chore(source-cart): Upgrade to Python 3.13, base image 4.1.0, and CDK 7.x

[devin-ai-integration]

Resolves https://github.com/airbytehq/oncall/issues/10107

What

Upgrades the source-cart connector to support Python 3.13 by upgrading to base image 4.1.0 and airbyte-cdk 7.x. This change was initiated to address SSL certificate verification failures reported in airbytehq/oncall#10107, though the upstream certificate was rotated on Nov 20, 2025, resolving the SSL issue independently.

How

Dependency upgrades:

• Base image: python-connector-base:4.0.2 → 4.1.0
• Python version: ^3.9,<3.12 → ^3.10,<3.14 (CDK 7.x requires Python >=3.10)
• airbyte-cdk: 0.80.0 → ^7.0.0 (resolves to 7.5.1)
• Added explicit pendulum = "^3.0.0" dependency (was transitive in CDK 0.80.0, removed in CDK 7.x)

Code changes for CDK 7.x compatibility:

• Replaced AirbyteLogger with logging.Logger in type hints
• Replaced HttpAuthenticator with AbstractHeaderAuthenticator from airbyte_cdk.sources.streams.http.requests_native_auth.abstract_token
• Updated imports in source.py and streams.py

Testing:

• Verified poetry install succeeds with new dependencies
• Verified spec command runs successfully locally in base image 4.1.0

Review guide

1. source_cart/source.py - Review authenticator class changes (CustomHeaderAuthenticator, CentralAPIHeaderAuthenticator) and verify they inherit from the correct base class
2. source_cart/streams.py - Review CartStream authenticator type hint change
3. pyproject.toml - Verify pendulum dependency addition and version constraints
4. CI test results - Ensure all acceptance tests pass, particularly authentication and data sync tests

User Impact

• Connector now supports Python 3.13
• No breaking changes for users - connector spec and behavior remain unchanged
• SSL certificate verification should work correctly (though the upstream issue was already resolved)

Can this PR be safely reverted and rolled back?

• YES 💚

This is a standard dependency upgrade with no schema or state format changes. Rolling back would restore the previous Python 3.9/CDK 0.80.0 version.

---

Devin run: https://app.devin.ai/sessions/f117be8b016940058bb30b7d4564c295
Requested by: unknown ()

[devin-ai-integration]

Original prompt from API User

Comment from @agarctfi: /ai-fix can you create the PR for the Base Image Upgrade?\n\nIMPORTANT: The user will expect a response posted back to the PR. You should post exactly one comment back to the respective issue PR. If the user requested a code change or PR, your comment should contain a link to the PR. Assume the user has no access to your session or conversation thread unless/until you respond back to them.\n\nIssue #10107 by @dkelly-airbyte: Source Cart.com: Connector failing to connect due to SSL certificate issue\n\nIssue URL: https://github.com/airbytehq/oncall/issues/10107\n\nPlease use playbook macro: !issue_fix

PLAYBOOK_md:
# AI Fix Playbook

You are AI Fix Devin, an expert at reproducing and fixing Airbyte-related issues.

## Context
You are working on the issue linked above in context. You will also need to pull issue comments for full context.

## Rule: Immediate Issue Comment After PR Creation
**MANDATORY REQUIREMENT**: If you create a PR during an AI Fix workflow, your **first action** after creating the PR must be to create a comment on the originating issue. If you cannot create a PR, likewise, your action should be to comment back to the issue.

## Properly note breaking changes

Types of breaking changes:
- spec change
    - a spec field is removed or renamed.
    - a new required spec field is added.
- schema change
    - a field is removed or renamed, or, the datatype is changed.
- stream or property removal
    - a stream is removed.
- state changes
    - the format of the state is changed.

Consult development guides for how to document in the metadata that a change is breaking (if so), and try to avoid breaking changes where necessary. Appropriate updates will also need to be made to the docs changelog and migration guide. Refer to the [Managing Breaking Changes in Connectors](https://docs.airbyte.com/platform/next/connector-development/connector-breaking-changes) documentation to understand what types of changes are considered "breaking"... (3950 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

Helpful Resources

• Breaking Changes Guide - Breaking changes, migration guides, and upgrade deadlines
• Developing Connectors Locally
• Managing Connector Secrets
• On-Demand Live Tests
• On-Demand Regression Tests
• #connector-ci-issues
• #connector-publish-updates
• #connector-build-statuses

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

• /format-fix - Fixes most formatting issues.
• /bump-version - Bumps connector versions.
  • You can specify a custom changelog by passing changelog. Example: /bump-version changelog="My cool update"
  • Leaving the changelog arg blank will auto-populate the changelog from the PR title.
• /run-cat-tests - Runs legacy CAT tests (Connector Acceptance Tests)
• /build-connector-images - Builds and publishes a pre-release docker image for the modified connector(s).
• JVM connectors:
  • /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
    Example: /update-connector-cdk-version connector=destination-bigquery
  • /bump-bulk-cdk-version bump=patch changelog='foo' - Bump the Bulk CDK's version. bump can be major/minor/patch.
• Python connectors:
  • /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
  • /poe source example lock - Alias for /poe connector source-example lock.
  • /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
  • /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.

📝 Edit this welcome message.

[github-actions]

source-cart Connector Test Results

6 tests   3 ✅  6s ⏱️
2 suites  3 💤
2 files    0 ❌

Results for commit 277bead.

♻️ This comment has been updated with latest results.

[github-actions]

Deploy preview for airbyte-docs ready!

✅ Preview
https://airbyte-docs-dx8ghbqh1-airbyte-growth.vercel.app

Built with commit 277bead.
This pull request is being automatically deployed with vercel-action

[devin-ai-integration]

Devin is currently unreachable - the session may have died.

[agarctfi]

Can you update the date for today?

[agarctfi]

We tested locally, & cloud with a dev image, and the user said all looks good on the source & destination sides.