[deps] chore: raise minimum versions of boto3, cryptography, requests (#11)

* chore(deps): raise minimum versions of boto3, cryptography, requests

Bump lower bounds to pick up current stable releases:
- boto3 >=1.40.0 (S3 express + latest session handling)
- cryptography >=44.0.0, cap <46.0.0 (current stable line)
- requests >=2.32.4 (CVE-2024-47081 netrc leak fix included in lower bound)

* fix(types): narrow metadata value to str in _first_metadata_value

Newer boto3-stubs (>=1.40 floor) types Object metadata values as Any, tripping mypy no-any-return. Narrow with isinstance(value, str).

---------

Co-authored-by: dudepls[bot] <323171535+dudepls[bot]@users.noreply.github.com>

pyproject.toml

@@ -49,11 +49,11 @@ classifiers = [
 ]
 
 dependencies = [
-    "boto3>=1.35.0,<2.0.0",
+    "boto3>=1.40.0,<2.0.0",
     "click>=8.1.0,<9.0.0",
-    "cryptography>=42.0.0,<45.0.0",
+    "cryptography>=44.0.0,<46.0.0",
     "python-dateutil>=2.9.0,<3.0.0",
-    "requests>=2.32.0,<3.0.0",
+    "requests>=2.32.4,<3.0.0",
 ]
 
 [project.urls]

src/deltaglider/client_operations/stats.py

@@ -40,7 +40,7 @@ def _first_metadata_value(metadata: dict[str, Any], *keys: str) -> str | None:
     """Return the first non-empty metadata value matching the provided keys."""
     for key in keys:
         value = metadata.get(key)
-        if value not in (None, ""):
+        if isinstance(value, str) and value:
             return value
     return None