build: update pyrate-limiter requirement from <4.0.0,>=3.7.0 to >=3.7.0,<5.0.0

[dependabot]

Updates the requirements on pyrate-limiter to permit the latest version.

Release notes

Sourced from pyrate-limiter's releases.

v4.4.0

What's Changed

• fix: leaker/InMemory data race, Postgres clock fallback, leaker restart by @​vutran1710 in vutran1710/PyrateLimiter#302
• refactor(limiter): unify async acquire plumbing (no API change) by @​vutran1710 in vutran1710/PyrateLimiter#303
• perf(limiter): release the limiter lock during the sync blocking wait (#301) by @​vutran1710 in vutran1710/PyrateLimiter#304
• fix: declarative bucket is_async to drop side-effecting leak() probe (#305) by @​vutran1710 in vutran1710/PyrateLimiter#305
• Batch weighted RedisBucket inserts by @​amir-h-rassafi in vutran1710/PyrateLimiter#284
• refactor: introduce Algorithm/Decision seam for sliding-window-log (R2) by @​vutran1710 in vutran1710/PyrateLimiter#307
• release: v4.4.0 changelog + auto-create GitHub Release with artifacts by @​vutran1710 in vutran1710/PyrateLimiter#308

New Contributors

• @​amir-h-rassafi made their first contribution in vutran1710/PyrateLimiter#284

Full Changelog: vutran1710/PyrateLimiter@v4.3.1...v4.4.0

Changelog

Sourced from pyrate-limiter's changelog.

[4.4.0]

Bug-fix, scalability, and internal-refactor release. No public API changes (the new AbstractBucket.is_async attribute is additive).

Fixed

• InMemoryBucket: guard the internal item list with a lock so the background Leaker thread can no longer race put/peek/leak. This was a data race in the default configuration (in-memory bucket + scheduled leak). MultiprocessBucket aliases this lock to its shared cross-process lock. (#302)
• PostgresClock: when the DB time query fails, fall back to local wall-clock epoch time instead of monotonic time. The monotonic fallback was ~5 orders of magnitude smaller than the stored epoch-ms timestamps and would corrupt every window comparison and leak bound. (#302)
• Leaker: make the background sync-leak worker restartable. Re-registering a bucket after every bucket had been disposed previously raised RuntimeError: threads can only be started once. (#302)
• Keep Limiter picklable after the InMemoryBucket lock addition. (#302)

Performance & Scalability

• Limiter: release the limiter lock during the synchronous blocking wait, so a long wait on one key no longer serializes acquisitions for every other key sharing the limiter. (#304)
• RedisBucket: batch weighted ZADDs in bounded chunks inside the atomic Lua script, lowering latency for high-weight puts. (#284)

Internal / Refactor

• Unify the limiter's sync/async acquire plumbing into a single coroutine and share the delay-step decision across the sync and async branches. (#303)
• Add a declarative is_async bucket attribute so the Leaker no longer detects async by executing a side-effecting leak(0) probe. RedisBucket still probes because it may wrap either a sync or an async client. (#305)
• Introduce an internal Algorithm/Decision seam (SlidingWindowLog) that the built-in buckets delegate their per-rate admit decision and leak bound to — the foundation for pluggable algorithms (e.g. GCRA, sliding-window-counter) in a future release. (#307)

Documentation

• Document that RedisBucket keeps one sorted-set member per consumed unit, and that long-window / high-volume quotas may want a coarser counter-based backend for bounded memory. (#284)

CI

• The release workflow now also creates a GitHub Release for the pushed tag and attaches the built dist/* artifacts, in addition to publishing to PyPI.

[4.3.1]

Performance and maintenance release. No API or behavior changes.

... (truncated)

Commits

• 4e48e08 Merge pull request #308 from vutran1710/claude/changelog-v4.4.0
• 8b64b54 ci: auto-create GitHub Release with dist artifacts on tag
• 3f0eae6 docs: changelog for v4.4.0
• 6f118af refactor: introduce Algorithm/Decision seam (R2) (#307)
• adcdc09 Batch weighted RedisBucket inserts (#284)
• 043d5c9 fix: declarative bucket is_async to drop side-effecting leak() probe (#305) (...
• 6aa2618 perf(limiter): release the limiter lock during the sync blocking wait (#304)
• 740b2f8 refactor(limiter): unify async acquire plumbing (no API change) (#303)
• 76939a2 Merge pull request #302 from vutran1710/claude/design-review-ces-asj0w9
• 19698b5 fix(mp): silence mypy for cross-process _lock alias assignment
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.