[dependabot]

Updates the requirements on pydantic-settings, boto3, pandas, sentry-sdk, multidict, cachetools, langchain, langchain-core, langgraph-sdk, langsmith, openai, llama-cloud, pytest-asyncio and hypothesis to permit the latest version.
Updates pydantic-settings to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

• Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
• A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

• Harden CI by @​Viicos in pydantic/pydantic-settings#1044
• Keep list of dicts CLI values as lists by @​hramezani in pydantic/pydantic-settings#1049
• Keep fixed-length tuple CLI positionals single-valued by @​hramezani in pydantic/pydantic-settings#1069
• Prepare release 2.16.1 by @​hramezani in pydantic/pydantic-settings#1087
• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

Commits

• 4e286e2 Prepare release 2.16.1 (#1087)
• 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
• f651a7a Keep list of dicts CLI values as lists (#1049)
• ecf7d90 Harden CI (#1044)
• See full diff in compare view

Updates boto3 to 1.43.118

Commits

• 185b1bd Merge branch 'release-1.43.118'
• 732c473 Bumping version to 1.43.118
• b087cd3 Add changelog entries from botocore
• 69e35c3 Backfill 1.43.117 changelog entry for CA bundle fix (#4861)
• 3667679 Merge branch 'release-1.43.117'
• ea13634 Merge branch 'release-1.43.117' into develop
• 94f6b3e Bumping version to 1.43.117
• 1eba892 Add changelog entries from botocore
• cfa4808 Bump https://github.com/astral-sh/ruff-pre-commit (#4860)
• dbaa95d Merge branch 'release-1.43.116'
• Additional commits viewable in compare view

Updates pandas to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates sentry-sdk to 2.73.0

Release notes

Sourced from sentry-sdk's releases.

2.73.0

New Features ✨

• (arq) Add an option to monitor arq cron jobs by @​wedamija in #8051
• (huey) Add an option to monitor Huey periodic tasks by @​wedamija in #8052
• (rq) Add an option to monitor rq-scheduler jobs by @​wedamija in #8053
• (types) Export Attributes from the public types module by @​sansynx in #8019

Bug Fixes 🐛

• (arq) Don't monitor cron jobs with unsupported schedules by @​wedamija in #8098
• (attributes) Handle special float values correctly by @​sentrivana in #8067
• (celery) Don't round down beat schedule intervals by @​wedamija in #7842
• (cohere) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8017
• (huggingface_hub) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8018
• Exclude litellm==1.107.0 from extras by @​jonny-norwine in #8104

Internal Changes 🔧

Deps

• Update github workflows by @​renovate in #8045
• Update github workflows by @​renovate in #8036
• Update github workflows by @​renovate in #7276

Other

• (litellm) Require filelock>=4.0.3 on Python 3.10/3.11 by @​sentry-junior in #8026
• (monitor) Stop background health checks in tests that drive the monitor by @​sentry-junior in #8032
• Update AGENTS.md by @​sentrivana in #8077
• 🤖 Update test matrix with new releases (10/12) by @​github-actions in #7944

Changelog

Sourced from sentry-sdk's changelog.

2.73.0

New Features ✨

• (arq) Add an option to monitor arq cron jobs by @​wedamija in #8051
• (huey) Add an option to monitor Huey periodic tasks by @​wedamija in #8052
• (rq) Add an option to monitor rq-scheduler jobs by @​wedamija in #8053
• (types) Export Attributes from the public types module by @​sansynx in #8019

Bug Fixes 🐛

• (arq) Don't monitor cron jobs with unsupported schedules by @​wedamija in #8098
• (attributes) Handle special float values correctly by @​sentrivana in #8067
• (celery) Don't round down beat schedule intervals by @​wedamija in #7842
• (cohere) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8017
• (huggingface_hub) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8018
• Exclude litellm==1.107.0 from extras by @​jonny-norwine in #8104

Internal Changes 🔧

Deps

• Update github workflows by @​renovate in #8045
• Update github workflows by @​renovate in #8036
• Update github workflows by @​renovate in #7276

Other

• (litellm) Require filelock>=4.0.3 on Python 3.10/3.11 by @​sentry-junior in #8026
• (monitor) Stop background health checks in tests that drive the monitor by @​sentry-junior in #8032
• Update AGENTS.md by @​sentrivana in #8077
• 🤖 Update test matrix with new releases (10/12) by @​github-actions in #7944

2.72.0

New Features ✨

Asgi

• Set user_agent.original for inbound filters by @​sentrivana in #7794
• Add sentry.is_localhost for inbound filters by @​sentrivana in #7781

Boto3

• Add ServiceExtension class by @​pabloDeputter in #7536
• Add response, retry, and error span attributes by @​pabloDeputter in #7499
• Add common OTel AWS client attributes by @​pabloDeputter in #7481

Wsgi

... (truncated)

Commits

• 54160ae release: 2.73.0
• 25d265b fix: Exclude litellm==1.107.0 from extras (#8104)
• 60116ac fix(celery): Don't round down beat schedule intervals (#7842)
• 68bc4dd fix(arq): Don't monitor cron jobs with unsupported schedules (#8098)
• 1c249d8 feat(huey): Add an option to monitor Huey periodic tasks (#8052)
• 4e19592 feat(rq): Add an option to monitor rq-scheduler jobs (#8053)
• f8b08b3 meta: Update AGENTS.md (#8077)
• cfce72f chore(deps): bump uv from 0.13.0 to 0.13.4 (#8095)
• a9553c4 feat(arq): Add an option to monitor arq cron jobs (#8051)
• 641517a fix(attributes): Handle special float values correctly (#8067)
• Additional commits viewable in compare view

Updates multidict to 7.2.1

Release notes

Sourced from multidict's releases.

7.2.1

Bug fixes

• Fixed a regression in 7.2.0 where a subclass of MultiDictProxy or CIMultiDictProxy that converted its argument in its own __init__() raised TypeError before that __init__() ran; such a subclass got an empty multidict until its __init__() set the proxied one -- by @​asvetlov.

  Related issues and pull requests on GitHub: #1824, #1825.

---

Changelog

Sourced from multidict's changelog.

7.2.1

(2026-10-24)

Bug fixes

• Fixed a regression in 7.2.0 where a subclass of :class:~multidict.MultiDictProxy or :class:~multidict.CIMultiDictProxy that converted its argument in its own __init__() raised :exc:TypeError before that __init__() ran; such a subclass got an empty multidict until its __init__() set the proxied one -- by :user:asvetlov.

  Related issues and pull requests on GitHub: :issue:1824, :issue:1825.

---

7.2.0

(2026-10-23)

7.2.0 drops Python 3.10, fixes a crash in a proxy built without __init__() and a :exc:MemoryError from a huge __length_hint__(), and is otherwise a performance release for the C extension: lookups, adds, updates and deletes each needed a few percent fewer instructions.

Bug fixes

• Stopped a huge __length_hint__() from raising :exc:MemoryError in :meth:~multidict.MultiDict.extend, :meth:~multidict.MultiDict.update and :meth:~multidict.MultiDict.merge; the C extension capped the room it reserved for the hint at the largest table the constructor allocates up front -- by :user:asvetlov.

  Related issues and pull requests on GitHub: :issue:1767.

• Fixed a segmentation fault when using a :class:~multidict.MultiDictProxy or :class:~multidict.CIMultiDictProxy built by __new__() without __init__(); __new__() started requiring the proxied multidict, the same argument as the constructor -- by :user:asvetlov.

... (truncated)

Commits

• f50870c Release 7.2.1 (#1826)
• 6526b96 Let proxy subclasses convert their argument in init() (#1825)
• 3d08ebe Keep the sdist in the deploy group that makes the Release (#1822)
• 17b8e41 Build(deps): Bump pypa/cibuildwheel from 4.3.1 to 4.3.2 (#1823)
• 57ffa0c Fix the huge length hint test on 32-bit builds (#1821)
• 8dcff50 Release 7.2.0 (#1819)
• a2cc61c Pin Hypothesis in the MyPy hooks, drop an unused type: ignore (#1820)
• b933263 Refresh the benchmark tables (#1818)
• edfc84d Inline the GIL contains lookup, take an add's references after the table is r...
• b2f65b8 Refresh the benchmark tables (#1816)
• Additional commits viewable in compare view

Updates cachetools to 7.2.5

Changelog

Sourced from cachetools's changelog.

v7.2.5 (2026-10-25)

• Fix @cachedmethod with condition for decorated methods taking a pending keyword argument (broken since v7.0.0).

• Fix pickling and deep-copying of instances using @cachedmethod (broken since v7.0.0).

• Fix calling @cachedmethod decorated methods through the class with the receiver (self) passed as a keyword argument (broken since v7.2.4).

• Various documentation improvements.

v7.2.4 (2026-10-19)

• Restore autospec calls to @cachedmethod decorated methods.

• Improve branch coverage of unit tests.

• Minor type stub improvements.

v7.2.3 (2026-10-17)

• Fix @cached decorator stacking behavior.

• Minor type stub improvements.

v7.2.2 (2026-10-15)

• Fix @cachedmethod for subclasses that override a decorated method and call the base class implementation via super().

• Restore class access to instance methods decorated with @cachedmethod.

• Improve TTLCache robustness when calculating expiration time fails.

• Various unit test improvements.

v7.2.1 (2026-10-05)

... (truncated)

Commits

• a2d411e Release v7.2.5.
• 354c075 Various documentation corrections and improvements.
• 2609f06 Fix #417: Re-enable pickling of objects with cached methods.
• b34643f Fix @​cachedmethod class access with receiver as keyword argument.
• 36d4e87 Forward "pending" keyword argument in cached methods.
• 6f23e2a Release v7.2.4.
• 2be4254 Clarify _AbstractCondition's wait() and notify() are reserved for future use.
• eb84481 Improve branch coverage of unit tests.
• 95e6add Fix #443: Restore autospec calls to @​cachedmethod decorated methods
• See full diff in compare view

Updates langchain to 1.4.7

Release notes

Sourced from langchain's releases.

langchain==1.4.7

Changes since langchain==1.4.6

chore(langchain): update lockfile (#41402) release(langchain): 1.4.7 (#41401) chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/langchain_v1 (#41370) feat(core,langchain,standard-tests): read tool-call-delta in stream consumers (#41246) chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/langchain_v1 (#41360) chore(deps): bump aiohttp from 3.14.3 to 3.14.4 in /libs/langchain_v1 (#41330) chore(deps): bump mcp from 2.1.1 to 2.2.0 in /libs/langchain_v1 (#41270) feat(core): accept address inside LangChainTracer (#41006)

Commits

• fbb8a35 chore(langchain): update lockfile (#41402)
• ad92e36 release(langchain): 1.4.7 (#41401)
• bdf0f53 release(core): 1.6.13 (#41397)
• 59be9ee chore(text-splitters): bump certifi to 2026.10.19 (#41393)
• 82ef933 release(perplexity): 1.4.2 (#41392)
• fc23e66 chore(model-profiles): refresh model profile data (#41354)
• 331e6be chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/partners/ant...
• 144b0b4 chore(deps): bump certifi from 2025.8.3 to 2026.10.19 in /libs/partners/chrom...
• 9b5ae66 chore(deps): bump certifi from 2025.8.3 to 2026.10.19 in /libs/partners/deeps...
• c773a1b chore(deps): bump certifi from 2025.8.3 to 2026.10.19 in /libs/partners/exa (...
• Additional commits viewable in compare view

Updates langchain-core to 1.7.0

Release notes

Sourced from langchain-core's releases.

langchain-core==1.7.0

Changes since langchain-core==1.6.13

release(core): 1.7.0 (#41418) feat(core): emit tool-call-delta for streamed tool-call args (#41257)

Notes

• Tool-call args now stream as tool-call-delta slices instead of block-delta snapshots of the args so far. If you read raw stream events and their block-delta args mid-stream, read tool-call-delta instead. .tool_calls.get() and .output are unchanged. To keep snapshots, pin langchain-core<1.7.
• Since 1.6.13, iterating ChatModelStream.tool_calls yields each call's new args slice, not a snapshot of the args so far.

Commits

• f4e6cde release(core): 1.7.0 (#41418)
• 1013180 docs: update OpenWiki (#41416)
• 64ecb6a chore(model-profiles): refresh model profile data (#41415)
• b84fa61 feat(core): emit tool-call-delta for streamed tool-call args (#41257)
• 6908e67 chore(deps): bump uv to 0.13.5 (#41408)
• 8eff3b3 docs: update OpenWiki (#41356)
• 45dae8c chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/partners/openai (#41...
• 150d2cb chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/partners/huggingface...
• de1cc39 chore(deps): bump setuptools from 84.2.0 to 84.2.1 in /libs/partners/huggingf...
• fbb8a35 chore(langchain): update lockfile (#41402)
• Additional commits viewable in compare view

Updates langgraph-sdk to 0.4.9

Release notes

Sourced from langgraph-sdk's releases.

langgraph-sdk==0.4.9

Changes since sdk==0.4.8

• release(sdk-py): 0.4.9 (#9398)
• feat(sdk-py): add Priority for thread priority settings (#9392)
• chore(deps): remove precautionary third-party upper bounds (#9390)
• chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in /libs/sdk-py (#9370)
• chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in /libs/cli/js-examples in the major group (#9154)
• chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt with 6 updates (#9150)

Commits

• 98c369a 0.4.9
• c354402 If FuturesDict callback has been GCed, don't call it
• 3c79812 docs: remove usage of StateGraph(dict) (#4967)
• d7c364c Port step_timeout/GraphBubbleUp fix to v0
• See full diff in compare view

Updates langsmith to 0.14.12

Release notes

Sourced from langsmith's releases.

v0.14.12

0.14.12 (2026-10-21)

Features

• agents: add agent registry CRUD to SDKs and CLI (d3de1d5)
• authz: add root_run_metadata policy conditions and compiled trace_filters (64684e0)
• cli: expose runs share and get-url to the CLI (fcfae7c)
• evaluators: add trajectory input type for code evaluators (9b6f6e5)
• sandboxes: let LangSmith login service URLs be embedded by named origins (dcf7c3e)
• sdk-python: create enforced feedback configs (1e3cd15)

Bug Fixes

• sandboxes: add cursor pagination to registry listing (1a44460)
• sdk-python: use reference outputs for example creation (f995f42)
• sdk-python: use reference outputs for example creation (7cbb508)
• sdk: keep wrap_openai Responses stream output when it ends incomplete or failed (e88c57c)
• support Standard Units in sandbox cost breakdowns (e9bee5c)

Chores

• remove langsmith-sdk and staging repo leftovers, update SDK docs (459d4bd)

Documentation

• move sandbox auth options to the bottom of README.md (#71) (be8a4db)

Changelog

Sourced from langsmith's changelog.

0.14.12 (2026-10-21)

Features

• agents: add agent registry CRUD to SDKs and CLI (d3de1d5)
• authz: add root_run_metadata policy conditions and compiled trace_filters (64684e0)
• cli: expose runs share and get-url to the CLI (fcfae7c)
• evaluators: add trajectory input type for code evaluators (9b6f6e5)
• sandboxes: let LangSmith login service URLs be embedded by named origins (dcf7c3e)
• sdk-python: create enforced feedback configs (1e3cd15)

Bug Fixes

• sandboxes: add cursor pagination to registry listing (1a44460)
• sdk-python: use reference outputs for example creation (f995f42)
• sdk-python: use reference outputs for example creation (7cbb508)
• sdk: keep wrap_openai Responses stream output when it ends incomplete or failed (e88c57c)
• support Standard Units in sandbox cost breakdowns (e9bee5c)

Chores

• remove langsmith-sdk and staging repo leftovers, update SDK docs (459d4bd)

Documentation

• move sandbox auth options to the bottom of README.md (#71) (be8a4db)

0.14.11 (2026-10-16)

Chores

• drop the release-as pin now that 0.14.10 is out (#68) (1b41cc8)

0.14.10 (2026-10-15)

Chores

• switch release-please to the stable channel, release 0.14.10 (#52) (9cbdb21)

0.14.9-rc.1 (2026-10-15)

⚠ BREAKING CHANGES

... (truncated)

Commits

• 6c2c995 Merge pull request #42 from langchain-ai/release-please--branches--main
• fb9685c release: 0.14.12
• 293363a Merge pull request #74 from langchain-ai/copybara/export-python
• d3de1d5 feat(agents): add agent registry CRUD to SDKs and CLI
• dcf7c3e feat(sandboxes): let LangSmith login service URLs be embedded by named origins
• 1a44460 fix(sandboxes): add cursor pagination to registry listing
• e88c57c fix(sdk): keep wrap_openai Responses stream output when it ends incomplete or...
• bc958f9 ci(sdks): move staging-only SDK jobs into langchainplus
• 459d4bd chore: remove langsmith-sdk and staging repo leftovers, update SDK docs
• 48ffe4d ci: run Python live tests and JavaScript evals on SDK pull requests
• Additional commits viewable in compare view

Updates openai to 3.37.0

Release notes

Sourced from openai's releases.

v3.37.0

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

Changelog

Sourced from openai's changelog.

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)
• api: add custom voice consent management (#4135) (de6d70d)
• types: prepare native synchronous WebSocket option type (#4118) (90c0bac)

... (truncated)

Commits

• e8a0fd2 release: 3.37.0 (#4154)
• fa9a161 chore(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109)
• 1e45ad1 feat(api): expand Decisions input and question types (#4158)
• 1f76a59 ci: allow time for browser dependency installation (#4159)
• 7db9d88 chore(api): preserve file and video polling helpers (#4155)
• a29dc39 chore(api): preserve upload helpers and Live connection defaults (#4152)
• 49e6757 release: 3.36.1 (#4145)
• 6ed945e chore(api): clarify service-account API key deletion (#4151)
• 7cd7028 refactor: prepare handwritten vector-store polling runtime (#4148)
• d40a5e1 fix(api): honor per-call WebSocket query settings (#4138)
• Additional commits viewable in compare view

Updates llama-cloud to 2.19.0

Release notes

Sourced from llama-cloud's releases.

v2.19.0

2.19.0 (2026-10-21)

Features

• classify: add expand=usage to GET /api/v2/classify/{job_id} (#29577) (235ebc3)

Bug Fixes

• parse: apply watermark and wrapped-word rules to Lite fallbacks (#30128) (b534870)
• sdk: one FormText model for the forms text node (PROD-10339) (f288591)
• split: refuse to delete a non-terminal job (#29785) (415f09f)

Changelog

Sourced from llama-cloud's changelog.

2.19.0 (2026-10-21)

Features

• classify: add expand=usage to GET /api/v2/classify/{job_id} (#29577) (235ebc3)

Bug Fixes

• parse: apply watermark and wrapped-word rules to Lite fallbacks (#30128) (

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
regengine	Ignored	Preview	Nov 2, 2026 8:35am UTC

[github-actions]

PR Blocker Checklist

Head SHA: a63e6144aa4387b92b99a86f00159b1104c5b551

Status: Ready

• All review threads resolved
• No reviews requesting changes
• No blocked review engines

[github-actions]

Regenerated requirements.lock with CI's toolchain (pip 24.3.1, pip-tools 7.5.2, Python 3.11), pinned to the versions this PR proposes. Backend CI and security were re-dispatched on the new head — wait for them to go green before merging.