ci: update langfuse requirement from <4,>=2.0.0 to >=2.0.0,<5

[dependabot]

Updates the requirements on langfuse to permit the latest version.

Commits

• See full diff in compare view

[yonib05]

@strandly-the-agent is this PR safe to merge?

[strandly-the-agent]

TL;DR: 🔴 Not safe to merge. langfuse 4.x breaks LangfuseProvider at runtime — v4 moved observations.get_many from page-based to cursor-based pagination, and the provider still calls it with page=. Every get_evaluation_data() call (and strands-evals fetch langfuse) crashes. CI is green only because the unit tests fully mock the SDK, so they can't catch this.

Repro against real langfuse 4.14.4 (no network needed — fails at the call signature):

TypeError: ObservationsClient.get_many() got an unexpected keyword argument 'page'

Recommendation: keep <4 for now (close this PR or @dependabot ignore this major version) and track v4 support as its own change — it needs a code migration, not just a constraint bump.

Verification details

What I checked (head dbe4bdb, langfuse 4.14.4 in a clean venv with this package installed):

• ✅ Langfuse(public_key=, secret_key=, host=) ctor — still compatible (langfuse_provider.py:98)
• ✅ client.api.trace.list — still accepts page/limit/session_id (langfuse_provider.py:156)
• 🔴 client.api.observations.get_many — no longer accepts page; v4 signature is cursor-based (cursor, limit, trace_id, …). _fetch_all_pages (langfuse_provider.py:130-140) passes page= and reads response.meta.total_pages, so _fetch_observations (langfuse_provider.py:160) raises:

from strands_evals.providers.langfuse_provider import LangfuseProvider
p = LangfuseProvider(public_key="pk", secret_key="sk", host="https://example.invalid")
p._fetch_observations("some-trace-id")
# TypeError: ObservationsClient.get_many() got an unexpected keyword argument 'page'

Why CI didn't catch it: tests/strands_evals/providers/test_langfuse_provider.py MagicMocks the whole client, so the real v4 signatures are never exercised.

Second issue even after a pagination fix: in SDK v4, client.api.observations.* targets the Observations v2 endpoints, which require a Langfuse v4 server. Users on self-hosted Langfuse v3 would need client.api.legacy.observations_v1.get_many (which keeps page-based pagination). So proper v4 support means choosing between the legacy resource or cursor pagination + a server-version story — worth its own issue/PR.

Also note: the resulting range >=2.0.0,<5 would span three majors with materially different client surfaces, which the current code doesn't attempt to handle.