[jtroup]

ENG-9447

what

Raise four dependency caps in pyproject.toml and compile the
requirements files again:

• Pillow 11.3.0 to 13.0.0, cryptography 46.0.5 to 50.0.2 and msgpack
  1.0.8 to 1.2.3, with the floors and caps from upstream master.
  requirements/base.in takes the upstream cryptography line.
• pyopenssl moves from 26.2.0 to 26.4.0 with cryptography 50.
• pyarrow 16.1.0 to 23.0.1, below upstream's 26.0.0. A comment on the
  cap gives the reason, and upstream's test_uuid_column_is_stringified
  from 543ad04 guards it.

why

These releases carry upstream fixes, and the caps blocked them.

pyarrow stops at 23.0.1 for two reasons:

• pyarrow 26 does not import with NumPy 1.x, and its package metadata
  does not declare this. Upstream moved to NumPy 2.4 and pandas 2.3
  first, with code changes.
• From 24.0.0, pyarrow infers Python uuid.UUID values as an Arrow
  extension type. Postgres uuid columns then reach the results as
  raw bytes. Upstream fixed this in 543ad04. pyarrow 23.0.1 still
  rejects these values, so our stringify fallback applies and no code
  change is needed. The backported test passes on 23.0.1 and fails on
  24.0.0 without upstream's helper.

testing

The unit suite passes against these pins, except the test_mysql
tests, which need mysqlclient and I could not build it locally. In
the built image, pyarrow 23.0.1 imports with NumPy 1.26.4 and rejects
uuid.UUID values. The Stacklet platform functional suite passes
against a local amd64 build of this branch.

docs

No docs needed.

---

🤖 Generated with Claude Code