Update dependency pins and preserve supported CI environments

.github/requirements/integration.in

@@ -15,9 +15,9 @@ PyYAML>=6.0.3
 # Keep Windows timezone data even when Dependabot recompiles this shared lock on Linux.
 tzdata>=2026.5
 opentelemetry-api>=1.44.0
-opentelemetry-sdk>=1.44.0
+opentelemetry-sdk>=1.45.1
 tomli>=2.0.1; python_version<"3.11"
-boto3>=1.43.108
+boto3>=1.43.109
 azure-storage-blob>=12.19.0
 google-api-python-client>=2.100.0
 google-auth-httplib2>=0.2.0
@@ -27,7 +27,7 @@ paramiko>=3.4.0
 smbprotocol>=1.13.0
 fsspec>=2024.2.0
 msal>=1.39.0
-boxsdk>=10.15.0,<11
+boxsdk>=10.17.1,<11
 pyarrow>=25.0.1
 PySide6>=6.11.2,<6.12
 pytest>=8.0.0

.github/requirements/integration.txt

@@ -7,7 +7,7 @@ azure-core==1.41.0 \
 azure-storage-blob==12.31.0 \
     --hash=sha256:0c0cb601d3462491d09ea96023cd791bb9dd4b173bf950daf3cff34ff47ba5b5 \
     --hash=sha256:997b393cfcbdc4b186d5911790d91f80387f7edc12c4d73eab963a2d26e5b2a9
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 bcrypt==5.0.0 \
     --hash=sha256:046ad6db88edb3c5ece4369af997938fb1c19d6a699b9c1b27b0db432faae4c4 \
     --hash=sha256:0c418ca99fd47e9c59a301744d63328f17798b5947b0f791e9af3c1c499c2d0a \
@@ -73,20 +73,20 @@ bcrypt==5.0.0 \
     --hash=sha256:f8429e1c410b4073944f03bd778a9e066e7fad723564a52ff91841d278dfc822 \
     --hash=sha256:fc746432b951e92b58317af8e0ca746efe93e66555f1b40888865ef5bf56446b
     # via paramiko
-boto3==1.43.108 \
-    --hash=sha256:03341f089158368acf83e921aca98b706095322ca52bc4c039a616940aa5ad41 \
-    --hash=sha256:19e9da95ef0c494e27052049a42137550e66730509bb613e76eaa30ddf9a7170
-    # via -r .github/requirements/integration.in
-botocore==1.43.108 \
-    --hash=sha256:ab9d16c6b4350aaa54ed28202dfa2998b2d735fdbf3247eb60af469d8d48a5b8 \
-    --hash=sha256:ee4f75cf3bdbb0da7912e089950e8112f692016539d939312c771499958e6cfd
+boto3==1.43.109 \
+    --hash=sha256:703a81baed186d31e27cf50065d25a9faeb704f009e7c56b0f002ca52a328896 \
+    --hash=sha256:c829bc3352e1e3922d8fe1db10b697182ac411b64ce5fc3acb0a06a29837417e
+    # via -r integration.in
+botocore==1.43.114 \
+    --hash=sha256:d1c441a22e93e158de5b1e026205f5d6d67a4545d10540c5090c62dccb3a9eca \
+    --hash=sha256:f366fa4db518775632ad1eb128cd8203ca46396cecf37209d904f0bbc049ce90
     # via
     #   boto3
     #   s3transfer
-boxsdk==10.17.0 \
-    --hash=sha256:86c9a1f665c8879af501c02ec51bbe02247b24f96c6bc39f6890912e70091840 \
-    --hash=sha256:fe42658185901b80437a0d5b393c91b4a732f3b78d1be11d881aa7484807c9d5
-    # via -r .github/requirements/integration.in
+boxsdk==10.17.1 \
+    --hash=sha256:7e85b520172ccc1e9c9f9ad7c72875a69caee8d8f609e804936f8a7e111a7774 \
+    --hash=sha256:c17ef54a30062e9a4528facdbf386a1e3e426661d319451a8ceb9007019623ea
+    # via -r integration.in
 certifi==2026.7.22 \
     --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
     --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
@@ -559,7 +559,7 @@ cryptography==50.0.2 \
     --hash=sha256:fa8f5efb344d6908a1ce62f4a24e2e5780f825d6f53f5f50ec5ffacac72936cb \
     --hash=sha256:fdd28f912fccfec1846a94e2e1e8f9b0012f557f0c46fe4f3eb0d7a87afcf90b
     # via
-    #   -r .github/requirements/integration.in
+    #   -r integration.in
     #   azure-storage-blob
     #   google-auth
     #   msal
@@ -570,23 +570,23 @@ cryptography==50.0.2 \
 defusedxml==0.7.1 \
     --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \
     --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 dropbox==12.2.2 \
     --hash=sha256:044d963cdee83a5149e103c792b1a0284f681bb1b6984259cda01244cc3c1a6e \
     --hash=sha256:9abc636a57788165c1e1f263971163230ccc26fd448df643c1005e0dc1abd1a3
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 fsspec==2026.9.0 \
     --hash=sha256:0f08147951c8cb31d844c3547d631053b127863b60be04cf06e121333ee0e2fe \
     --hash=sha256:8dd6e646e99ea382bd85f97a45e6b526a442d79423a7dc673f1e2756d05fcb5f
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 google-api-core==2.40.0 \
     --hash=sha256:4b9e0a80024c269ae173136d5439f4ed284651d6e5e2773ba5c694f481f9c0f4 \
     --hash=sha256:ebee7d1b138b5362beecec260e6e8988ac97346562c7382ccb6f0ad8435c599f
     # via google-api-python-client
 google-api-python-client==2.201.0 \
     --hash=sha256:2d9bf1ba3f12eee8ed3d0f1791ce0605d163432f496baa72d3677faa2cf097d6 \
     --hash=sha256:d5691982abd7287f53cb0b0e0c6a9984d4103cf864ea0a88cb6e4347bbaf70de
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 google-auth==2.59.1 \
     --hash=sha256:89c3f931683a482ac97e61df7eb9da5e08a91703f3c752b2377d72cfb7d69e6a \
     --hash=sha256:ce50fc533ac02f489a2b183a0c156672c376ecb2091b1127bc7efba2975fff27
@@ -599,12 +599,12 @@ google-auth-httplib2==0.4.4 \
     --hash=sha256:b931de392c20cfaa351cd789274922bd8cdc001e0e9e96de31b39d71347f8e16 \
     --hash=sha256:bbe5d7b2401bb3a4017f4720e1e91bd273ab9a2bb60b84e65edbc0de127852da
     # via
-    #   -r .github/requirements/integration.in
+    #   -r integration.in
     #   google-api-python-client
 google-auth-oauthlib==1.5.0 \
     --hash=sha256:71625fdea21c6c03217eb9ff13741c3096e6d257ebca0ad084dbd6e9f4aa4ef4 \
     --hash=sha256:b351107c7dd9017f426cbb0272ea1bc04f469020fd18f4443c7d40362e0b1510
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 googleapis-common-protos==1.75.5 \
     --hash=sha256:c7a866fc34ed29a3b10af627a4b9b1dc2433313ca6e959f0ae4feb132047ed72 \
     --hash=sha256:d7285525c23039db98f2463e6d5a4f9b958b94d497f03a844ece3259c4e72d5d
@@ -634,7 +634,7 @@ isodate==0.7.2 \
 je-action-core==0.0.3 \
     --hash=sha256:395890665483e58f17fede17aa809bf6e2762ba8f0bd6751126fe46efabb8c85 \
     --hash=sha256:7b73ab0172a3c90c91b0a81b8a662350199a35842f529acf7a54706052fb38ee
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 jinja2==3.1.6 \
     --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
     --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
@@ -739,26 +739,26 @@ markupsafe==3.0.3 \
 msal==1.39.0 \
     --hash=sha256:2d2577886906cd7293850dffa2da29119966c213bfc6ec0cecf8bf7621e1ca77 \
     --hash=sha256:6ab7de335e6d7f5717e2c7e1dbf86e4dda2f6acf3c56773b78dc53ebc6395b5f
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 oauthlib==4.0.0 \
     --hash=sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd \
     --hash=sha256:efb274799819440f95b4ab3b818869f1ce9ae26c5beacba0201d1a1b76b54f86
     # via requests-oauthlib
-opentelemetry-api==1.45.0 \
-    --hash=sha256:711ede81773c8025c2c03dac0450bc89f3d30aea6eabcc815c570d4e35a963f7 \
-    --hash=sha256:80e068aba7cd56c8b58512d6a36f8d25cb1dfaa0c0a4cc1c938ccf9f362d9cb3
+opentelemetry-api==1.45.1 \
+    --hash=sha256:aa38ed19bcc084ba42782a73255b3582283eced7ad6dddbd6695189e69adfb75 \
+    --hash=sha256:b31553efa588ae44bc306f863c785c5333a9ecc091248c6ee68b4b6c87fdedfb
     # via
-    #   -r .github/requirements/integration.in
+    #   -r integration.in
     #   google-api-core
     #   opentelemetry-sdk
     #   opentelemetry-semantic-conventions
-opentelemetry-sdk==1.45.0 \
-    --hash=sha256:20caa5130505e386c67c3da1c76e446c842698ced54c76c6148679539aa97972 \
-    --hash=sha256:5dc634c946546f61b757c5b1781f9fd1a10e96ffaf7357c797e508fe9c57e75e
-    # via -r .github/requirements/integration.in
-opentelemetry-semantic-conventions==0.66b0 \
-    --hash=sha256:175b19dd98c4473f4f43a2b1df59186fd7b4a48cd3f77cbe03438b6d6fda230a \
-    --hash=sha256:97a77dce484c54861e7eeff7651fd8a806dd3c30e501dc316730215ec36890e6
+opentelemetry-sdk==1.45.1 \
+    --hash=sha256:63d24a6ca645019a631e6a51999c73e93adcac1196ca640b8ae78a7cc4762bf3 \
+    --hash=sha256:c604c11dc429810812348989115fa44bd558772a3d7442afc43d024f2c250ca4
+    # via -r integration.in
+opentelemetry-semantic-conventions==0.66b1 \
+    --hash=sha256:497ca63bf383723411e8eaf60c8779e9877633c936bb641080adab59d0eb6ec8 \
+    --hash=sha256:d4cddeb4315490b35213f55e2bdc9ac54bb1e4d318927475bed62b35545e581b
     # via opentelemetry-sdk
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
@@ -770,7 +770,7 @@ packaging==26.3 \
 paramiko==5.0.0 \
     --hash=sha256:36763b5b95c2a0dcfdf1abc48e48156ee425b21efe2f0e787c2dd5a95c0e5e79 \
     --hash=sha256:b7044611c30140d9a75261653210e2002977b71a0497ff3ba0d98d7edbf62f7c
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
     --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
@@ -780,7 +780,7 @@ pluggy==1.6.0 \
 prometheus-client==0.26.0 \
     --hash=sha256:04a91bcf94e2cf74a44a1a874d651a2e853ed354b6e822f3b7487751465d5c2b \
     --hash=sha256:fa93d06737aa02bacd05794768508bb97d2fbee28cb3bca04eaae92f0ca953d6
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 proto-plus==1.29.0 \
     --hash=sha256:8acd070469a7aaf43f440b022ef9757c8cac1a9f866e933f59ae98669ddc6c8b \
     --hash=sha256:cfb4e62ad7e13dd18f346cabbda00cab39930d36a05791fd81ddb074d6ee884f
@@ -842,7 +842,7 @@ pyarrow==25.0.1 \
     --hash=sha256:eb6203482ff3746a5632303a7279ae0b5a304c46985b49ed1378cb350ea6728d \
     --hash=sha256:f3831aaa25c67a99f99dc8b05873cb9d64560390372e2aa197ce9dd4a3f06a44 \
     --hash=sha256:f729cfdbd36fd99d543b67a914d2de044c84ebe45be8b34902b299b608c15c8f
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 pyasn1==0.6.4 \
     --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
     --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
@@ -862,7 +862,9 @@ pygments==2.21.0 \
 pyjwt==2.15.1 \
     --hash=sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193 \
     --hash=sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8
-    # via msal
+    # via
+    #   msal
+    #   pyjwt
 pynacl==1.6.2 \
     --hash=sha256:018494d6d696ae03c7e656e5e74cdfd8ea1326962cc401bcf018f1ed8436811c \
     --hash=sha256:04316d1fc625d860b6c162fff704eb8426b1a8bcd3abacea11142cbd99a6b574 \
@@ -900,7 +902,7 @@ pyside6==6.11.2 \
     --hash=sha256:3201d67e3c10be2eaedd3910ff0f02351eca7e88c95a291cde5e7f2f55ef207f \
     --hash=sha256:57fe867a6c93821a085d74e8a26f863fc2363516848181c466032595b33b1729 \
     --hash=sha256:dc6d03990489a5085842770718392ef5de36352d8f608d9a9fe03e60af4d7b66
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 pyside6-addons==6.11.2 \
     --hash=sha256:354c574a839f7d0751960ba03f33bec87c95e0f2796dca3287f54d03abe97dac \
     --hash=sha256:a2ca3c73e5f060d4aca49451abd9fba68dd0e1c66ff40cea3a1fe0415def579a \
@@ -925,12 +927,12 @@ pytest==9.1.1 \
     --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
     --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
     # via
-    #   -r .github/requirements/integration.in
+    #   -r integration.in
     #   pytest-cov
 pytest-cov==7.1.0 \
     --hash=sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2 \
     --hash=sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
@@ -1009,12 +1011,12 @@ pyyaml==6.0.3 \
     --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
     --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
     --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   -r .github/requirements/integration.in
+    #   -r integration.in
     #   azure-core
     #   boxsdk
     #   dropbox
@@ -1050,7 +1052,7 @@ six==1.17.0 \
 smbprotocol==1.17.0 \
     --hash=sha256:bcc27edfff7d727a7eb30424138766e1ee216ae2ffc1af03dab0448f29c4731c \
     --hash=sha256:bd1abff5417f5af83ca516a64ab8e5acece3dbdcf58d4e5e23e47f5165a77349
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 sspilib==0.6.0 ; sys_platform == 'win32' \
     --hash=sha256:03335e14f8563e350506b47a15887a99f08102a80cfb6bd715ad83ab1c2c89ae \
     --hash=sha256:0482631c67a57d8710ecbba3bbe49a9fb60e153dfcfee6d1f9b8a8ff6e419548 \
@@ -1089,7 +1091,7 @@ stone==3.5.5 \
 tqdm==4.70.1 \
     --hash=sha256:c293e525e6fef9c20e8728fd4612df02a0aa31bb5fe91ecd93e123b1b7bffa73 \
     --hash=sha256:cefd0eca11b2a37a3aee776544d4f4ae913f02688135b5556b8788dfa474afc4
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 typing-extensions==4.16.0 \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
     --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
@@ -1102,7 +1104,7 @@ typing-extensions==4.16.0 \
 tzdata==2026.5 \
     --hash=sha256:8cc73c0a0bfca7dbfa59235d60b2eff82231dee33f53d206db1acd9173cfc0a7 \
     --hash=sha256:b683bd1b6659ddcd810ff02ad09ba821d4bf1065072805063eb35c49617905ac
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 uritemplate==4.2.0 \
     --hash=sha256:480c2ed180878955863323eea31b0ede668795de182617fef9c6ca09e6ec9d0e \
     --hash=sha256:962201ba1c4edcab02e60f9a0d3821e82dfc5d2d6662a21abd533879bdb8a686
@@ -1145,8 +1147,8 @@ watchdog==6.0.0 \
     --hash=sha256:e6f0e77c9417e7cd62af82529b10563db3423625c5fce018430b249bf977f9e8 \
     --hash=sha256:e7631a77ffb1f7d2eefa4445ebbee491c720a5661ddf6df3498ebecae5ed375c \
     --hash=sha256:ef810fbf7b781a5a593894e4f439773830bdecb885e6880d957d5b9382a960d2
-    # via -r .github/requirements/integration.in
+    # via -r integration.in
 wheel==0.48.0 \
     --hash=sha256:3217dcc807155e45db462d7ef2431f5ddda0d7273b700d05a67b271ceb1287ab \
     --hash=sha256:94800765601e9171bf5d58d066e640662842bcedcbab982b2c90787a2c987322
-    # via -r .github/requirements/integration.in
+    # via -r integration.in

docs/updates/2026-10.md

@@ -761,3 +761,18 @@ Name the clock fixture explicitly and request its side effect through usefixture
 ## U-20261012-01 · 2026-10-12 · Preserve cross-platform integration dependencies during automated updates · #done #ci
 
 Keep tzdata unconditional in shared integration inputs so Linux-based dependency updates retain Windows timezone data. Add pip-tools configuration for Dependabot and local compilation to retain the hash-locked setuptools build backend. Regenerate the universal Python 3.12 lock with the seven-day release cutoff and add Linux, macOS and Windows compiler regressions. Validation: 37 workflow tests passed; the full local suite passed 5390 tests with 230 optional skips; Ruff lint and format checks passed; mypy reported no issues in 275 source files. Remote service jobs must install the editable package without fetching an unlocked backend.
+
+## U-20261022-01 · 2026-10-22 · Preserve complete dependency locks · #bugfix #deps #ci
+
+- PR #119: restored platform and Python compatibility markers, conditional dependencies, and explicit build tools removed during lock updates. Retained the requested dependency upgrades and their hashes.
+- Validation: tests/test_workflow_actions.py.
+
+## U-20261022-02 · 2026-10-22 · Preserve complete dependency locks · #bugfix #deps #ci
+
+- PR #121: restored platform and Python compatibility markers, conditional dependencies, and explicit build tools removed during lock updates. Retained the requested dependency upgrades and their hashes.
+- Validation: tests/test_workflow_actions.py.
+
+## U-20261022-03 · 2026-10-22 · Preserve complete dependency locks · #bugfix #deps #ci
+
+- PR #122: restored platform and Python compatibility markers, conditional dependencies, and explicit build tools removed during lock updates. Retained the requested dependency upgrades and their hashes.
+- Validation: tests/test_workflow_actions.py.

docs/updates/README.md

@@ -58,6 +58,9 @@ In the same commit: delete the item from `progress.md`, add a `#done` entry here
 
 | ID | Date | Title | Tags | Batch |
 |---|---|---|---|---|
+| U-20261022-03 | 2026-10-22 | Preserve complete dependency locks | #bugfix #deps #ci | [2026-10](2026-10.md) |
+| U-20261022-02 | 2026-10-22 | Preserve complete dependency locks | #bugfix #deps #ci | [2026-10](2026-10.md) |
+| U-20261022-01 | 2026-10-22 | Preserve complete dependency locks | #bugfix #deps #ci | [2026-10](2026-10.md) |
 | U-20261012-01 | 2026-10-12 | Preserve cross-platform integration dependencies during automated updates | #done #ci | [2026-10](2026-10.md) |
 | U-20261011-02 | 2026-10-11 | Keep circuit breaker clock fixtures lint clean | #done #ci | [2026-10](2026-10.md) |
 | U-20261011-01 | 2026-10-11 | Integrate open pull requests and stabilize circuit breaker tests | #ci #tests #dependencies | [2026-10](2026-10.md) |

requirements.txt

@@ -10,8 +10,8 @@ watchdog
 defusedxml>=0.7.1
 PyYAML>=6.0.3
 pyarrow>=25.0.1
-opentelemetry-api>=1.45.0
+opentelemetry-api>=1.45.1
 opentelemetry-sdk>=1.45.1
 msal>=1.39.0
 boxsdk>=10.17.1,<11
-tomli; python_version<"3.11"
+tomli; python_version<"3.11"