gatelock + crdt-sync: exact-pin every Python dependency

Sixteen `>=` floors become exact pins across the two Python packages, taking
five majors with them: mypy 1.13 -> 2.3.1, pylint 3.3 -> 4.0.7, pytest 8 -> 9,
pytest-cov 5 -> 7, bandit 1.7 -> 1.9.4, plus ruff 0.15 -> 0.16.5 and
requests/types-requests. A `>=` floor is satisfied by everything newer, so it
told a checker nothing about whether these repos were actually current.

Verified in a clean venv per repo, which is what both CI workflows do
(`pip install -r requirements.txt`): gatelock 389 tests at 100% coverage under
xvfb, crdt-sync 432 tests at 100%. No test change was needed for any of the
five majors.

**Open, and deliberately not in this commit:** `.pre-commit-config.yaml` pins
these same tools AGAIN via `rev:` (ruff v0.15.2, mypy v1.13.0, pylint v3.3.2),
independently of requirements.txt, and the gate does not read `rev:` pins at
all -- so the linters CI actually runs are still on the old majors. Bumping
them is a separate and much larger job: ruff 0.16 raises 71 findings here
(CPY001 alone accounts for many, since this repo selects ALL) and mypy 2.x
raises 60, mostly stricter implicit-re-export rules. One major per commit, and
that is several.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK

crdt-sync/pyproject.toml

@@ -3,7 +3,7 @@ name = "crdt-sync"
 version = "0.9.0"
 description = "Shared CRDT merge scheme + GitHub-Contents-API sync transport for cross-device apps"
 requires-python = ">=3.10"
-dependencies = ["requests"]
+dependencies = ["requests==2.34.2"]
 
 # Ship only the library. `tool/` is a package too (it has an __init__.py so
 # its scripts import cleanly), and setuptools' flat-layout auto-discovery

crdt-sync/requirements.txt

@@ -1,9 +1,12 @@
-bandit[toml]>=1.7
-mypy>=1.13
-pre-commit>=4.0
-pylint>=3.3
-pytest>=8.0
-pytest-cov>=5.0
-requests>=2.31
-ruff>=0.15
-types-requests>=2.31
+# Exact pins, enforced by the shared dependency-freshness gate: a `>=`
+# floor is satisfied by anything newer, so it tells a checker nothing
+# about whether this repo is actually current.
+bandit[toml]==1.9.4
+mypy==2.3.1
+pre-commit==4.6.2
+pylint==4.0.7
+pytest==9.1.1
+pytest-cov==7.1.0
+requests==2.34.2
+ruff==0.16.5
+types-requests==2.33.0.20260712

gatelock/pyproject.toml

@@ -15,7 +15,7 @@ dependencies = []  # pure stdlib — tkinter is bundled with Python
 # promptly — so this must stay OPTIONAL: a locker that refuses to start
 # because a dependency is missing is itself a way to end up unlocked.
 # Consumers' install scripts install it unconditionally all the same.
-randr = ["python-xlib>=0.33"]
+randr = ["python-xlib==0.33"]
 
 [tool.setuptools.packages.find]
 include = ["gatelock*"]

gatelock/requirements.txt

@@ -1,7 +1,10 @@
-bandit[toml]>=1.7
-mypy>=1.13
-pre-commit>=4.0
-pylint>=3.3
-pytest>=8.0
-pytest-cov>=5.0
-ruff>=0.15
+# Exact pins, enforced by the shared dependency-freshness gate: a `>=`
+# floor is satisfied by anything newer, so it tells a checker nothing
+# about whether this repo is actually current.
+bandit[toml]==1.9.4
+mypy==2.3.1
+pre-commit==4.6.2
+pylint==4.0.7
+pytest==9.1.1
+pytest-cov==7.1.0
+ruff==0.16.5