Support pySigma 2.0

[cristianchiriac]

pySigma 2.0.0 was released on 2026-10-04. This backend currently requires pysigma = "^1.4.0", so it can't be installed alongside 2.0.

Changes

• pyproject.toml: pysigma = "^2.0.0". poetry.lock was regenerated with poetry lock. The resolved changes are pysigma 1.4.0 → 2.0.0, the new google-re2 dependency, packaging 26.2 → 26.3, and removal of the 3.10-only exceptiongroup/tomli.
• pySigma 2.0 requires Python ≥ 3.11, so python = "^3.11". 3.10 is removed from the test matrix and the README.
• test_logpoint_windows_hashes_duplicates: HashesFieldsDetectionItemTransformation now strips wildcards from hash values (SigmaHQ/pySigma@44d9ba0). Hashes|contains: 'MD5=…' therefore converts to hash="…" instead of hash="…*". The test expected the old trailing *; it now expects exact hash matches, the same as the md5:/sha1: selection in the same rule.

Testing: after poetry install from the new lock (pySigma 2.0.0, Python 3.11), pytest gives 54 passed. Without the test change, only test_logpoint_windows_hashes_duplicates fails. It also fails on pySigma 1.5.1, so any version newer than the current lock needs this update.

[cristianchiriac]

Update: the red CI here is not caused by this change. pySigma 2.0.0 turned sigma into a regular package (it added sigma/__init__.py), so a plugin installed in editable mode, which is what poetry install does, can no longer be imported: ModuleNotFoundError: No module named 'sigma.backends...'. I reported and proposed a fix upstream in SigmaHQ/pySigma#584.

Correction to the description above: my local runs that passed used a non-editable install of this backend (pip install .), not plain poetry install. Sorry for the imprecise wording. I'm marking this as a draft until a pySigma release contains the fix, and will then refresh the lock file.