Description

Second and final batch for the /test tooling project. After this merges, test/poetry.lock and test/pyproject.toml have no open Dependabot alerts, so the per-package security PRs against /test stop.

Versions are the latest each constraint allows, so three land above the Dependabot targets (idna, werkzeug, pytest). pytest 9 adds pygments as a transitive dependency.

cryptography and pyopenssl. Dependabot could not raise a PR for the four open cryptography alerts (fixes in 48.0.1, 49.0.0 and 50.0.0) because pyopenssl 26.0.0 requires cryptography <47; its updater job reported update_not_possible. pyopenssl is not imported anywhere in test/ or cicd/: werkzeug serves TLS from cert files via the stdlib ssl module. It is removed here. cryptography itself is still needed, since write_gcp_service_account in StackQLInterfaces.py generates a throwaway RSA key with it for four robot scenarios, so it moves from an inherited transitive to an explicit cryptography = "50.0.0" pin, matching cicd/requirements.txt since #730.

test/pyproject.toml was edited by hand and test/poetry.lock regenerated with Poetry 2.4.1 (the version that wrote the existing lock) via poetry lock plus poetry update --lock urllib3 werkzeug idna pytest. No other packages moved.

Closes #745, closes #746, closes #747, closes #748.

Type of change

• Bug fix (non-breaking change to fix a bug).
• Feature (non-breaking change to add functionality).
• Breaking change.
• Other (eg: documentation change). Please explain: dependency changes for the python test tooling only. No product code changes.

Evidence

Local, WSL, Python 3.12.3, poetry sync from the new lock (pyopenssl confirmed absent from the environment):

• pip check: no broken requirements.
• Resolved: flask 3.1.3, werkzeug 3.1.8, urllib3 2.7.0, idna 3.19, pytest 9.1.1, cryptography 50.0.0, cffi 2.1.1, pygments 2.21.0.
• write_gcp_service_account called directly under cryptography 50.0.0: writes a valid 2048-bit PKCS8 RSA key that loads back with load_pem_private_key.
• TLS github flask mock starts on 1093 with the mTLS cert files (stdlib ssl path, no pyopenssl) and serves GET /repos/dummyorg/dummyapp.io/contributors: HTTP 200, 8 rows.
• stackql exec through that mock returns the expected count of 8.
• robot test/robot/functional/stackql_casing.robot against the native_test mock: 29 tests, 29 passed, 0 failed.

CI: Test Python Package Build builds the wheel from this lock; the Linux, WSL and Docker test jobs consume it. The four Write Gcp Service Account scenarios in the mocked suite exercise the cryptography path end to end.

Checklist:

• A full round of testing has been completed, and there are no test failures as a result of these changes.
• The changes are covered with functional and/or integration robot testing. (see Variations)
• The changes work on all supported platforms.
• Unit tests pass locally, as per the developer guide. (n/a, no Go changes)
• Robot tests pass locally, as per the developer guide. (casing suite via the fast path; full sweep left to CI)
• Linter passes locally, as per the developer guide. (n/a, no Go changes)

Variations

No new robot scenarios. Existing suites, including the four scenarios that call Write Gcp Service Account, are the regression coverage.

Tech Debt

cicd/requirements.txt still pins Flask 3.0.3, Jinja2 3.1.4, mistune 3.0.2 and requests 2.32.3, and the CI test jobs install it after the tooling wheel, so pip downgrades to those pins. It carries its own open alerts (mistune, jinja2) and is the next batch. Longer term the two Python manifests should collapse into one.

Remaining alert sources after this PR: cicd/requirements.txt, go.mod (pgx, kin-openapi), get-app/package-lock.json (undici), packaging/mcpb/npm/package.json (adm-zip), and two action-version alerts in workflows. A dependabot.yml with grouped security updates would make future waves arrive as one PR per manifest.