build: synchronize dependency pins and service locks

install/service-requirements.txt

@@ -2,6 +2,6 @@ beautifulsoup4==4.15.0
 chandra-ocr==0.2.0
 filetype==1.2.0
 httpx==0.28.1
-openai==3.3.1
+openai==3.19.2
 openpyxl==3.1.5
 pypdfium2==5.13.0

requirements.txt

@@ -2,10 +2,10 @@ beautifulsoup4==4.15.0
 chandra-ocr==0.2.0
 fastapi==0.141.1
 filetype==1.2.0
-firecrawl-anydoc==0.2.3
+firecrawl-anydoc==0.2.4
 httpx==0.28.1
-mcp==2.0.0
-openai==3.3.1
+mcp==2.1.1
+openai==3.19.2
 openpyxl==3.1.5
 pypdfium2==5.13.0
 python-multipart==0.0.32

tests/ci/release-contract.test.mjs

@@ -211,7 +211,7 @@ test("runtime and development requirements are exact reviewed pins", async () =>
     );
   }
   assert.ok(
-    runtime.some((entry) => entry.toLowerCase() === "firecrawl-anydoc==0.2.3"),
+    runtime.some((entry) => entry.toLowerCase() === "firecrawl-anydoc==0.2.4"),
     "requirements.txt must install the anydoc module imported by the MCP server",
   );
   assert.ok(

tests/runtime_security_test.py

@@ -759,6 +759,10 @@ def test_retention_only_deletes_exact_owned_safe_job_directories(self):
         unsafe_child = unsafe / "link"
         unsafe_child.write_text("pretend-reparse", encoding="utf-8")
         (arbitrary / "keep.txt").write_text("keep", encoding="utf-8")
+        # Make age deterministic even on coarse Windows filesystem clocks.
+        old_timestamp = time.time() - 86400
+        for directory in (owned, unsafe, arbitrary):
+            os.utime(directory, (old_timestamp, old_timestamp))
         original_check = service._is_reparse_or_symlink
 
         def mark_unsafe(path):