fix(deps): widen boto3 pin and apply safe dependency updates across all uv lockfiles

[blarghmatey]

What are the relevant tickets?

N/A

Description (What does it do?)

• Fixes the blocker behind Renovate's boto3 PR (fix(deps): update dependency boto3 to ~=1.43.70 - autoclosed #2368): packages/ol-orchestrate-lib pinned boto3 ~=1.42.0. Every dg_projects/* code location depends on ol-orchestrate-lib via a local path dependency, so that pin transitively capped boto3 everywhere and made the lockfile unresolvable once boto3 published 1.43.x. Widened to ~=1.43.0.
• Applies safe patch/minor dependency bumps across all 13 uv lockfiles in this repo (the root workspace, all 9 dg_projects/*, dg_deployments/local, src/ol_superset, and src/ol_dlt — each is its own standalone uv project with its own uv.lock): boto3/botocore/aiobotocore/s3transfer, sqlalchemy, pyarrow, sentry-sdk, dbt-core/dbt-common, sqlglot, dlt, gcsfs, greenlet, platformdirs, charset-normalizer, typing-inspection, uvicorn, and others, each moved to the newest version its project's own dependency graph already permits (uv lock --upgrade-package, not a blanket --upgrade).
• Deliberately left untouched: protobuf and grpcio-health-checking. dagster itself requires protobuf<7 (confirmed via uv tree --invert --package protobuf), so the 6→7 major bump is blocked upstream, not just by this repo's own pin. grpcio-health-checking>=1.82.0 ships a health_pb2.py pre-generated against protobuf 7.35 gencode, which crashes on import under that protobuf<7 ceiling — the existing override-dependencies pin in every pyproject.toml stays in place.
• No pyproject.toml files needed edits beyond the one boto3 pin — every other change is lockfile-only.

How can this be tested?

Every one of the 13 projects was synced and verified independently:

• uv sync --frozen succeeded with no resolution errors in all 13 lockfiles.
• Every project with a pytest suite passed with the new lockfile: root workspace (packages/ol-orchestrate-lib 117 passed, src/ol_dbt_cli 412 passed), dg_projects/data_loading (18 passed), dg_projects/data_platform (42 passed), dg_projects/edxorg (32 passed), dg_projects/lakehouse (50 passed), dg_projects/openedx (25 passed), src/ol_superset (121 passed), src/ol_dlt (87 passed) — zero failures anywhere.
• The remaining projects (dg_projects/b2b_organization, canvas, learning_resources, legacy_openedx, student_risk_probability, dg_deployments/local) have no pytest suite yet (per CI's own dynamic test-discovery script), so only a clean uv sync --frozen was verified for those.
• pre-commit run passes on the full diff (all 15 changed files).
• Reviewers can reproduce locally with uv sync --all-groups --all-packages --frozen at the root, and cd <project-dir> && uv sync --frozen && uv run pytest for any standalone project.

Additional Context

• There are 3 open Renovate PRs related to this area: fix(deps): update dependency boto3 to ~=1.43.70 - autoclosed #2368 (boto3) is superseded by this PR and can be closed once this merges. chore(deps): update superset-sup digest to e35d2bd #2278 (superset-sup digest bump) was investigated separately and found to resolve to a commit that's actually an ancestor of the currently pinned commit — it would silently drop the OIDC auth code added on the self_hosted_superset_oidc branch (src/ol_superset/ol_superset/lib/superset_api.py's preset_cli.auth.oauth_interactive import would break). Recommend closing chore(deps): update superset-sup digest to e35d2bd #2278 as invalid rather than merging, and following up on why Renovate mis-resolved that branch-pinned git ref. chore(deps): update python #1930 (python version bump) is unrelated and already green — can be merged independently.

[Copilot]

Pull request overview

Updates shared dependency constraints and lockfiles to support boto3 1.43 across the data platform.

Changes:

• Moves ol-orchestrate-lib to boto3 ~=1.43.0.
• Refreshes 14 independent uv lockfiles with compatible dependency updates.
• Preserves protobuf and gRPC compatibility constraints.

Reviewed changes

Copilot reviewed 1 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/ol-orchestrate-lib/pyproject.toml	Updates the shared boto3 constraint.
uv.lock	Refreshes root workspace dependencies.
dg_deployments/local/uv.lock	Refreshes local deployment dependencies.
src/ol_dlt/uv.lock	Refreshes DLT dependencies.
src/ol_superset/uv.lock	Refreshes Superset dependencies.
dg_projects/b2b_organization/uv.lock	Refreshes B2B organization dependencies.
dg_projects/canvas/uv.lock	Refreshes Canvas dependencies.
dg_projects/data_loading/uv.lock	Refreshes data-loading dependencies.
dg_projects/data_platform/uv.lock	Refreshes data-platform dependencies.
dg_projects/edxorg/uv.lock	Refreshes edX.org dependencies.
dg_projects/lakehouse/uv.lock	Refreshes lakehouse dependencies.
dg_projects/learning_resources/uv.lock	Refreshes learning-resources dependencies.
dg_projects/legacy_openedx/uv.lock	Refreshes legacy Open edX dependencies.
dg_projects/openedx/uv.lock	Refreshes Open edX dependencies.
dg_projects/student_risk_probability/uv.lock	Refreshes student-risk dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.