Update project dependencies

[cassi-volkova]

Summary

Consolidates Dependabot updates #294, #423, #441, #463, #464, #465, #466, #467, and #468 into one compatibility-tested Exordos Core change.

The update also includes a scoped compatibility fix for GCL IAM 1.3.1: the explicit default client alias is resolved to Core's default client UUID without weakening credential checks for UUID-based or explicitly invalid requests.

Validation

Validated exact commit 18c394ead11f81a8afbbd36870d0d222ebc15620:

• GitHub Actions build, coverage, lint, functional tests, and unit tests on Python 3.10, 3.12, and 3.14 pass;
• 21 authentication regression and boundary tests pass;
• the complete Python 3.14 functional suite passes with 440 pre-existing tests plus the new boundary coverage;
• the production documentation build, wheel, sdist, and image build pass;
• an isolated clean bootstrap reaches API readiness and active Core runtime resources with the exact image.

A detailed source review and validation report is available in the PR discussion.

Decision: safe to merge and ready for review.

[gemini-code-assist]

Code Review

This pull request updates dependencies in pyproject.toml, upgrading setuptools in the build system and updating the pytest version range in the development dependencies. The reviewer suggested a maintainability improvement to avoid duplicating the pytest dependency between the dev and test groups by having the dev group inherit from the test group.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cassi-volkova]

Dependency validation report

Verdict: safe to merge. The consolidated dependency update was reviewed, tested, built, and deployed from exact commit 18c394e.

Upstream/source review

• bazooka 1.3.4: avoids treating binary response bodies as text and resolves its logger once at module import.
• gcl_sdk 3.0.8: improves missing-resource logging and makes the SSH metadata path configurable.
• gcl_iam 1.3.1: adds controller auto-values/read-only DB support and changes the default IAM test client to use the default client alias.
• Zensical 0.0.50: reviewed the intervening feature/fix releases; the documentation build completes cleanly.
• setuptools 82.0.1: removes pkg_resources; Core has no pkg_resources usage and package/image builds succeed.
• pytest 9.1.1, mypy 2.2.0, Ruff 0.15.21, and tox 4.56.4: reviewed their release changes and exercised the repository tooling with the updated lock.

Compatibility issue found and fixed

gcl_iam 1.3.1 changed its default client identifier from the default UUID to the alias default. Core initially rejected nine authentication scenarios because /clients/default/... was not resolved.

This PR now:

• resolves only the explicit default alias to Core's default client UUID;
• permits omitted client credentials only when the request used that alias;
• continues to reject a UUID request without credentials;
• continues to reject the alias with explicitly incorrect credentials;
• includes functional regression and boundary coverage for those cases.

Automated validation

• GitHub Actions: build, coverage, lint, functional tests, and unit tests on Python 3.10, 3.12, and 3.14 all pass.
• Functional authentication regression set: 21 tests pass, including all nine originally failing scenarios and the new security boundaries.
• Full Python 3.14 functional suite: all 440 pre-existing tests pass; the new boundary cases also pass after matching the API's 401 Unauthorized behavior.
• Documentation: production Zensical build passes.
• Packaging: wheel and sdist build successfully with the updated build stack.

Isolated runtime validation

The exact image was deployed through a clean Core bootstrap:

• exordos ready_api passes;
• the Core element, manifest, compute node, and hypervisor become ACTIVE;
• the deployed image identifies commit 18c394ea;
• checked Core services are active and no dependency-induced runtime errors were found.

Result

No remaining dependency-induced regression was found. The aggregate update plus the default-client compatibility fix is safe to merge.