fix: pin dependency upper bounds and bump version to 0.36.1

Add explicit upper bounds to unbounded >= dependencies to prevent
unintended major-version upgrades. Keep ~= specifiers where already
present. Bump protobuf floor to >=5.0.0, fix anyio and langgraph dev
constraints to resolve uv sync conflicts.

Author: ArthurTonial

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sap-cloud-sdk"
-version = "0.36.0"
+version = "0.36.1"
 description = "SAP Cloud SDK for Python"
 readme = "README.md"
 license = "Apache-2.0"
@@ -10,30 +10,30 @@ authors = [
 requires-python = ">=3.11"
 dependencies = [
     "minio~=7.2.16",
-    "setuptools~=80.9.0",
-    "requests>=2.33.0",
+    "setuptools>=80.9.0,<81",
+    "requests>=2.33.0,<3",
     "requests-oauthlib~=2.0.0",
     "pydantic~=2.12.3",
     "hatchling~=1.27.0",
     "opentelemetry-exporter-otlp-proto-grpc~=1.42.1",
     "opentelemetry-exporter-otlp-proto-http~=1.42.1",
     "traceloop-sdk~=0.61.0",
-    "opentelemetry-instrumentation-langchain>=0.61.0",
-    "httpx>=0.27.0",
-    "PyJWT>=2.13.0",
-    "protobuf>=4.25.0",
-    "protovalidate>=0.13.0",
-    "grpcio>=1.60.0",
-    "opentelemetry-api>=1.42.1",
-    "opentelemetry-sdk>=1.42.1",
-    "mcp>=1.1.0",
+    "opentelemetry-instrumentation-langchain>=0.61.0,<1",
+    "httpx>=0.27.0,<1",
+    "PyJWT>=2.13.0,<3",
+    "protobuf>=5.0.0,<8",
+    "protovalidate>=0.13.0,<1",
+    "grpcio>=1.60.0,<2",
+    "opentelemetry-api>=1.42.1,<2",
+    "opentelemetry-sdk>=1.42.1,<2",
+    "mcp>=1.1.0,<2",
 ]
 
 [project.optional-dependencies]
-extensibility = ["a2a-sdk>=0.2.0"]
-starlette = ["starlette>=0.40.0"]
-langchain = ["langchain-core>=1.2.7"]
-langgraph = ["langgraph>=1.0.0"]
+extensibility = ["a2a-sdk>=0.2.0,<1"]
+starlette = ["starlette>=0.40.0,<1"]
+langchain = ["langchain-core>=1.2.7,<2"]
+langgraph = ["langgraph>=1.0.0,<2"]
 
 [build-system]
 requires = ["hatchling"]
@@ -44,23 +44,23 @@ packages = ["src/sap_cloud_sdk", "src/buf"]
 
 [dependency-groups]
 dev = [
-    "pytest>=8.4.2",
-    "pytest-cov>=7.0.0",
-    "pytest-asyncio>=1.0.0",
-    "pytest-bdd>=7.2.0",
-    "python-dotenv>=1.0.0",
-    "ty>=0.0.21",
-    "cryptography>=46.0.3",
-    "ruff>=0.8.0",
-    "starlette>=0.40.0",
-    "anyio>=3.6.2",
-    "httpx>=0.27.0",
-    "a2a-sdk>=0.2.0",
-    "langchain-core>=1.2.7",
-    "langgraph>=0.2.0",
-    "langchain-community>=0.3.0",
-    "litellm>=1.40.0",
-    "langchain-litellm>=0.6.6",
+    "pytest>=8.4.2,<9",
+    "pytest-cov>=7.0.0,<8",
+    "pytest-asyncio>=1.0.0,<2",
+    "pytest-bdd>=7.2.0,<8",
+    "python-dotenv>=1.0.0,<2",
+    "ty>=0.0.21,<1",
+    "cryptography>=46.0.3,<47",
+    "ruff>=0.8.0,<1",
+    "starlette>=0.40.0,<1",
+    "anyio>=4.5,<5",
+    "httpx>=0.27.0,<1",
+    "a2a-sdk>=0.2.0,<1",
+    "langchain-core>=1.2.7,<2",
+    "langgraph>=1.0.0,<2",
+    "langchain-community>=0.3.0,<1",
+    "litellm>=1.40.0,<2",
+    "langchain-litellm>=0.6.6,<1",
 ]
 
 [tool.pytest.ini_options]