[services, hailtop] shift supported python versions from 3.10-13 to 3.12-14 (#15603)

## Change Description

Updates the default python version to 3.12 and shifts the list of
supported versions to 3.12, 3.13, 3.14 to realign with the numpy's
supported versions.

Update: 3.11 will NOT continue to be supported. EMR has been shown to
work ok with 3.12 and numpy support has already expired on 3.11.

## Security Assessment

Delete all except the correct answer:
- This change potentially impacts the Hail Batch instance as deployed by
Broad Institute in GCP

### Impact Rating

- This change has a low security impact

### Impact Description

Python version updates in services and client libraries.

### Appsec Review

- [x] Required: The impact has been assessed and approved by appsec

Author: cjllanwarne

.github/workflows/pip-npm-bump.yml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.12'
 
       - uses: actions/setup-node@v4
         with:

.github/workflows/static-and-unit-tests.yml

@@ -22,7 +22,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 
@@ -48,7 +48,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 
@@ -79,7 +79,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 
@@ -111,7 +111,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
 
       - name: Install pyyaml
         run: pip install pyyaml
@@ -138,7 +138,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 
@@ -186,7 +186,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 
@@ -231,7 +231,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 
@@ -299,7 +299,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
           cache: pip
           cache-dependency-path: '**/pinned-requirements.txt'
 

.github/workflows/validate-build-yaml.yml

@@ -19,7 +19,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.12'
 
       - name: Install PyYAML
         run: pip install pyyaml

Makefile

@@ -131,7 +131,6 @@ update-gateways-envoy:
 generate-pip-lockfiles:
 	./generate-pip-lockfile.sh hail/python/hailtop
 	./generate-pip-lockfile.sh hail/python
-	uv pip compile --python-version 3.10 --python-platform linux --upgrade hail/python/requirements.txt --output-file=hail/python/pinned-requirements-py310.txt
 	./generate-pip-lockfile.sh hail/python/dev
 	./generate-pip-lockfile.sh gear
 	./generate-pip-lockfile.sh web_common

auth/auth/driver/__main__.py

@@ -8,5 +8,6 @@
 
 from .driver import async_main
 
-loop = asyncio.get_event_loop()
+loop = asyncio.new_event_loop()
+asyncio.set_event_loop(loop)
 loop.run_until_complete(async_main())

batch/batch/driver/main.py

@@ -2163,6 +2163,8 @@ def log(self, request, response, time):
 
 
 async def on_startup(app):
+    asyncio.get_running_loop().add_signal_handler(signal.SIGUSR1, dump_all_stacktraces)
+
     exit_stack = AsyncExitStack()
     app['exit_stack'] = exit_stack
 
@@ -2264,8 +2266,6 @@ def run():
     app.on_startup.append(on_startup)
     app.on_cleanup.append(on_cleanup)
 
-    asyncio.get_event_loop().add_signal_handler(signal.SIGUSR1, dump_all_stacktraces)
-
     web.run_app(
         deploy_config.prefix_application(app, 'batch-driver', client_max_size=HTTP_CLIENT_MAX_SIZE),
         host='0.0.0.0',

batch/batch/front_end/front_end.py

@@ -3782,6 +3782,8 @@ class AppKeys(CommonAiohttpAppKeys):
 
 
 async def on_startup(app):
+    asyncio.get_running_loop().add_signal_handler(signal.SIGUSR1, dump_all_stacktraces)
+
     exit_stack = AsyncExitStack()
     app['exit_stack'] = exit_stack
 
@@ -3894,8 +3896,6 @@ def run():
     app.on_startup.append(on_startup)
     app.on_cleanup.append(on_cleanup)
 
-    asyncio.get_event_loop().add_signal_handler(signal.SIGUSR1, dump_all_stacktraces)
-
     web.run_app(
         deploy_config.prefix_application(app, 'batch', client_max_size=HTTP_CLIENT_MAX_SIZE),
         host='0.0.0.0',

batch/batch/worker/worker.py

@@ -3598,7 +3598,7 @@ async def async_main():
             cleanup.push_async_callback(worker.shutdown)
             await worker.run()
     finally:
-        asyncio.get_event_loop().set_debug(True)
+        asyncio.get_running_loop().set_debug(True)
         other_tasks = [t for t in asyncio.all_tasks() if t != asyncio.current_task()]
         if other_tasks:
             log.warning('Tasks immediately after docker close')
@@ -3610,7 +3610,8 @@ async def async_main():
                 t.cancel()
 
 
-loop = asyncio.get_event_loop()
+loop = asyncio.new_event_loop()
+asyncio.set_event_loop(loop)
 loop.add_signal_handler(signal.SIGUSR1, dump_all_stacktraces)
 loop.run_until_complete(async_main())
 log.info('closing loop')

batch/pinned-requirements.txt

@@ -79,7 +79,7 @@ def _copyfail2_command(variant: str) -> str:
 def test_no_af_alg_socket(client: BatchClient):
     """CVE-2026-31431: AF_ALG socket creation must be blocked on worker nodes."""
     b = create_batch(client)
-    j = b.create_job('python:3.11-slim', ['/bin/sh', '-c', _AF_ALG_CHECK])
+    j = b.create_job('python:3.12-slim', ['/bin/sh', '-c', _AF_ALG_CHECK])
     b.submit()
     status = j.wait()
     assert status['state'] == 'Success', str((status, b.debug_info()))