Drop Python 2 and 3.6 support

[jiasli]

Describe the bug

Python 2 has been deprecated long time ago: https://www.python.org/doc/sunset-python-2/

We have decided that January 1, 2020, was the day that we sunset Python 2.

Customers asked Azure CLI to drop Python 2 since 2019-11-23 in Azure/azure-cli#11362 and Azure CLI finally dropped Python 2 in Azure/azure-cli#11363.

As there is no security maintenance for Python 2 anymore. Running MSAL on Python imposes security risks: https://www.activestate.com/products/python/python-2-end-of-life-security-updates/

[rayluo]

We will label this issue as "Internal" (rather than an "Enhancement"), because the only difference of MSAL dropping Python 2 is we the MSAL maintainers can use Python 3 in our code base. Our customers would not feel any difference.

By the way, dropping Python 2 is technically a removal of a behavior, so it would only happen with a major version bump. Libraries will announce the end of support in a stable release with a changelog entry like "this is the last version to support 2.7". The next stable release will require Python 3.7+. Bugfixes and new features will assume 3.7.

Also, core libraries like identity will move more slowly because they should be the last to drop 2.7 support. Same applies to MSAL.

[lmazuel]

Ray Luo (@rayluo) if that helps, SDK world dropped Python 2 on Jan 1st 2022:
Azure/azure-sdk-for-python#20691

[jiasli]

I saw MSAL's CI still has tests for Python 2.7, 3.5 and 3.6:

Azure CLI (Azure/azure-cli#19858) and Azure Python SDK (https://github.com/Azure/azure-sdk-for-python/issues?q=is%3Aissue+is%3Aopen+drop+3.6) have now dropped Python 3.6.

Python 3.6 is out of security fixes since December 2021, meaning it’s not recommended to run Python code 3.6 anymore for customers. MSAL on Python 3.6 is potentially insecure as well.

[yrro]

FYI, RHEL 8 comes with Python 3.6, which will be maintained until May 2029.

[rayluo]

FYI, RHEL 8 comes with Python 3.6, which will be maintained until May 2029.

Thanks for the information. That same link indicates that RHEL even supports Python 2.7 until June 2024.

Regardless, most of the libraries in the ecosystem would probably, if they haven't already, drop old Python support in their release X.Y, long before those dates above. I guess someone in RHEL will then somehow pin their environment dependency as library Foo X.Y-1.

[rayluo]

Python 2 and Python 3.6 support was dropped since MSAL Python 1.28.