chore(toolchain): drop all but the latest 3.9 toolchain (#3377)

Summary:
- drop the `3.9` versions one by one.
- add the latest astral toolchain builds.
- add a disclaimer to our changeleg about `3.9`.
- update examples to use the latest `3.9` build (separate PR)
  will switch to a different python version.

Work towards #2704

Author: aignas

CHANGELOG.md

@@ -30,11 +30,13 @@ BEGIN_UNRELEASED_TEMPLATE
 
 {#v0-0-0-removed}
 ### Removed
+* (toolchain) Remove all of the python 3.9 toolchain versions except for the `3.9.25`.
+  This version has reached EOL and will no longer receive any security fixes, please update to
+  `3.10` or above.
 
-* Nothing removed.
 {#v0-0-0-changed}
 ### Changed
-* Nothing changed.
+* (toolchains) Use toolchains from the [20251031] release.
 
 {#v0-0-0-fixed}
 ### Fixed
@@ -43,8 +45,9 @@ BEGIN_UNRELEASED_TEMPLATE
 
 {#v0-0-0-added}
 ### Added
-* Nothing added.
+* (toolchains) `3.9.25` Python toolchain from [20251031] release.
 
+[20251031]: https://github.com/astral-sh/python-build-standalone/releases/tag/20251031
 
 END_UNRELEASED_TEMPLATE
 -->

examples/BUILD.bazel

@@ -26,7 +26,7 @@ lock(
         "--universal",
         "--python-version=3.9",
     ],
-    python_version = "3.9.19",
+    python_version = "3.9",
 )
 
 lock(

examples/bzlmod/MODULE.bazel

@@ -55,7 +55,6 @@ python.override(
     # require versions not listed here.
     # available_python_versions = [
     #     "3.10.9",
-    #     "3.9.18",
     #     "3.9.19",
     #     # The following is used by the `other_module` and we need to include it here
     #     # as well.
@@ -65,7 +64,7 @@ python.override(
     # instead of rules_python's defaulting to the latest available version,
     # controls what full version is used when `3.x` is requested.
     minor_mapping = {
-        "3.9": "3.9.19",
+        "3.9": "3.9.25",
     },
 )
 

examples/pip_parse/MODULE.bazel

@@ -9,14 +9,14 @@ local_path_override(
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 python.toolchain(
     # We can specify the exact version.
-    python_version = "3.9.13",
+    python_version = "3.9.25",
 )
 
 # You can use this repo mapping to ensure that your BUILD.bazel files don't need
 # to be updated when the python version changes to a different `3.9` version.
 use_repo(
     python,
-    python_3_9 = "python_3_9_13",
+    python_3_9 = "python_3_9_25",
 )
 
 pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
@@ -34,7 +34,7 @@ pip.parse(
     },
     hub_name = "pypi",
     # We need to use the same version here as in the `python.toolchain` call.
-    python_version = "3.9.13",
+    python_version = "3.9.25",
     requirements_lock = "//:requirements_lock.txt",
     requirements_windows = "//:requirements_windows.txt",
 )

examples/pip_parse/WORKSPACE

@@ -11,7 +11,7 @@ py_repositories()
 
 python_register_toolchains(
     name = "python_3_9",
-    python_version = "3.9.13",
+    python_version = "3.9.25",
 )
 
 load("@rules_python//python:pip.bzl", "pip_parse")