build(deps): bump the root-backend-runtime group with 14 updates

requirements.in

@@ -20,7 +20,7 @@ sqlalchemy>=2.1.5
 # rejects the build on Railway. See build failure on #1823 / #1842.
 greenlet>=3.5.6
 pydantic>=2.14.1,<3
-pydantic-settings>=2.16.0
+pydantic-settings>=2.16.1
 structlog>=26.1.0
 python-json-logger>=4.2.0
 python-dotenv>=1.2.4
@@ -46,14 +46,14 @@ redis>=8.1.0
 neo4j>=6.4.1
 
 # Cloud SDKs & External Services
-boto3>=1.43.114
+boto3>=1.43.118
 supabase>=2.33.0
 gotrue>=2.12.4,<3
 resend>=2.50.0,<3
 stripe>=16.0.0,<17
 
 # Data Processing
-pandas>=3.0.6
+pandas>=3.1.0
 numpy>=1.26.0
 # Direct import in scripts/ingest_document.py (documented in
 # docs/engineering/CONTENT_INGESTION.md). Until #2870 it was satisfied only
@@ -90,7 +90,7 @@ opentelemetry-exporter-otlp==1.45.1
 opentelemetry-instrumentation-fastapi==0.66b1
 opentelemetry-instrumentation-sqlalchemy==0.66b1
 opentelemetry-instrumentation-httpx==0.66b1
-sentry-sdk>=2.72.0
+sentry-sdk>=2.73.0
 
 # Networking
 # Transitive of langchain-community. Floored to >=3.14.3 for CVE-2026-34993,
@@ -103,7 +103,7 @@ aiohttp>=3.14.5
 # Transitive of aiohttp/yarl. Floored to >=6.9.1 for CVE-2026-104874
 # (items-view reference leak allowing unbounded memory growth). Pinned here
 # so the lockfile cannot regress below the fix.
-multidict>=7.1.0
+multidict>=7.2.1
 httpx[http2]>=0.28.1
 tenacity>=9.2.1
 slowapi>=0.1.10
@@ -119,22 +119,22 @@ urllib3>=2.8.0
 # Messaging / Kafka
 confluent-kafka[schema-registry,avro]>=2.16.0
 fastavro>=1.13.1
-cachetools>=7.2.3
+cachetools>=7.2.5
 attrs>=26.1.0
 
 # NLP & ML
 regex>=2026.9.29
-langchain>=1.4.6
+langchain>=1.4.7
 langchain-classic>=1.0.8  # CVE-2026-45134
-langchain-core>=1.6.12,<2.0.0
+langchain-core>=1.7.0,<2.0.0
 langchain-community>=0.4.2
 langchain-text-splitters>=1.1.3
 # Transitive of langgraph. Floored to >=0.4.4 for CVE-2026-104873
 # (resource-scoped auth decorators ignored actions=).
-langgraph-sdk>=0.4.8
+langgraph-sdk>=0.4.9
 langchain-groq>=1.1.3
-langsmith>=0.14.11  # Transitive of langchain; pinned for CVE-2026-45134 and GHSA-f4xh-w4cj-qxq8
-openai>=3.35.1
+langsmith>=0.14.12  # Transitive of langchain; pinned for CVE-2026-45134 and GHSA-f4xh-w4cj-qxq8
+openai>=3.37.0
 jsonschema>=4.26.0
 
 # AI decisioning — TypeSafe AI "Jev" System One model (services/shared/jev/).
@@ -153,7 +153,7 @@ typesafe-sdk>=0.7.5,<0.8
 # (scans, free-form letters). Optional at runtime (no LLAMA_CLOUD_API_KEY ->
 # disabled). Stainless SDK; its transitives (anyio, distro, httpx, pydantic,
 # sniffio, typing-extensions) are already in the lock.
-llama-cloud>=2.18.0,<3
+llama-cloud>=2.19.0,<3
 
 # Scheduler
 apscheduler>=3.11.3
@@ -174,11 +174,11 @@ pyzbar>=0.1.9,<1
 
 # Testing (included for CI — move to dev-requirements.txt if image size matters)
 pytest>=9.1.1
-pytest-asyncio>=1.4.0
+pytest-asyncio>=1.4.1
 pytest-cov>=7.1.0
 pytest-mock>=3.17.0
 pytest-xdist>=3.8.0
-hypothesis>=6.170.2
+hypothesis>=6.170.11
 aiosqlite>=0.22.1
 testcontainers[postgres]>=4.15.0
 testcontainers[redis]>=4.15.0