Add Python 3.9 upper caps for 3.9-dropping deps and fix pip-compile hooks

.pre-commit-config.yaml

@@ -747,9 +747,10 @@ repos:
           - -c=requirements/static/pkg/py3.14/linux.lock
           - -o=requirements/static/ci/py3.14/linux.lock
 
+      - id: pip-compile
         alias: compile-ci-linux-3.13-zmq-requirements
         name: Linux CI Py3.13 ZeroMQ Requirements
-        files: ^requirements/(constraints\.txt|(base|zeromq|pytest)\.txt|static/((ci|pkg)/(linux\.txt|common\.txt)|py3\.14/linux\.txt))$
+        files: ^requirements/(constraints\.txt|(base|zeromq|pytest)\.txt|static/((ci|pkg)/(linux\.txt|common\.txt)|py3\.13/linux\.txt))$
         pass_filenames: false
         additional_dependencies: ["pip<26.0"]
         args:
@@ -970,9 +971,10 @@ repos:
           - -c=requirements/static/pkg/py3.14/freebsd.lock
           - -o=requirements/static/ci/py3.14/freebsd.lock
 
+      - id: pip-compile
         alias: compile-ci-freebsd-3.13-zmq-requirements
         name: FreeBSD CI Py3.13 ZeroMQ Requirements
-        files: ^requirements/(constraints\.txt|(base|zeromq|pytest)\.txt|static/((ci|pkg)/(freebsd|common)\.txt|py3\.14/freebsd\.txt))$
+        files: ^requirements/(constraints\.txt|(base|zeromq|pytest)\.txt|static/((ci|pkg)/(freebsd|common)\.txt|py3\.13/freebsd\.txt))$
         pass_filenames: false
         additional_dependencies: ["pip<26.0"]
         args:
@@ -1195,9 +1197,10 @@ repos:
           - -c=requirements/static/pkg/py3.14/darwin.lock
           - -o=requirements/static/ci/py3.14/darwin.lock
 
+      - id: pip-compile
         alias: compile-ci-darwin-3.13-zmq-requirements
         name: Darwin CI Py3.13 ZeroMQ Requirements
-        files: ^(requirements/(constraints\.txt|(base|zeromq|pytest)\.txt|static/((ci|pkg)/(darwin|common)\.txt|py3\.14/darwin\.txt)))$
+        files: ^(requirements/(constraints\.txt|(base|zeromq|pytest)\.txt|static/((ci|pkg)/(darwin|common)\.txt|py3\.13/darwin\.txt)))$
         pass_filenames: false
         additional_dependencies: ["pip<26.0"]
         args:
@@ -1418,9 +1421,10 @@ repos:
           - -c=requirements/static/pkg/py3.14/windows.lock
           - -o=requirements/static/ci/py3.14/windows.lock
 
+      - id: pip-compile
         alias: compile-ci-windows-3.13-zmq-requirements
         name: Windows CI Py3.13 ZeroMQ Requirements
-        files: requirements/((base|zeromq|pytest)\.txt|static/((ci|pkg)/(windows|common)\.txt|py3\.14/windows\.txt))$
+        files: requirements/((base|zeromq|pytest)\.txt|static/((ci|pkg)/(windows|common)\.txt|py3\.13/windows\.txt))$
         pass_filenames: false
         additional_dependencies: ["pip<26.0"]
         args:
@@ -1777,6 +1781,7 @@ repos:
           - -c=requirements/static/ci/py3.14/linux.lock
           - -o=requirements/static/ci/py3.14/docs.lock
 
+      - id: pip-compile
         alias: compile-doc-requirements
         name: Docs CI Py3.13 Requirements
         files: ^requirements/(constraints\.txt|(base|zeromq|pytest|crypto)\.txt|static/ci/(docs|common|linux)\.txt|static/pkg/linux\.txt|static/pkg/.*/linux\.txt)$

requirements/base.txt

@@ -24,8 +24,12 @@ frozenlist>=1.5.0; python_version >= '3.11'
 gitpython>=3.1.50
 immutables>=0.21
 importlib-metadata>=8.7.0
-jaraco.functools>=4.4.0
-jaraco.context>=6.1.1
+# jaraco.functools 4.5.0 and jaraco.context 6.1.2 drop Python 3.9; keep the
+# last 3.9-compatible releases there and let py>=3.10 float forward.
+jaraco.functools>=4.4.0,<4.5.0; python_version < '3.10'
+jaraco.functools>=4.4.0; python_version >= '3.10'
+jaraco.context>=6.1.1,<6.1.2; python_version < '3.10'
+jaraco.context>=6.1.1; python_version >= '3.10'
 jaraco.text>=4.2.0
 Jinja2>=3.1.6
 jmespath>=1.1.0
@@ -36,7 +40,9 @@ MarkupSafe<4.0.0
 # conversion checks (macOS 15 onedir builds compile from sdist via
 # --no-binary=:all:). 6.6+ fixed the C source compatibility.
 multidict>=6.6.0
-msgpack>=1.1.2
+# msgpack 1.2.1 drops Python 3.9; keep the last 3.9-compatible release there.
+msgpack>=1.1.2,<1.2.1; python_version < '3.10'
+msgpack>=1.1.2; python_version >= '3.10'
 # Packaging 24.1+ imports annotations from __future__ which breaks
 # salt-ssh on target hosts with older Python versions (Amazon Linux 2
 # still ships Python 3.7). 26.x additionally uses positional-only
@@ -54,7 +60,9 @@ pymysql>=1.2.0; sys_platform == 'win32'
 pyopenssl>=26.0.0,<26.2.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
-pythonnet>=3.0.5; sys_platform == 'win32'
+# pythonnet 3.1.0 drops Python 3.9; keep the last 3.9-compatible release there.
+pythonnet>=3.0.5,<3.1.0; sys_platform == 'win32' and python_version < '3.10'
+pythonnet>=3.0.5; sys_platform == 'win32' and python_version >= '3.10'
 tzdata; sys_platform == 'win32'
 pywin32>=312; sys_platform == 'win32'
 pycryptodomex>=3.23.0
@@ -73,18 +81,26 @@ tornado>=6.5.5
 # (CVE-2025-66418, CVE-2026-21441).
 urllib3>=1.26.20,<2.0.0; python_version < '3.10'
 urllib3>=2.7.0; python_version >= '3.10'
-virtualenv>=21.4.2
+# virtualenv 21.5.1 drops Python 3.9; keep the last 3.9-compatible release there.
+virtualenv>=21.4.2,<21.5.1; python_version < '3.10'
+virtualenv>=21.4.2; python_version >= '3.10'
 # Transitive of virtualenv; some uv resolver caches pin a stale 3.25
 # version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
 filelock>=3.29.1; python_version >= '3.10'
 filelock>=3.19.1,<3.29.0; python_version < '3.10'
 wmi>=1.5.1; sys_platform == 'win32'
 xmltodict>=1.0.4; sys_platform == 'win32'
-zipp>=3.23.1
+# zipp 4.1.0 drops Python 3.9; keep the last 3.9-compatible release there.
+zipp>=3.23.1,<4.1.0; python_version < '3.10'
+zipp>=3.23.1; python_version >= '3.10'
 apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
 apache-libcloud>=3.9.1; python_version >= '3.10'
 idna>=3.18
-more-itertools>=10.8.0
+# more-itertools 11.0.0 drops Python 3.9; keep the last 3.9-compatible release there.
+more-itertools>=10.8.0,<11.0.0; python_version < '3.10'
+more-itertools>=10.8.0; python_version >= '3.10'
 pyasn1>=0.6.3
-pycparser>=2.23
+# pycparser 3.0 drops Python 3.9; keep the last 3.9-compatible release there.
+pycparser>=2.23,<3.0; python_version < '3.10'
+pycparser>=2.23; python_version >= '3.10'
 vultr>=1.0.1

requirements/static/ci/common.txt

@@ -59,12 +59,14 @@ toml
 # vcert 0.18.x adds hard pins on cryptography, pynacl, and six that
 # conflict with every other CI requirement; stay on 0.9.x.
 vcert~=0.9.0; sys_platform != 'win32'
-virtualenv>=21.4.2
+virtualenv>=21.4.2,<21.5.1; python_version < '3.10'
+virtualenv>=21.4.2; python_version >= '3.10'
 watchdog>=6.0.0
 websocket-client>=1.9.0
 # werkzeug is a dependency of moto
 werkzeug>=3.1.8
-xmldiff>=2.7.0
+xmldiff>=2.7.0,<3.0; python_version < '3.10'
+xmldiff>=2.7.0; python_version >= '3.10'
 # Available template libraries that can be used
 genshi>=0.7.11
 cheetah3>=3.2.6.post1

requirements/static/ci/py3.14/cloud.lock

@@ -734,6 +734,7 @@ toml==0.10.2
     #   -r requirements/static/ci/common.txt
 tornado==6.5.7
     # via
+    #   -c requirements/static/ci/py3.14/linux.lock
     #   -c requirements/static/pkg/py3.14/linux.lock
     #   -r requirements/base.txt
 transitions==0.9.3