diff --git a/azure-pipelines/pipelines.yaml b/azure-pipelines/pipelines.yaml
index f041cf236..001ce4050 100644
--- a/azure-pipelines/pipelines.yaml
+++ b/azure-pipelines/pipelines.yaml
@@ -29,7 +29,7 @@ stages:
           vmImage: ubuntu-latest
 
         variables:
-          python.version: "3.9"
+          python.version: "3.10"
 
         steps:
 
@@ -125,8 +125,6 @@ stages:
 
       strategy:
         matrix:
-          py39:
-            python.version: 3.9
           py310:
             python.version: 3.10
           py311:
@@ -170,8 +168,6 @@ stages:
 
       strategy:
         matrix:
-          py39:
-            python.version: 3.9
           py310:
             python.version: 3.10
           py311:
@@ -215,11 +211,6 @@ stages:
 
       strategy:
         matrix:
-          py39:
-            python.version: 3.9
-          py39_32:
-            python.version: 3.9
-            architecture: x86
           py310:
             python.version: 3.10
           py311:
diff --git a/pyproject.toml b/pyproject.toml
index 3ad327ef0..bbba5ea32 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -14,7 +14,7 @@ exclude = '''
 '''
 
 [tool.pyright]
-pythonVersion = "3.8"
+pythonVersion = "3.10"
 include = ["src/**", "tests/**" ]
 extraPaths = ["src/debugpy/_vendored/pydevd", "src/debugpy/_vendored/pydevd/pydevd_attach_to_process"]
 ignore = ["src/debugpy/_vendored/pydevd", "src/debugpy/_version.py"]
@@ -71,8 +71,8 @@ line-length = 88
 # Allow unused variables when underscore-prefixed.
 dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
 
-# Assume Python 3.8
-target-version = "py38"
+# Assume Python 3.10
+target-version = "py310"
 
 [tool.ruff.per-file-ignores]
 "tests/debugpy/test_breakpoints.py" = ["F841"]
diff --git a/setup.py b/setup.py
index e01f675ae..96fd8c53f 100644
--- a/setup.py
+++ b/setup.py
@@ -160,11 +160,9 @@ def tail_is(*suffixes):
         project_urls={
             "Source": "https://github.com/microsoft/debugpy",
         },
-        python_requires=">=3.8",
+        python_requires=">=3.10",
         classifiers=[
             "Development Status :: 5 - Production/Stable",
-            "Programming Language :: Python :: 3.8",
-            "Programming Language :: Python :: 3.9",
             "Programming Language :: Python :: 3.10",
             "Programming Language :: Python :: 3.11",
             "Programming Language :: Python :: 3.12",
diff --git a/tests/requirements.txt b/tests/requirements.txt
index 77fcfbe1e..195e94fba 100644
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -1,6 +1,6 @@
 ## Used to run the tests:
 
-pytest
+pytest>=9.0.3  # CVE-2025-71176 (vulnerable <= 9.0.2)
 pytest-xdist
 pytest-cov
 pytest-timeout
@@ -18,7 +18,10 @@ django
 flask
 gevent
 numpy
-requests
+requests>=2.33.0  # CVE-2026-25645 (vulnerable < 2.33.0)
+# urllib3 is pulled in transitively by requests; pin a secure floor for
+# CVE-2026-44431 and CVE-2026-44432 (vulnerable 2.6.0 <= x < 2.7.0).
+urllib3>=2.7.0
 typing_extensions
 
 # Used to build pydevd attach to process binaries:
diff --git a/tox.ini b/tox.ini
index 2a5ea04a2..e53b29f07 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py{38,39,310,311,312,313,314}{,-cov}
+envlist = py{310,311,312,313,314}{,-cov}
 
 [testenv]
 deps = -rtests/requirements.txt
@@ -8,7 +8,5 @@ setenv =
     DEBUGPY_TEST=1
 commands_pre = python build_attach_binaries.py
 commands =
-    py{38,39}-!cov: python -m pytest {posargs}
-    py{38,39}-cov: python -m pytest --cov --cov-append --cov-config=.coveragerc {posargs}
     py{310,311,312,313,314}-!cov: python -Xfrozen_modules=off -m pytest {posargs}
     py{310,311,312,313,314}-cov: python -Xfrozen_modules=off -m pytest --cov --cov-append --cov-config=.coveragerc {posargs}