chore(deps,flink): update confluent-kafka requirement from <3,>=2.15.0 to >=2.16.0,<3 in /src/agentflow_runtime/processing/flink_jobs

[dependabot]

Updates the requirements on confluent-kafka to permit the latest version.

Release notes

Sourced from confluent-kafka's releases.

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

• confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
• Add Python 3.14t wheels (#2352)
• Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
• Producer close() now aborts any open transaction (#2347)
• Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
• SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
• Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
• New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
• New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
• New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
• Add support for saving Azure key version with DEK (#2306)
• Pass context when clients make KEK calls to DEK Registry (#2308)
• Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
• Add support for inline validation rules (#2326)
• Add Variant, Decimal, and Timestamp CEL functions (#2332)

Fixes

... (truncated)

Changelog

Sourced from confluent-kafka's changelog.

v2.16.0

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

• confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
• Add Python 3.14t wheels (#2352)
• Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
• Producer close() now aborts any open transaction (#2347)
• Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
• Add support for CPython free-threading (PEP 703) to enable true multi-core parallel execution in No-GIL environments (#2347)
• SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
• Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
• New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
• New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
• New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
• Add support for saving Azure key version with DEK (#2306)
• Pass context when clients make KEK calls to DEK Registry (#2308)
• Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
• Add support for inline validation rules (#2326)
• Add Variant, Decimal, and Timestamp CEL functions (#2332)

... (truncated)

Commits

• 4a1bcb0 Copy pyproject.toml into smoketest temp dir so asyncio_mode=auto applies (#2384)
• 16ba967 Fix Unicode errors in string serialization (#2379)
• 73a71f8 2.16.0 (#2380)
• 20614ae Integrate Schema Registry serdes into the Kafka clients: serde builders, clus...
• 7f2e72f Add s390x wheels to the build and verification matrix (#2360)
• 6a54a83 chore: normalize service.yml field names (#2193)
• c57c5b8 Fix Producer.purge() ignoring boolean flags on big-endian platforms (#2345)
• 89c99e0 On Windows, the tag isn't currently given when building librdkafka, that affe...
• cc1c970 v2.16.0rc2 (#2369)
• d245efd Fix crash on nullable array of $ref items in JSON Schema CSFLE (#2370)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: flink, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 0 total / 0.0 per week
• Lead time for changes: avg n/a / median n/a
• Change failure rate: n/a (0/0)
• MTTR: n/a across 0 incident(s)

MTTR note: No GitHub Actions or deployment log history available.