[Randy808]

Summary

Updates all Python dependencies and switches local and CI installs to hash-pinned lock files.

Main dependency bumps

• FastAPI 0.139.0 → 0.162.0
• Starlette 1.3.1 → 1.10.0
• SQLAlchemy 2.0 → 2.1.6
• Pillow 12.3 → 13.0.0
• Pydantic 2.13.4 → 2.14.1, pydantic-settings 2.14.2 → 2.16.1
• Alembic 1.20.1, psycopg 3.3.6, uvicorn 0.54.0, wallycore 1.5.6
• schemathesis 4.22.4 → 4.32.5 (dev)
• Remote signer example: FastAPI 0.115.6 → 0.162.0, uvicorn 0.34.0 → 0.54.0, cryptography 44.0.0 → 50.0.2

API spec change

The new FastAPI version generates the discriminated action unions (issuer actions, admin lifecycle actions, and asset-scoped admin actions) as oneOf with an operation discriminator mapping instead of anyOf. This matches the existing Field(discriminator="operation") declarations; request validation is unchanged. openapi.yaml and sdk/src/generated/openapi.d.ts are regenerated, so the SDK's action types now carry discriminator enums.

Added httpx2 (dev)

Starlette 1.10 deprecates using httpx w and uses httpx2 when it's installed.httpx2 is added to the dev extra so TestClient stops emitting StarletteDeprecationWarning. The service still uses httpx at runtime.

Hash-pinned installs

• New requirements-dev.txt: hash-pinned lock of the production pins plus dev tools, built against
  requirements.txt.
• CI and CONTRIBUTING.md now install with pip install --require-hashes -r requirements-dev.txt followed by pip install --no-deps -e ..
• The root locks are resolved for Python er and CI); CONTRIBUTING.md now says touse 3.12 for local development.
• Remote signer example: its requirements are split into requirements.in/requirements.txt (runtime, used
  by the image) and requirements-dev.in/s pytest, pytest-asyncio, httpx), so testpackages no longer ship in the runtime image. The Dockerfile now installs with --require-hashes`.

Testing

• pytest on Python 3.12 with the new dev lock: 317 passed, 97 skipped (Postgres-backed tests skipped locally), no deprecation warnings with -W error::DeprecationWarning
• scripts/generate_openapi.py --check aass
• Remote signer: 22 tests pass using the dev lock; the runtime lock installs and imports the app without test packages

requirements-dev.txt includes the production pins plus the development tools,
with hashes for every dependency. has its own
sdk/examples/remote-signer/requirements.in; regenerate its lock with:
runtime inputs in sdk/examples/rin, used by its
container image, and test inputs in requirements-dev.in. Regenerate both locks
with:

uv pip compile sdk/examples/remote-signer/requirements.in \
  --python-platform x86_64-manyli --python-version 3.11 \
  --upgrade --output-file sdk/examples/remote-signer/requirements.txt
uv pip compile sdk/examples/remote-signer/requirements-dev.in \
  --constraint sdk/examples/remot\
  --python-platform x86_64-manylinux_2_28 --generate-hashes --python-version 3.11 \
  --upgrade --output-file sdk/examples/remote-signer/requirements-dev.txt

[jtrivinop]

Thanks for updating deps and addressing suggestions. tACK