LITE-33140: Tested bump dependencies

[pcaro]

Summary

Clean, targeted redo of the dependency bump attempted in #248, on top of current master.

This PR mirrors the targeted bump done in the sibling client repo — see cloudblue/connect-python-openapi-client#86 .

Changes

Test toolchain

Package	From	To
pytest	7.2.2	8.4.2
pytest-cov	2.12.1	6.3.0
coverage	5.5	7.14.3
responses	0.20.0	0.26.1

pytest 8 changed collection ordering, exposing a latent isolation bug: tests/plugins/play/test_play_commands.py does del sys.modules['connect.cli.ccli'] then reimports it, so test_ccli.py's module-level from ... import main bound to a stale module object that mocker.patch never touched. Fixed by importing main inside each test.

Lint toolchain

Package	From	To
flake8	5.0.4	7.3.0
flake8-bugbear	22.12.6	25.11.29
flake8-commas	2.1.0	4.0.0
flake8-isort	5.0.3	6.1.2
flake8-broken-line	0.5.0	1.0.0

Only bugbear codes are enforced (select = "B"); bugbear 25 adds B017, which flagged a broad pytest.raises(Exception) in test_http.py masking the real ValueError — narrowed it.

Runtime deps

Package	From	To
connect-openapi-client	34.0	35.0 (floor >=29 → >=35)
interrogatio	2.3.1	2.4.0
iso3166	1.0.1	2.1.1
phonenumbers	8.13.55	9.0.33
poetry-core	1.9.1	2.4.1
click	8.3.1	8.4.2
requests	2.32.5	2.34.2
connect-eaas-core	37.0	38.0 (floor >=37 → >=38)
pydantic	1.10.24	2.13.4

connect-openapi-client 35.0 dropped its importlib-metadata<7 pin (via #86), which unblocked interrogatio 2.4 (needs importlib-metadata>=8.5); that also pulls httpx 0.28.1 / pytest-httpx 0.35.0 and drops sniffio.

connect-eaas-core 38.0 migrated to pydantic v2 and dropped its pydantic<2 pin — eaas-core was the only thing holding the tree on pydantic 1, so raising the floor pulls pydantic 2 in (plus annotated-types, pydantic-core, typing-inspect, typing-inspection). connect-cli uses no pydantic directly, so no code changes. eaas-core 38 declares python <3.15, so connect-cli's range is narrowed to match:

python = ">=3.10,<3.15"   # was <4; eaas-core 38 caps at <3.15, keeping <4 fails to resolve

Verification

• CI green on this branch: test (3.10) (flake8 + full pytest) ✅, SonarCloud ✅.
• Full suite locally: 715 passed (poetry run pytest); flake8 clean repo-wide.
• (2 failures only reproduce locally — weasyprint native libs + a jinja binary-template byte — both pre-existing on master and independent of this change; they pass in CI, which has the system libs.)

⏳ Still deferred — blocked upstream

• rich 12 → 15 — capped by connect-markdown-renderer 3.x (rich >=12.4.4,<13); its latest (3.0.0) still caps it. Needs a markdown-renderer release that allows rich 13+. (This cap is markdown-renderer, not eaas-core.)

Out of scope

• connect-reports-core (26.*, latest 34.0) — deliberate major pin coupled to the report-execution engine (last bumped in LITE-24284 for the async engine). It transitively pins the report/PDF stack (weasyprint <54, plotly <6, kaleido ==0.2.1, jsonschema <4, orjson <4); bumping is behavior-affecting and needs separate validation. Used only by the report / project report plugins.
• black kept at 23.* (mirrors the client repo, avoids repo-wide reformat churn).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud