Dependency refresh

[hakandilek]

Summary

• Refresh poetry.lock with the latest transitive dependency resolutions.
• Add .DS_Store to .gitignore.

No pyproject.toml, workflow, or tox.toml changes: a full audit found every top-level Python dependency and every GitHub Action already pinned to its latest version, so there was nothing to bump.

Dependency audit (whole repo)

• pyproject.toml runtime + dev deps: all already at latest.
• GitHub Actions: all at latest major: checkout@v7, setup-python@v6, upload-artifact@v7, download-artifact@v8, git-auto-commit-action@v7, and gh-action-pypi-publish@release/v1 (resolves to v1.14.0).
• tox.toml: lower-bound floors left unchanged as intentional minimums.
• cachebox stays at 5.2.3 because it is capped by deepdiff <6.
• Python 3.15 intentionally excluded because it is still beta (3.15.0b3).
• Ignored generated artifacts (sbom/, dist/, output/) are not in scope.

Verification

Ran the checks from .github/workflows/build-and-test.yml before each commit:

• poetry install --no-root
• poetry build on Python 3.10, 3.11, 3.12, 3.13, and 3.14
• poetry run tox run -e 3.10
• poetry run tox run -e 3.11
• poetry run tox run -e 3.12
• poetry run tox run -e 3.13
• poetry run tox run -e 3.14
• poetry run tox run -e lint,type
• poetry check --lock

All checks passed.