chore: resolve open dependabot security alerts

providers/openfeature-provider-flagd/pyproject.toml

@@ -19,8 +19,8 @@ keywords = []
 dependencies = [
   "openfeature-sdk>=0.8.2",
   "openfeature-flagd-core>=1.0.0,<2",
-  "grpcio>=1.81.0",
-  "protobuf>=7.0.0,<8.0.0",
+  "grpcio>=1.82.1",
+  "protobuf>=7.35.1,<8.0.0",
   "pyyaml>=6.0.1",
   "cachebox>=5.1.0,<6.0.0",
 ]
@@ -33,7 +33,7 @@ Homepage = "https://github.com/open-feature/python-sdk-contrib"
 dev = [
   "asserts>=0.14.0,<0.15.0",
   "coverage[toml]>=7.10.0,<8.0.0",
-  "grpcio-health-checking>=1.82.0,<2.0.0",
+  "grpcio-health-checking>=1.82.1,<2.0.0",
   "mypy>=1.18.0,<2.0.0",
   "poethepoet>=0.37.0",
   "pytest>=9.0.0,<10.0.0",
@@ -47,9 +47,12 @@ dev = [
 [tool.hatch.build.hooks.protobuf]
 generate_pyi = false
 dependencies = [
-    "protobuf~=6.0",
+    # grpcio-tools >=1.82 requires protobuf>=7.35.1,<8.0.0
+    "protobuf>=7.35.1,<8.0.0",
     "hatch-protobuf",
     "mypy-protobuf~=3.0",
+    # Pin grpcio-tools to the same version as the runtime `grpcio` floor
+    "grpcio-tools==1.82.1",
 ]
 proto_paths = [
   ".",

renovate.json

@@ -9,5 +9,17 @@
   },
   "lockFileMaintenance": {
     "enabled": true
-  }
+  },
+  "packageRules": [
+    {
+      "description": "Keep grpcio runtime, grpcio-tools build pin, and grpc extras in lockstep so generated stubs stay compatible with the runtime grpcio floor",
+      "matchPackageNames": [
+        "grpcio",
+        "grpcio-tools",
+        "grpcio-health-checking",
+        "types-grpcio"
+      ],
+      "groupName": "grpc packages"
+    }
+  ]
 }