SCANPY-245 Fix strict dependencies pinning of pysonar

[guillaume-dequenne]

No description provided.

[hashicorp-vault-sonar-prod]

SCANPY-245

[sonar-review-alpha]

Summary

This PR loosens the overly strict dependency version pinning in pysonar by replacing exact version constraints with semantic versioning ranges. Changes include: updating main dependencies from pinned versions (e.g., tomli = '2.2.1') to ranges (e.g., tomli = '>=2.0,<3'), reorganizing dependencies by moving test tools (responses, pyfakefs) to dev dependencies, updating the JFrog server source reference from 'jfrog-server' to 'repox', and regenerating poetry.lock with Poetry 2.3.3. This aligns with Python packaging best practices and allows patch and minor version updates to be installed while maintaining compatibility.

What reviewers should know

The core change is in pyproject.toml (lines 31-36): three main dependencies shift from exact pinning to version ranges, and two dev-only packages move out of main dependencies. The poetry.lock file (~852 lines changed) is automatically regenerated to reflect these changes—reviewers should focus on verifying the pyproject.toml logic rather than the lock file details. Note the JFrog source rename from 'jfrog-server' to 'repox' (line 61)—ensure this aligns with infrastructure expectations.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

Conclusion: The dependency changes are correct in intent — loosening pins for runtime deps and moving test libraries to dev. One question needs clarification before approving.

🗣️ Give feedback

[sonar-review-alpha]

The lock file was generated with Poetry 2.1.1, but the previous lock file was generated with 2.3.2. This is a downgrade. The mise toolchain in this repo pins specific tool versions — was this intentional? If CI or other developers run a different Poetry version (2.3.x), they may get a different lock file on next poetry lock, causing churn. Please confirm this matches the Poetry version pinned in .mise.toml / .tool-versions.

• Mark as noise

[sonarqube-next]

Quality Gate passed for 'Python Scanner'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[joke1196]

LGTM! Do you need to add pygments 2.19, was version 2.20 not available?

[sonar-review-alpha]

LGTM! ✅

The Poetry version mismatch flagged in the previous review is still present, just with different version numbers. mise.toml pins pipx:poetry = "2.2.1" but the lock file was regenerated with Poetry 2.3.3. Developers using mise will get Poetry 2.2.1, which may produce a different lock file on next poetry lock or poetry install --sync, causing churn. Please either update mise.toml to 2.3.3, or regenerate the lock with 2.2.1.

🗣️ Give feedback