build: improve security around package updating

.mise.toml

@@ -1,4 +1,4 @@
 [tools]
 python="3.12"
-poetry="2.3.3"
+poetry="2.4.1"
 java="liberica-1.8.0"

CONTRIBUTE.md

@@ -58,7 +58,7 @@ poetry install --with lint
 
 ## Installation for Development
 
-We are utilising Poetry for build dependency management and packaging. If you're on a system that has `Make` available, you can simply run `make install` to setup a local virtual environment with all the dependencies installed (this won't install Poetry for you).
+We are utilising Poetry for build dependency management and packaging. To install simply run `poetry install`. If you need to update any of the dependencies then you will need to run `poetry lock` before the install command. **Please always review the contents of the lock before installing. We have a `min-release-age` of `10` which means that packages will not be updated until they have been released for at least 10 days.
 
 ## Testing
 

Makefile

@@ -1,10 +1,5 @@
 activate = poetry run
 
-# dev
-install:
-	poetry lock
-	poetry install --with dev
-
 # dist
 wheel:
 	poetry build -f wheel

poetry.toml

@@ -1,5 +1,8 @@
 [experimental]
 new-installer = false
 
+[solver]
+min-release-age = 10
+
 [virtualenvs]
 in-project = true

pyproject.toml

@@ -31,8 +31,8 @@ packages = [
 
 [tool.poetry.dependencies]
 python = ">=3.10,<3.13"  # breaking changes beyond 3.12
-boto3 = ">=1.34.162,<1.36"  # breaking change beyond 1.36
-botocore = ">=1.34.162,<1.36"  # breaking change beyond 1.36
+boto3 = "1.35.99"  # breaking change beyond 1.36
+botocore = "1.35.99"  # breaking change beyond 1.36
 delta-spark = "3.2.0"
 duckdb = "1.1.3"  # breaking changes beyond 1.1
 Jinja2 = "3.1.6"