deps: Bump the python-minor-and-patch group with 2 updates

[dependabot]

Bumps the python-minor-and-patch group with 2 updates: vgi-rpc and granian.

Updates vgi-rpc from 0.40.0 to 0.42.0

Release notes

Sourced from vgi-rpc's releases.

v0.42.0

The huge-payload conformance test is required, and reads are clamped too.

fix(transport): the read side of the >2 GiB syscall problem. v0.41.0 fixed the writers and said the readers were already hardened — they were hardened against a short read, not against an over-sized read request, and recv_into refuses a buffer above INT_MAX with EINVAL exactly as send does. Because BufferedReader only bypasses its buffer for large requests, whether any one read crossed the line depended on buffer state, so this destroyed roughly one Unix-socket connection in two while the rest passed — and the serve loop logged it at DEBUG and kept accepting. Anyone running the reference over Unix or TCP with multi-gigabyte batches wants this.

test(conformance): VGI_RPC_CONFORMANCE_HUGE is gone; large_payload.echo_binary_over_int32_max now runs by default. Ports may answer it two ways — echo the payload back intact, or refuse it with a typed error that leaves the connection usable (the test proves this with a follow-up call, and annotates the pass with a note:). The second answer exists because the JVM caps a byte[] at INT_MAX elements, so a Java worker cannot materialise 2³¹+1 bytes at any heap size. Silent truncation and deadlock remain failures for every implementation.

The gate is why the read bug survived: the test that exposes it was written a day earlier, was opt-in, and therefore never ran.

--filter gained !pattern exclusion — an exclusion always wins, and a filter made only of exclusions means "everything except these".

v0.41.0

Large payloads are written in full, and the ports are held to it.

An unbuffered transport writer maps write() onto a single write(2) / send(2). Above INT_MAX on macOS that syscall either returns a short count of exactly INT_MAX with no error (pipes) or fails outright with EINVAL (unix and TCP sockets), so a >2 GiB Arrow IPC body was silently truncated and the peer then blocked forever waiting for bytes the message header had promised — a deadlock, not an exception. All seven unbuffered writers now loop on the returned count and clamp each call to 1 GiB.

Adds the large_payload conformance category so ports are held to the same rule: echo_binary_4mib always runs and catches a writer that never loops; echo_binary_over_int32_max crosses INT_MAX and is opt-in via VGI_RPC_CONFORMANCE_HUGE=1. Conformance tests may now declare a per-test timeout.

v0.40.1 — every dependency current, pyarrow aligned with vgi-python

No shipped code changes. This is the version marker for e2ae9d8, which ran uv lock --upgrade across the tree and landed a superset of Dependabot #34 and #35 — 38 package moves, with nothing outdated left afterwards.

pyarrow 24.0.0 → 25.0.0

The one that mattered. vgi-python had already moved to 25, so this package's tests were exercising a different major of the library the whole protocol sits on than any vgi-python user actually runs. Both repos now resolve the same Arrow. Suite passes unchanged at 4042.

No security content

Zero open Dependabot alerts on this repo, and the advisories that drove vgi-python's dependency pass were already satisfied here — cryptography 50.0.0, aiohttp 3.14.3.

ty capped at <0.0.64

Pinned rather than upgraded. At 0.0.66 ty check stopped terminating — ten minutes locally, and in CI it hung until the step was cancelled, which continue-on-error does not rescue, so a check that gates nothing turned the whole Lint job red. The cap is what stops the next routine uv lock --upgrade from silently walking back into it. Lift once upstream terminates again.

Commits

• cfcb329 fix(transport): type the clamped raw as what it is, and handle a None read
• f63bc4b release: 0.42.0 — the huge-payload test is required, and reads are clamped too
• a75fddc test(conformance): require the huge payload, and let a port refuse it honestly
• 28ef98e fix(transport): clamp reads too, and stop losing one socket connection in two
• f375c56 release: 0.41.0 — large payloads are written in full, and the ports are held ...
• 2ca4c0a fix: write large payloads in full, and hold other languages to it
• c8bb1d1 release: 0.40.1 — every dependency current, pyarrow aligned with vgi-python
• e2ae9d8 deps: bring every dependency current, and cap ty below the hang
• See full diff in compare view

Updates granian from 2.8.0 to 2.8.1

Release notes

Sourced from granian's releases.

Granian 2.8.1

Patch release

Changes since 2.8.0:

• Fix a performance regression on ASGI websockets
• Fix PyFutureAwaitable Python interface
• Enhance RSGI ws transport close strategy
• Relax several atomic operations ordering

Commits

• 9a20b17 Update benchmarks
• a69a189 Update benchmarks suite
• ba538c2 Review atomic::Ordering usage
• a5e6b07 Enhance RSGI ws transport locking/closing strategy
• 5a914eb Address perf regression on ASGI websockets
• fd75a79 Fix PyFutureAwaitable Python interface
• 3f94262 Bump version to 2.8.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.