Python 3.9 End of Life October 2025 — Upgrade Target Selection — when and how should I migrate?
Python 3.9 reached end-of-life on October 31, 2025 and as of 2026-03-18 receives no security patches — not even for critical CVEs. NumPy 2.1+ requires Python 3.10+, pandas 3.0+ requires Python 3.11+. Teams must select a supported upgrade target and update CI matrices and Docker base images accordingly.
Blockers
- requires_version: package/numpy-2-1-plus → runtime/python-3-10
- requires_version: package/pandas-3-0-plus → runtime/python-3-11
- removed
- removed
- removed
- removed via PEP 594
- removed via PEP 594
Who this is for
- enterprise
- compliance
- low-ops
- small-team
Candidates
Python 3.12
Python 3.12 entered security-only mode in October 2025 with patches guaranteed until October 2028, giving approximately 2.5 years of coverage from 2026-03-18. It is the most widely adopted current-generation release with broad support across cloud runtimes, CI templates, and Docker official images. Key removals versus Python 3.9 are distutils (migrate to setuptools), asynchat, asyncore, and imp. The pyupgrade tool with --py312-plus automates safe syntax modernisation.
When to choose
Best for enterprise + compliance environments where broad ecosystem maturity and stable toolchain support outweigh having the longest EOL runway. Choose 3.12 when your dependency tree — including NumPy 2.x and pandas 3.x — is already compatible and you want the lowest-risk, most widely documented migration path from 3.9.
Tradeoffs
Pros: Broadest Docker and cloud PaaS runtime support; comprehension inlining gives up to 2x speedup on tight loops; ~2.5 years security support remaining; pyupgrade --py312-plus automates syntax migration. Cons: Security-only since October 2025 — no new binary releases or bug fixes; distutils removal breaks any package that imports it directly; shorter support runway than Python 3.13.
Cautions
setuptools is no longer pre-installed in virtual environments as of Python 3.12, so Docker images that run pip install without first installing setuptools will fail on packages that require it. Audit your full dependency tree for direct distutils imports before upgrading — they raise ModuleNotFoundError at runtime, not at install time.
Python 3.13
Python 3.13 is the current active bugfix release with binary patches through late 2026, then security-only until October 2029 — the longest EOL runway of any stable Python version as of 2026-03-18. It introduces optional free-threaded CPython (PEP 703, disables the GIL) and an experimental JIT compiler. Going from 3.9 to 3.13 carries the largest stdlib removal surface: 19 dead-battery modules removed per PEP 594 (cgi, aifc, telnetlib, nntplib, and 15 others), plus distutils, asynchat, and asyncore removed in 3.12.
When to choose
Best for greenfield services or teams that can invest in a full migration audit and want to avoid another forced upgrade for 3+ years. Choose 3.13 when targeting pandas 3.0+ and NumPy 2.1+ — both fully support 3.13 — and when you want the option to evaluate free-threaded parallelism for CPU-bound workloads.
Tradeoffs
Pros: Longest security runway (EOL October 2029, ~3.5 years from 2026-03-18); active binary bugfixes through late 2026; optional GIL-free build for true multi-core parallelism; experimental JIT compiler; improved REPL and colour tracebacks. Cons: Largest migration delta from 3.9 — any import of a PEP 594 module raises ModuleNotFoundError immediately; free-threaded mode is experimental and most C-extension libraries have not yet verified thread-safety.
Cautions
The free-threaded build is a separate binary (python3.13t) and is not the default CPython — most C-extension packages have not yet been audited for thread safety and may produce race conditions or crashes. All 19 removed PEP 594 modules fail at import time with no graceful fallback, so scan the full transitive dependency tree, not just first-party code, before deploying.
Python 3.11
Python 3.11 is in security-only mode with patches until October 2027, leaving approximately 18 months of coverage from 2026-03-18. It is the minimum version required by pandas 3.0+ (which dropped Python 3.9 and 3.10) and delivers a 10–60% performance improvement over Python 3.9 via the adaptive specialising interpreter. No stdlib modules are removed versus Python 3.9, making it the zero-import-breakage upgrade path.
When to choose
Best for small-team or low-ops projects where eliminating import-level breakage risk takes priority over long support longevity. Choose 3.11 as a stepping-stone when your codebase uses modules removed in 3.12 or 3.13 — such as distutils, cgi, or telnetlib — that cannot be immediately replaced, but you need to unblock pandas 3.0+ compatibility now.
Tradeoffs
Pros: Zero import-level breakage versus Python 3.9 — all stdlib modules present; satisfies pandas 3.0 minimum requirement; 10–60% performance gain; lowest migration effort. Cons: Security-only since October 2023 with only ~18 months of patches remaining; requires a follow-up upgrade to 3.12+ before October 2027; misses 3.12 comprehension optimisations and 3.13 free-threaded mode.
Cautions
Python 3.11 silently introduced an integer-string conversion length cap (4300 digits by default) as a CVE-2020-10735 mitigation — code calling int() on large untrusted strings raises ValueError at runtime and pyupgrade will not flag it. With only ~18 months of security support remaining as of 2026-03-18, plan the follow-up 3.12 upgrade now to avoid a second EOL crisis.
Try with your AI agent
$ npm install -g pocketlantern $ pocketlantern init # Restart Claude Code, Cursor, or your MCP client, then ask: # "Python 3.9 End of Life October 2025 — Upgrade Target Selection — when and how should I migrate?"