fix(deps): restore mypy <1.12 bound on the Python 3.9 types pin

[dorsha]

Related PRs

Related PRs

• Unblocks feat(mgmt): load external groups scoped to a specific SSO config #1641 (and every other open PR)

In a Nutshell

• Revert the 3.9 mypy pin from 2.3.0 back to the 1.11.x line
• Bounded range (>=1.11.2,<1.12) so renovate can't re-bump it

Description

Renovate #1569 bumped the python_version < '3.10' mypy pin in the types extra to 2.3.0, which requires Python 3.10+. That makes the Python 3.9 resolution split unsatisfiable, so uv sync --all-extras --locked fails for every CI job on main and on all open PRs. This mirrors the guard already used by the pytest entry in the same file: a bounded range with a comment explaining why the bound is required. Lock regenerated; full test suite passes (1042 passed).

Must

• Tests
• Documentation (if applicable)

🤖 Generated with Claude Code

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

Selected the reviewer who has contributed to both affected files to ensure proper review of the dependency pin update and its impact on configuration.

Reviewer	Reason
LioriE	LioriE has contributed to both 'pyproject.toml' and 'uv.lock', covering key configuration files affected by the dependency pin change, making them well-suited for review.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni's Review

Reverts the Python 3.9 mypy pin from ==2.3.0 (which needs 3.10+, making the 3.9 resolution split unsatisfiable) back to a bounded >=1.11.2,<1.12, mirroring the existing pytest<9 guard.

No issues sniffed out. Verified:

• pyproject.toml and uv.lock requires-dist specifiers now match, and the locked mypy 1.11.2 for python_full_version < '3.10' satisfies the new range — so uv sync --all-extras --locked resolves again on the 3.9 matrix legs.
• No stale mypy==2.3.0 references remain in the lock; the >=3.10 entry is untouched, so the 3.13 lint job still type-checks with mypy 2.x.
• 1.11.2 is the terminal 1.11.x release, so the range is effectively pinned while still blocking renovate re-bumps.

Good bones! Woof!

---

Declared coverage: FULL — 2/2 changed files reviewed.

[github-actions]

Coverage report

The coverage rate went from 98.26% to 98.27% ⬆️

None of the new lines are part of the tested code. Therefore, there is no coverage data about them.