chore: use and expect python39 (#3908)

dev/INSTALL

@@ -28,7 +28,7 @@ General Instructions for Deployment of a New Release
 
  4. Setup a new virtual environment and install requirements::
 
-      python3.6 -mvenv env
+      python3.9 -mvenv env
       source env/bin/activate
       pip install --upgrade setuptools
       pip install -r requirements.txt

dev/tests/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.6-bullseye
+FROM python:3.9-bullseye
 LABEL maintainer="IETF Tools Team <tools-discuss@ietf.org>"
 
 ENV DEBIAN_FRONTEND=noninteractive

docker-compose.yml

@@ -9,7 +9,7 @@ services:
                 # Update 'VARIANT' to pick a version of Python: 3, 3.10, 3.9, 3.8, 3.7, 3.6
                 # Append -bullseye or -buster to pin to an OS version.
                 # Use -bullseye variants on local arm64/Apple Silicon.
-                VARIANT: 3.6-bullseye
+                VARIANT: 3.9-bullseye
                 NODE_VERSION: '16'
                 
         init: true

requirements.txt

@@ -4,15 +4,15 @@ setuptools>=51.1.0    # Require this first, to prevent later errors
 argon2-cffi>=21.3.0    # For the Argon2 password hasher option
 beautifulsoup4>=4.11.1    # Only used in tests
 bibtexparser>=0.6.2,<1.0    # Only used in tests. Version 1.0 doesn't work under python 2.7.  1.0.1 doesn't recognize month names or abbreviations.
-bleach>=4.1.0
+bleach>=5.0.0
 coverage>=4.5.4,<5.0    # Coverage 5.x moves from a json database to SQLite.  Moving to 5.x will require substantial rewrites in ietf.utils.test_runner and ietf.release.views
 decorator>=5.1.1
 defusedxml>=0.7.1    # for TastyPie when using xml; not a declared dependency
 Django>=2.2.28,<3.0
 django-analytical>=3.1.0
-django-bootstrap5>=21.2
+django-bootstrap5>=21.3
 django-csp>=3.7
-django-cors-headers>=3.10.1
+django-cors-headers>=3.11.0
 django-debug-toolbar>=3.2.4
 django-form-utils>=1.0.3    # Only one use, in the liaisons app. Last release was in 2015.
 django-markup>=1.5    # Limited use - need to reconcile against direct use of markdown
@@ -23,8 +23,8 @@ django-simple-history>=3.0.0
 django-stubs==1.6.0    # The django-stubs version used determines the the mypy version indicated below
 django-tastypie==0.14.3    # Version must be locked in sync with version of Django
 django-webtest>=1.9.10    # Only used in tests
-django-widget-tweaks>=1.4.11
-djlint>=0.7.3    # To auto-indent templates via "djlint --profile django --reformat"
+django-widget-tweaks>=1.4.12
+djlint>=1.0.0    # To auto-indent templates via "djlint --profile django --reformat"
 docutils>=0.18.1    # Used only by dbtemplates for RestructuredText
 factory-boy>=3.2.1
 github3.py>=3.2.0
@@ -33,16 +33,16 @@ hashids>=1.3.1
 html2text>=2020.1.16    # Used only to clean comment field of secr/sreq
 html5lib>=1.1    # Only used in tests
 jsonfield>=3.1.0    # for SubmissionCheck.  This is https://github.com/bradjasper/django-jsonfield/.
-jwcrypto>=1.0    # for signed notifications - this is aspirational, and is not really used.
+jwcrypto>=1.2    # for signed notifications - this is aspirational, and is not really used.
 logging_tree>=1.9    # Used only by the showloggers management command
 lxml>=4.8.0,<5
-markdown>=3.3.4,<3.3.5    # 3.3.5 was yanked - can't move to 3.3.6 until we are off of python3.6 (interacts with django-bootstrap5)
+markdown>=3.3.6
 mock>=4.0.3    # Used only by tests, of course
 mypy>=0.782,<0.790    # Version requirements determined by django-stubs.
 mysqlclient>=2.1.0
 oic>=1.3    # Used only by tests
 pathlib2>=2.3.7.post1
-Pillow>=8.4.0
+Pillow>=9.1.0
 pyang>=2.5.3
 pyflakes>=2.4.0
 pyopenssl>=22.0.0    # Used by urllib3.contrib, which is used by PyQuery but not marked as a dependency
@@ -59,7 +59,7 @@ scout-apm>=2.24.2
 selenium>=3.141.0,<4.0
 six>=1.16.0
 tblib>=1.7.0    # So that the django test runner provides tracebacks
-tlds>=2022042100  # Used to teach bleach about which TLDs currently exist
+tlds>=2022042700    # Used to teach bleach about which TLDs currently exist
 tqdm>=4.64.0
 Unidecode>=1.3.4
 weasyprint>=52.5,<53    # Datatracker tests past on 54, but xml2rfc tests do not.