Update anyio to 4.14.2 in the development lock file

[jackaldenryan]

Summary

This PR fixes Dependabot alerts #122 (medium) and #123 (critical) for anyio in poetry.lock.

The fix is in anyio 4.14.2, which requires Python 3.10 or later. The SDK supports Python 3.9. Because of this, poetry update anyio keeps anyio 4.12.1 in the lock file.

• pyproject.toml: A dev dependency, anyio = { version = "^4.14.2", python = ">=3.10,<4.0" }, is added. This change uses the same pattern as pytest in Fix Dependabot alerts for idna and pytest [ZEPAI-3570] #353.
• poetry.lock: The only package change is anyio 4.12.1 to 4.14.2.
• .github/workflows/ci.yml: The compile job uses Python 3.10. The new lock file does not install on Python 3.9. The test job already uses Python 3.10.

The runtime dependencies do not change. The published package does not include poetry.lock, so customers do not see a change. The runtime requirement stays python = ">=3.9.0,<4.0".

Local development and CI can no longer use Python 3.9.

On Python 3.10, these checks pass:

• poetry lock --check
• poetry run mypy src/ --exclude tests
• poetry run pytest . (28 passed, 1 skipped)

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​anyio@​4.12.1 ⏵ 4.14.2		+75

View full report