Update clients/py dependencies (h2, construct-typing, pydantic-core, httpcore2, httpx2) and relax pins

[clankmaxxing-clod]

Updates the Python client's dependencies to the newest usable versions and relaxes the exact-pin lock to minimum-version constraints.

Requested package bumps

package	before	after	notes
h2	4.4.0	4.4.1	newest
construct-typing	0.7.0	0.8.1	newest
httpcore2	2.7.0	2.12.0	newest (pinned exactly by httpx2)
httpx2	2.7.0	2.12.0	newest
pydantic-core	2.46.4	2.46.5	newest installable — see below

Why pydantic-core is 2.46.5, not the newest 2.48.0

pydantic pins pydantic-core exactly. The newest pydantic (2.13.5) requires pydantic-core==2.46.5, and no released pydantic targets 2.48.0, so 2.48.0 cannot be installed alongside pydantic. 2.46.5 is the newest version that actually resolves.

Cascading changes

solana is the root of this dependency tree, and construct-typing 0.8.1 is only allowed by solana >= 0.40.2 (solana 0.40.1 caps construct-typing < 0.8.0), which in turn requires solders >= 0.28. construct-typing 0.8.1 also adds an arrow dependency. So:

• solana 0.40.1 → 0.40.3, solders 0.27.1 → 0.29.0, pydantic 2.13.4 → 2.13.5
• added transitive deps: arrow, python-dateutil, six, tzdata
• resolver-bumped: idna 3.18 → 3.19, typing-inspection 0.4.3 → 0.4.4, websockets 17.0.1 → 17.1
• optional-requirements.txt: mypy 2.3.0 → 2.3.1 (others already newest)

Relaxed pins (== → >=)

Every dependency here transitively roots at solana, so relaxing only a few packages while pinning the rest would be fragile (a future httpx2 could require an httpcore2/h11/anyio newer than a leftover == pin and break pip install). To relax consistently and without self-conflict, the exact-pin lock is converted to minimum bounds (>=) at the newest resolved versions. pip install -r still resolves to the newest set today; the file simply no longer freezes them. If you prefer a strict reproducible lock, re-pinning with pip freeze is trivial — happy to switch it back.

Verification

• pip install -r requirements.txt && pip install -r optional-requirements.txt — resolves cleanly to the newest set.
• flake8 --exclude venv — clean.
• mypy --exclude venv . — Success: no issues found in 32 source files (type-checks the client against the new library versions).
• pytest --collect-only — all 14 tests / modules import cleanly under the bumped deps.
• The full pytest integration suite requires a local solana-test-validator; it could not be exercised in this environment because the Agave test validator requires io_uring, which the sandbox blocks (assertion failed: io_uring_supported()) — unrelated to this dependency change (deps are client-side; the validator is a separate binary).

🤖 Generated with Claude Code