surface, improving security.
• Facilitates a general tidy up of the code base, increasing readability.
• Allows static type hints to be added.
• Manage user expectations. I.e. in future, we contributors -may- still choose to fix Python 2 bugs. However, we contributors should not be expected to fix Python 2 bugs. The advice will be to upgrade Python and PyShp versions.
• Reduces technical debt (allows deletion of the code that only runs in Python 2).

Cons:

• It ain't broke, so don't fix it.
• PyShp is one of the only libraries available that supports users running older Pythons - it's a USP!
• Creates work.
• Few users process arbitrary shapefiles from the wild. If they are running PyShp and Python 2 on their web server, they probably have much more important things they should worry about.

Proposed roadmap:

0. Announce proposal. Gather feedback. Participate in this very discussion.
1. October 2024, after Python 3.8 EOL. Release PyShp 2.4 with notice (deprecation warning if possible) that the upcoming 3.x releases will drop support for Python 2 and any Python below 3.8 (and changes for devs, e.g. Code formatter).
2. On the main branch, remove support for pythons 2, 3.5, 3.6, 3.7 and 3.8.
3. Release Pyshp 3.0 (support for Pythons >= 3.9 only).
4. Allow X months for user feedback.
5. Release 2.5, advertising PyShp 3, and announcing end of support for PyShp 2
6. 2025-10 drop support for python 3.9
7. 2026-10 drop support for python 3.10
8. Thereafter, follow https://devguide.python.org/versions/

[JamesParrott]

I've reached out to all the other contributors, but couldn't otherwise contact you guys: @lgolston @lemonez @bva-bme @eumiro @midichef

[JamesParrott]

Also: @cwalv @atlefren

[sebastic]

The proposed changes don't affect the Debian package.

[schwehr]

My main take is that dropping support for older versions reduces the maintenance burden for the main branch, which anyone needing support for older versions can do that in a branch.

Also, the addition of type annotations will make the library easier to use for many and possible catch some bugs in the process.

[mwtoews]

Generally, I don't think users of older/unsupported Python versions should expect maintenance from most packages. Previously published versions of packages are always available, so nothing is being taken away.