Move python-dateutil from the package's runtime dependencies to its Poetry development group.

[suliuzh]

Summary

Move python-dateutil from the package's runtime dependencies to its Poetry development group.

Rationale

python-dateutil is currently one of the package's two default dependencies (pyproject.toml:28-32).
In the repository, its only direct import is in the test comparison helper (tests/abstract_sbom_compare.py:13).
The distributed siemens_standard_bom package does not import it.

The project already maintains a Poetry development group, including the corresponding type stubs (pyproject.toml:44-50).

Changes

• Remove python-dateutil from [project].dependencies.
• Add the same version range to [tool.poetry.group.dev.dependencies].

 dependencies = [
-    "python-dateutil (>=2.9.0.post0,<3.0.0)",
     "cyclonedx-python-lib(>=11.11.0,<12.0.0)",
 ]

 [tool.poetry.group.dev.dependencies]
+python-dateutil = ">=2.9.0.post0,<3.0.0"
 types-python-dateutil = "2.9.0.20260716"

Impact

This would keep the test helper available to contributors without adding python-dateutil to every library installation.

If you agree with this change, I would be happy to open a pull request.

[hakandilek]

Thanks for the detailed write-up. Your analysis holds up.

I verified it locally, and there's one more fact in your favour: python-dateutil isn't pulled in transitively by cyclonedx-python-lib either. So removing it genuinely drops two packages from every downstream install — python-dateutil and six.

Two things before we act on it.

The proposed diff would break CI

tox installs the built wheel plus its own deps list, and Poetry dev-group dependencies aren't part of wheel metadata. Moving it to the dev group without also adding it to env_run_base.deps in tox.toml makes tests/abstract_sbom_compare.py:13 raise ImportError across all five matrix legs. That's why deepdiff is declared in both places — the dev group and tox.toml.

We'd rather delete it than move it

read_timestamp() has no callers outside test_timestamps, and it wraps dateutil.parser.isoparse — which no production path uses. StandardBom.timestamp returns bom.metadata.timestamp, which py-serializable parses with stdlib datetime.fromisoformat plus a Z-suffix shim.

This test looks meaningless at a first glance but it's gatekeeping the ISO Format change with Python 3.11. To be clear about what's breaking: removing the dependency isn't. Raising the floor to requires-python = ">=3.11,<4.0" is. Dropping 3.10 also retires a real inconsistency that the current dateutil-based test was masking — two-digit UTC offsets such as +01 parse fine on 3.11+ but raise ValueError on 3.10:

python3.10: '2009-08-07T06:05:04+01' -> ValueError: Invalid isoformat string
python3.11: '2009-08-07T06:05:04+01' -> 2009-08-07 06:05:04+01:00

Release scope

As Python 3.10 reaching EOL in October '26 we could drop both python-dateutil and Python 3.10 support together.

I'm going to handle the PR myself rather than ask you to open one, because this is landing together with dropping Python 3.10 support and is therefore entitled to a major bump: 4.3.0 → 5.0.0.

Thanks again for the clean report; it'll be credited in the 5.0.0 changelog. 🙂

[hakandilek]

@suliuzh PR has landed here: #158

Feedback appreciated!