Update project dependencies

[cassi-volkova]

Summary

Consolidates Dependabot updates #101, #103, #112, #113, #114, #115, #116, #117, #118, #119, and #120 into one compatibility-tested Exordos DB change.

Testing found a GCL SDK registration-default regression. This PR fixes it by disabling node verification only for the two DB-internal registration paths whose models do not have the corresponding verifier. Regression tests cover both paths; the secure SDK default remains unchanged everywhere else.

Validation

Validated exact commit 50391e507444f4b5d9d6d92fcd5862e125f0eff0:

• Python 3.14 unit and functional tests pass, including both new regression tests;
• Ruff, wheel, sdist, and both element image builds pass;
• Mypy matches the unchanged master baseline;
• both DB elements deploy successfully in an isolated test environment;
• a fresh PostgreSQL data-plane instance accepts local and consumer connections, and a dependent service reaches active state.

The remaining red BuildTestPush check occurs after successful image build/upload because the unchanged workflow cannot discover the exact development artifact during installation. The detailed report documents this as a workflow artifact-discovery issue rather than a dependency or image failure.

Decision: dependency update and scoped compatibility fix are safe to merge and ready for review.

[gemini-code-assist]

Code Review

This pull request updates several dependency versions in pyproject.toml, including core dependencies (restalchemy, gcl_iam, and gcl_sdk), build system requirements (setuptools and setuptools_scm), and development/test dependencies (tox and coverage). There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cassi-volkova]

Preliminary dependency validation report

This preliminary report for commit 9605c87 has been superseded by the final validation report.

The initial source review, automated tests, package/image builds, and isolated runtime checks found the dependency set compatible. Subsequent consumer validation exposed a GCL SDK registration-default regression; the final report documents the scoped fix, regression tests, exact final commit, and current merge recommendation.

[cassi-volkova]

Validation correction — runtime regression confirmed

The earlier compatibility verdict is withdrawn and this PR is back in draft.

A subsequent cross-element Notification install exposed a real DBaaS runtime regression on the exact 2.4.1-dev+20260713011225.9605c87c images: the DBaaS control-plane stored the intended plaintext password and computed a SCRAM verifier, but the newly created PostgreSQL data-plane did not accept that password, leaving Notification bootstrap blocked with password authentication failure.

An A/B rerun with the same exact Notification image and DBaaS/communal PG rolled back to stable 2.4.0 produced matching desired and actual SCRAM verifier hashes on a fresh PostgreSQL cluster. This isolates the failure to the DB dependency bundle rather than Notification secrets, interpolation, or the isolated test environment.

Investigation and a scoped fix are in progress. This PR must not be merged until the exact dependency images are rebuilt and the same fresh-cluster Notification scenario passes.

[cassi-volkova]

CASSI final dependency validation report

This report supersedes the earlier preliminary report.

Final aggregate head: 50391e507444f4b5d9d6d92fcd5862e125f0eff0

Regression found and fixed

The aggregate updates gcl_sdk from 3.0.4 to 3.0.8. Starting with 3.0.5, the SDK enables verify_node_on_register=True by default. DB uses two internal registration paths whose models do not have the corresponding verifier in the local status store.

With the new SDK default, both registrations were rejected with Node verification failed; PostgreSQL resources remained unscheduled and a dependent Notification deployment could not connect to its database.

The scoped compatibility fix keeps the secure SDK default everywhere else and opts out only for these two DB-internal paths:

• verify_node_on_register=False in the internal UAgent construction;
• verify_node_on_register = False in the packaged PostgreSQL agent configuration.

Two regression tests cover the constructor argument and the packaged configuration value.

Automated validation

• Exact-head Python 3.14 unit tests pass, including both new regression tests.
• Exact-head Python 3.14 functional tests pass.
• Ruff passes.
• Wheel, sdist, and both Exordos element images build successfully.
• Mypy matches the master baseline: 76 errors in 20 files.
• GitHub lint jobs pass.
• GitHub BuildTestPush builds and uploads the image, bootstraps Core, and reaches installation. Installation fails because the workflow downloads build artifacts but invokes the repository-only install path without publishing or locally deploying that exact development version. This is a workflow artifact-discovery issue, not an image or dependency failure.

Isolated runtime validation

Both DB elements built from the final SHA were deployed successfully and became ACTIVE. The DB control plane was replaced from the final image; its service is active, the scoped registration flag is present, and no Node verification failed entries appeared after startup.

A fresh PostgreSQL data-plane instance was then created through a dependent Notification deployment:

• the PostgreSQL agent and Patroni services became active;
• the packaged verify_node_on_register = False value was confirmed;
• local and consumer-side SELECT 1 checks passed;
• the dependent Notification API and agent services became active.

Recommendation

The dependency aggregate plus the scoped DB compatibility fix is safe to merge. The dependency-induced registration regression is fixed and covered by tests, and the final images pass a clean consumer deployment. The remaining red GitHub build check is the unrelated workflow artifact-publication gap described above.