Update project dependencies

[cassi-volkova]

Summary

Combines Dependabot updates #18, #20, #25, and #26 into one tested dependency patch:

• gcl_sdk 2.0.0 → 3.0.8
• certbot 4.1.1 → 5.6.0
• mock 3.0.5 → 5.2.0
• cryptography 46.0.5 → 49.0.0

The patch adds focused compatibility tests for the Certbot authenticator interface, Cryptography RSA key/CSR operations, and the SDK-backed DNS client.

The dependency bridge is complete: gcl_iam 1.3.2 is published with Python 3.10+ and Cryptography 49 support. The final lock resolves the registry release and contains no temporary Git source.

Source review highlights

• Certbot 5 removes Python 3.9 support and deprecated ACME/TLS interfaces; this project requires Python 3.10+ and does not use the removed interfaces. The DNS authenticator remains discoverable by Certbot 5.6.0.
• Cryptography 47–49 removes legacy curves, old OpenSSL support, deprecated type aliases, and legacy platforms. The plugin uses supported RSA, serialization, CSR, and X.509 APIs.
• GCL SDK 3 changes IAM authentication defaults, adds node verification, and includes agent/meta fixes. This plugin uses CoreIamAuthenticator and CollectionBaseClient; both are covered by compatibility tests and isolated integration validation.
• Mock 4–5 tightens autospec/mock-of-mock behavior and adds AsyncMock fixes. The new DNS client test exercises the updated package.

Validation

Tested commit: 93a3f565b0c6baa8b2e5e973f94a4880787a6369.

• Final lock resolves gcl_iam 1.3.2 and Cryptography 49.0.0 from PyPI.
• Unit and dependency-boundary tests pass locally on Python 3.10, 3.11, 3.12, 3.13, and 3.14.
• GitHub CI passes Ruff and tests on Python 3.10, 3.12, and 3.14.
• Wheel and sdist build successfully; wheel metadata requires Python 3.10+ and contains only registry-compatible dependency ranges.
• Certbot discovers genesis-core as an Authenticator.
• RSA key persistence, CSR/SAN round trip, SDK-backed DNS client creation/deletion, and IAM-backed integration behavior pass.
• Mypy matches the master baseline: 11 errors in 2 files.
• The configured functional tox environment fails identically on master because the functional-test directory does not exist.

Result

The released dependency set is compatible and this PR is ready for review.

[cassi-volkova]

CASSI final dependency validation report

Final head: 93a3f565b0c6baa8b2e5e973f94a4880787a6369

The temporary validation source has been removed. The final lock resolves the published gcl_iam 1.3.2 and Cryptography 49.0.0 from PyPI.

Verification

• Source and changelog review completed for Certbot 5.6.0, Cryptography 49.0.0, GCL SDK 3.0.8, and Mock 5.2.0.
• uv lock --check passes with no Git source overrides.
• Local unit and dependency-boundary matrix passes on Python 3.10–3.14: 4 tests per interpreter / 20 executions.
• GitHub CI passes Ruff and unit tests on Python 3.10, 3.12, and 3.14.
• Compatibility coverage includes the Certbot authenticator interface, Cryptography RSA key/CSR round trip, and the SDK DNS client.
• Exact-head wheel and sdist builds pass:
  • wheel SHA-256: a81edd3d88747ca9a174d2616b61782edf1b631a248aaef5291bfc5a53586df2
  • sdist SHA-256: 5c35772535d4d69878789ece43040ff02cb612083dd981f4891b46cb6d5f148a
• Wheel metadata contains Requires-Python: >=3.10, cryptography>=49.0.0,<50.0.0, and registry-compatible GCL IAM/GCL SDK constraints.
• Certbot plugin discovery and isolated integration validation pass, including IAM authentication and DNS challenge record creation/cleanup.
• Mypy remains at the master baseline of 11 errors in 2 files.
• The functional tox target remains unavailable on both branch and master because the configured functional-test directory does not exist.

Recommendation

Safe to merge. The released dependency set resolves cleanly, all dependency-sensitive automated and integration checks pass, and no compatibility workaround remains in the patch.

[gemini-code-assist]

Code Review

This pull request updates project dependencies, including bumping certbot to version 5.x, cryptography to version 49.x, and mock to version 5.x, along with adding a temporary validation source for gcl-iam. It also introduces a new unit test suite (test_dependency_compat.py) to verify compatibility with these updated dependencies. Feedback on the new tests suggests importing mock from the standard library unittest module to align with PEP 8 import grouping, and simplifying public key comparison by comparing the key objects directly instead of using public_numbers().

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.