chore(deps): bump python-minor-patch group across the workspace

CHANGELOG.md

@@ -16,6 +16,10 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `pyarrow` is pinned at `26.0.0` (was `25.0.1`) in the runtime, the engine
   contract's `testing` extra and the three adapters, so they keep resolving
   together.
+- Dependency pins move together across the workspace: `ruff` 0.17.1, `mypy`
+  2.4.0, `boto3` 1.43.114, `sqlglot` 30.23.0 (runtime and engine contract),
+  `trino` 0.340.0 and `psycopg2-binary` 2.9.13. `urllib3` moves to 2.8.0 in
+  `uv.lock` (CVE-2026-97687, CVE-2026-97689).
 
 ## [0.10.0] - 2026-10-22
 

adapters/duckdb/pyproject.toml

@@ -25,16 +25,16 @@ duckdb = "continuo_duckdb_adapter.adapter:DuckDBAdapter"
 
 [dependency-groups]
 dev = [
-    "ruff==0.16.5",
-    "mypy==2.3.1",
+    "ruff==0.17.1",
+    "mypy==2.4.0",
 ]
 test = [
     "pytest==9.1.1",
     "pytest-cov==7.1.0",
     # Integration tests read the DuckLake catalog (postgres) and the data
     # files (MinIO) directly to prove layout was really applied.
-    "psycopg2-binary==2.9.12",
-    "boto3==1.43.85",
+    "psycopg2-binary==2.9.13",
+    "boto3==1.43.114",
 ]
 
 [build-system]

adapters/postgres/pyproject.toml

@@ -13,7 +13,7 @@ dependencies = [
     # newest. This adapter subclasses the contract's WarehouseAdapter port
     # directly, so the pair must stay the tested one.
     "continuo-engine-contract==0.8.1",
-    "psycopg2-binary==2.9.12",
+    "psycopg2-binary==2.9.13",
     "pyarrow==26.0.0",
 ]
 classifiers = [
@@ -27,8 +27,8 @@ postgres = "continuo_postgres_adapter.adapter:PostgresAdapter"
 
 [dependency-groups]
 dev = [
-    "ruff==0.16.5",
-    "mypy==2.3.1",
+    "ruff==0.17.1",
+    "mypy==2.4.0",
 ]
 test = [
     "pytest==9.1.1",

adapters/trino/pyproject.toml

@@ -13,7 +13,7 @@ dependencies = [
     # newest. This adapter subclasses the contract's WarehouseAdapter port
     # directly, so the pair must stay the tested one.
     "continuo-engine-contract==0.8.1",
-    "trino==0.339.0",
+    "trino==0.340.0",
     "pyarrow==26.0.0",
 ]
 classifiers = [
@@ -27,8 +27,8 @@ trino = "continuo_trino_adapter.adapter:TrinoAdapter"
 
 [dependency-groups]
 dev = [
-    "ruff==0.16.5",
-    "mypy==2.3.1",
+    "ruff==0.17.1",
+    "mypy==2.4.0",
 ]
 test = [
     "pytest==9.1.1",

contract/pyproject.toml

@@ -7,7 +7,7 @@ readme = "README.md"
 requires-python = ">= 3.14"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
-dependencies = ["sqlglot==30.17.0"]
+dependencies = ["sqlglot==30.23.0"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Programming Language :: Python :: 3.14",

pyproject.toml

@@ -20,11 +20,11 @@ dependencies = [
     # contract version never exists without a new runtime version to match it;
     # an exact pin therefore costs nothing and keeps the tested pair together.
     "continuo-engine-contract==0.8.1",
-    "boto3==1.43.85",
+    "boto3==1.43.114",
     "pyarrow==26.0.0",
     "PyYAML==6.0.3",
     # Pinned in lockstep with continuo-engine-contract's OWN sqlglot pin
-    # (currently ==30.17.0) -- bump this whenever that pin moves.
+    # (currently ==30.23.0) -- bump this whenever that pin moves.
     # continuo_python_runtime/contract/loader.py imports sqlglot.errors
     # directly to catch TokenError, which escapes
     # continuo_engine_contract.sql.ensure_single_read uncaught despite
@@ -33,7 +33,7 @@ dependencies = [
     # parser's own ParseError handling ever runs). Once that contract bug is
     # fixed upstream, this direct import -- and this explicit pin, since
     # sqlglot would then again be needed only transitively -- can be dropped.
-    "sqlglot==30.17.0",
+    "sqlglot==30.23.0",
 ]
 classifiers = [
     "Development Status :: 4 - Beta",
@@ -45,7 +45,7 @@ classifiers = [
 continuo-runtime = "continuo_python_runtime.cli:main"
 
 [dependency-groups]
-dev = ["ruff==0.16.5", "mypy==2.3.1", "types-PyYAML==6.0.12.20250915"]
+dev = ["ruff==0.17.1", "mypy==2.4.0", "types-PyYAML==6.0.12.20250915"]
 test = ["pytest==9.1.1", "pytest-cov==7.1.0"]
 
 [build-system]

tests/test_rehearsal_version.py

@@ -69,7 +69,7 @@ def test_image_requirements_follow_the_package_versions(tree):
 def test_third_party_pins_are_untouched(tree):
     rehearsal.apply(tree, ".dev1201")
     text = (tree / "pyproject.toml").read_text()
-    assert '"boto3==' in text and "boto3==1.43.85" in text
+    assert '"boto3==' in text and "boto3==1.43.114" in text
 
 
 def test_the_rewritten_tree_still_passes_the_consistency_guards(tree):