Description

Rolls the four open Dependabot bumps against the /test tooling project into one change, so they land in a single CI cycle instead of four:

Transitive changes pulled in by pyopenssl 26.0.0 (which requires cryptography >=46,<47), identical to what #742 resolved:

test/pyproject.toml pins were updated by hand (both requests occurrences, main and dev groups, as in #741) and test/poetry.lock was regenerated with Poetry 2.4.1, the version that wrote the existing lock. The resulting package set is exactly the union of the four Dependabot lock diffs. No other packages moved.

Closes #739, closes #740, closes #741, closes #742.

Type of change

• Bug fix (non-breaking change to fix a bug).
• Feature (non-breaking change to add functionality).
• Breaking change.
• Other (eg: documentation change). Please explain: dependency bumps for the python test tooling only. No product code changes.

Evidence

Local, WSL, Python 3.12.3, installed from the new lock with poetry install:

• pip check: no broken requirements.
• Resolved versions: flask 3.1.3, jinja2 3.1.6, requests 2.33.0, pyOpenSSL 26.0.0, cryptography 46.0.7, werkzeug 3.1.3, cffi 2.1.1.
• The TLS github flask mock (pyOpenSSL/cryptography via werkzeug's ssl adapter) starts on 1093 with the mTLS certs and serves GET /repos/dummyorg/dummyapp.io/contributors: HTTP 200, 8 rows.
• stackql exec against that mock returns the expected count of 8.
• robot test/robot/functional/stackql_casing.robot against the native_test mock: 29 tests, 29 passed, 0 failed.

CI: the Test Python Package Build job builds the wheel from this lock, and the Linux, WSL and Docker test jobs consume it.

Checklist:

• A full round of testing has been completed, and there are no test failures as a result of these changes.
• The changes are covered with functional and/or integration robot testing. (see Variations)
• The changes work on all supported platforms.
• Unit tests pass locally, as per the developer guide. (n/a, no Go changes)
• Robot tests pass locally, as per the developer guide. (casing suite via the fast path; full sweep left to CI)
• Linter passes locally, as per the developer guide. (n/a, no Go changes)

Variations

No new robot scenarios. The existing suites are the regression coverage for the flask mocks and the tooling this package provides.

Tech Debt

cicd/requirements.txt still pins Flask 3.0.3, Jinja2 3.1.4, mistune 3.0.2 and requests 2.32.3. The CI test jobs install that file after the tooling wheel, so pip downgrades to those pins with a dependency-conflict warning and the robot runs in CI use the older versions. The two manifests should be brought into line (or collapsed into one) in a follow-up; Dependabot has open alerts for mistune and jinja2 on that file and will raise the mirror PRs otherwise.

Remaining test/poetry.lock alerts after this change: cryptography has advisories patched only in 48.0.1 and 49.0.0, which pyopenssl 26.0.0's <47 bound prevents reaching. That clears when pyopenssl lifts the bound.