fix: dependency version constraints

[betinacosta]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

Adds explicit upper-bound version constraints to all runtime and optional dependencies in pyproject.toml, and fixes a type-checker error in the data anonymization HTTP transport layer.

Dependency constraints: Every unbounded >= specifier has been tightened to a >=X,<Y range to prevent silent breakage when a dependency releases a new major (or incompatible minor) version. This improves reproducibility and makes dependency conflicts easier to diagnose.

Notable constraint decisions:

• protobuf: minimum raised from >=5.29.5 to >=6.0.0,<7 (aligns with the protobuf v6 API)
• minio: pinned to >=7.2.16,<7.2.17 (patch-exact, matching previous ~=7.2.16 intent)
• cryptography: >=46.0.3,<47
• mcp, grpcio, opentelemetry-api/sdk, PyJWT, httpx, protovalidate, opentelemetry-instrumentation-langchain: all capped at their next major version
• All optional extras (starlette, fastapi, aiohttp, sqlalchemy, django, flask, langgraph, a2a-sdk): capped at their respective next major versions

Type fix: In _http_transport.py, _post_file_request now explicitly types file_value as BinaryIO | bytes and asserts request.file_content is not None in the else branch. This satisfies the ty type checker, which previously rejected the None-inclusive union as incompatible with requests.Session.post's files parameter. The assertion is always true at runtime — the model validates that exactly one of file_path or file_content is provided.

Related Issue

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

1. Install the package in a fresh virtual environment: uv sync
2. Verify no dependency conflicts are reported
3. Run the full test suite: uv run pytest
4. Run pre-commit checks: uvx pre-commit run --all-files
5. Confirm all hooks pass, including ty type check

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Additional Notes

The uv.lock file was regenerated after the constraint changes. The protobuf minimum version bump from 5.x to 6.x is the only change that could affect consumers who were pinned to protobuf 5 — however, since the SDK already requires protobuf 6 APIs at runtime, this was already an implicit requirement.

[LucasAlvesSoares]

Could use the compatible release operator ˜= instead of restricting the major directly.