fix(deps): update dependency scim2-models to >=0.10.3,<0.11 - #832

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml

Artifact update for scim2-models resolved to version 0.10.6, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 0.10.3
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

Closing: scim2-models stays on the 0.6 line until after GA. pyproject.toml holds it there on purpose (#743: its next releases change behaviour the engine relies on), GA is not cut (DFE 2.2.1 is still a pre-release), and this PR shows the reason.

Moving to 0.10.6 fails tests/unit/test_api/test_group_crud.py::TestScimLeavesAndProviderIdsNeedTheGroupsRoles::test_a_patch_cannot_remove_a_member_of_the_admin_group[value] (test_group_crud.py:597 and :601). Reproduced locally: 1 failed, 8 passed. CI run 38339567861 shows the same one failure in 12274 passed. Since scim2-models 0.8.0 a PATCH remove that carries a value is refused with 400 invalidValue ('a remove operation carries no value, a filter in the path selects what to remove'). src/dfe_engine/api/v1/scim.py:639 validates group PATCH bodies through PatchOp[ScimGroup], and _patched_members (scim.py:760) reads that value on purpose. scim2-models documents that form as what Microsoft Entra sends, so after this bump an Entra member removal would be a 400 and the member would stay in the group.

The code change is small: scim_policy=ScimPolicy(remove_value_as_filter=ScimPolicy.RemoveValue.apply) on the call at scim.py:639. Tried on this branch and not pushed: tests/unit/test_api/test_group_crud.py and test_scim.py then pass, 243 tests. Not done: reading the rest of the 0.7 to 0.12 changelog against the admin-group guard. Attribute names match case-insensitively only (0.8.0), a PATCH add on an unmatched filter is noTarget (0.9.0), strings compare under PRECIS (0.12.0).

Latest is 0.12.2 (2026-10-09), so the post-GA bump should start there, not at 0.10.6. The renovate/artifacts failure on this PR is Renovate noting uv resolved 0.10.6 where it had asked for 0.10.3, and does not bear on the decision.

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (>=0.10.3,<0.11). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.