[davidmreed]

Opened as draft because this moves the App Engine example's language runtime by more than two minor versions (Python 3.8 -> 3.11), and it could not be deployed to App Engine from here.

What changes

• examples/google_app_engine/flask/app.yaml:1: runtime: python38 -> runtime: python311.
• Why python311: App Engine's support schedule (updated 2026-10-20) lists the runtimes below.
  • python38 and python39 run on Ubuntu 18.04 (bionic), which has no fixed ca-certificates package.
  • python310 reached end of support on 2026-10-04.
  • python311 runs on Ubuntu 22.04 (jammy), is supported until 2027-10-24, and is the smallest supported step. Google manages the OS image.

Where it ships

• This is a user template; nothing in this repo deploys it.

Not covered by this PR

• Pre-existing problem: requirements.txt's Flask>=1.1,<2 already fails to import on the current python38 runtime. Jinja2 2.x imports markupsafe.soft_unicode, which current MarkupSafe removed, so Flask>=3.1.3,<4 (matching requirements/adapter_dev.txt:41) is an owner follow-up.
  • This PR does not change it, because the failure does not depend on the runtime: import flask fails the same way on Python 3.8, 3.10, 3.11 and 3.12.
• examples/aws_lambda/*_config.yaml:6 still use python3.8 on Amazon Linux 2. There is no fixed package to gate on, and the fix depends on AWS. Owner follow-up.
• The example Dockerfile base moves are in a separate draft PR (Docker), and the Cloud Functions certifi floor is in a separate PR (Python).

Verification

• ubuntu:22.04: apt-cache policy ca-certificates shows candidate 20260816ubuntu0.22.04.1, the fixed jammy version. Whether App Engine's python311 image has picked it up is up to Google and was not verified.
• pip install slack_bolt "Flask>=1.1,<2", then importing flask and slack_bolt.adapter.flask:
  • Result on python:3.8-slim, 3.10-slim, 3.11-slim and 3.12-slim: ImportError: cannot import name 'soft_unicode' from 'markupsafe'.
  • This confirms the Flask failure exists already and does not depend on the runtime.
• Not verified: an actual App Engine deploy. CI: Python CI is waiting for maintainer approval (fork PR), and it does not cover this example.

🤖 Generated with Claude Code
Part of the eMudhra 53119 CA-distrust remediation (CVE-2026-111943).