[maxipavlovic]

What

• Python 3.10 is the new minimum: range >=3.10,<4 and test matrix 3.10 and 3.11, because the 3.8 and 3.9 jobs can't start on ubuntu-latest. No other range in pyproject.toml or package.json changes.
• poetry.lock and package-lock.json move to the newest releases the constraints allow for Python 3.10 and newer.
• One test assertion on a jq error message is relaxed, in its own commit.
• Dependabot groups version updates into one PR a month per ecosystem, once a release is 7 days old. Security updates still open as soon as an alert appears, grouped when several are due at once: the monthly schedule, the cooldown and the PR limit don't apply to them.

Why

• 99 open Dependabot alerts (5 critical, 42 high): 35 on poetry.lock, 62 on package-lock.json, 2 on pyproject.toml. This clears 75 and leaves 24: 69 with the refresh and 6 more with the Python 3.10 floor.

Key decisions

• The extension's own requirements don't change. That holds back the 19 left on poetry.lock and pyproject.toml:
  • 7: starlette, because connect-eaas-core 28 needs fastapi 0.95.
  • 8: urllib3, because the extension and connect-eaas-core ask for urllib3 < 2. One of them is on pyproject.toml.
  • 2: pytest, capped below 8 in pyproject.toml. One of them is on pyproject.toml.
  • 2: setuptools, whose fixes (83, 84.1) have no pkg_resources. connect-eaas-core 28 imports it at start-up and flake8-commas needs it, so setuptools stays at 81.0.0.
• 5 are left on npm: serialize-javascript (3), because css-minimizer-webpack-plugin sits under dependencies and the fix needs its 8.x and copy-webpack-plugin 14, both Node 20.9 or newer; deepmerge (1), which has no fixed release; minimatch (1), which eslint and glob pin below 11.
• connect-openapi-client moves from 29.3 to 34.0, with httpx, httpcore, h11 and pytest-httpx. jq moves from 1.4.1 to 1.13.0, inside the extension's ^1.4.1. It bundles a newer jq that words one error message differently ("line 1, column 393:"). Worth a look at the formula and filter row behaviour before a release.
• This extension deploys from its lock file, so the new versions reach production with its next release: deploy that release to a test environment first.
• The Dockerfile (local development) runs poetry update, which ignores the lock and now picks setuptools 84, without pkg_resources. It was not built here.
• connect_transformations/static is tracked and is not rebuilt.

How it worked before / after

• Before: 99 alerts, Python 3.8 and newer, no Dependabot configuration.
• After: 24 alerts, Python 3.10 and newer, one grouped version PR a month per ecosystem, and security PRs only when an alert appears.
• Locally (Poetry 2.5.1): flake8 passes and 300 tests pass on Python 3.10 and 3.11. On Node 25.4.0 (there is no frontend CI), lint, 5 tests and the build passed before this change; no npm file changes here.