build(deps): Update tomli requirement from <3,>=2 to >=2.4.1,<3

[dependabot]

Updates the requirements on tomli to permit the latest version.

Changelog

Sourced from tomli's changelog.

2.4.1

• Fixed
  • Limit number of parts of a TOML key to address quadratic time complexity

2.4.0

• Added
  • TOML v1.1.0 compatibility
  • Binary wheels for Windows arm64

2.3.0

• Added
  • Binary wheels for Python 3.14 (also free-threaded)
• Performance
  • Reduced import time

2.2.1

• Fixed
  • Don't attempt to compile binary wheels for Python 3.8, 3.9 and 3.10 where cibuildwheel depends on a conflicting Tomli version

2.2.0

• Added
  • mypyc generated binary wheels for common platforms

2.1.0

• Deprecated
  • Instantiating TOMLDecodeError with free-form arguments. msg, doc and pos arguments should be given.
• Added
  • msg, doc, pos, lineno and colno attributes to TOMLDecodeError

2.0.2

• Removed
  • Python 3.7 support
• Improved
  • Make loads raise TypeError not AttributeError on bad input types that do not have the replace attribute. Improve error message when bytes is received.
• Type annotations
  • Type annotate load input as typing.IO[bytes] (previously typing.BinaryIO).

2.0.1

• Improved
  • Make bundling easier by using relative imports internally and adding license and copyright notice to source files.

... (truncated)

Commits

• c5f4469 Bump version: 2.4.0 → 2.4.1
• 2bcd262 Add change log for 2.4.1 and 2.3.1
• e1fdb94 Limit number of parts of a key (#286)
• c20c491 pre-commit autoupdate
• 920e20b Update performance benchmark and results
• 064e492 Merge pull request #280 from hukkin/version-2.4.0
• a678e6f Bump version: 2.3.0 → 2.4.0
• b8a1358 Tests: remove now needless "TOML compliance"->"burntsushi" format conversion
• 4979375 Update GitHub actions
• f890dd1 Update pre-commit hooks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[imran-siddique]

Closing this so a clean bump can be raised. The tomli floor itself is fine; the regenerated lockfiles are not, and the failure is not what the job names suggest.

test (3.11), test (3.12) and test (3.13) fail on ModuleNotFoundError: No module named 'agentrust_trace', while test (3.10) passes. That split is the tell. The resolve dropped agentrust-trace==0.10.0 out of requirements/test.txt altogether, and 3.10 passes only because the tests that need it were already skipped there.

The environment markers went with it. In requirements/release.txt and requirements/sbom.txt:

-tomli==2.4.1 ; python_full_version < '3.11'
+tomli==2.4.1

That is an unconditional install of a backport on interpreters that ship tomllib, which is a different change from the one this PR is titled after. Across the four files the diff removes 580 lines against 12 added, on a bump whose only intended content is one floor in requirements/test.in.

So this is a marker-loss and dependency-drop in the regeneration, not a bad tomli version. Worth stating plainly because this repository has no maintainer-hold gate, so unlike the rest of the org a red here is always a real verdict and never a policy check waiting on a human.

The fix is to regenerate with markers preserved, so tomli keeps python_full_version < '3.11' and agentrust-trace stays in requirements/test.txt with its own marker intact. Reopening from a fresh resolve is cleaner than rebasing this one, since the damage is in the generated files rather than in the base.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.