chore(deps): bump the all-dependencies group with 39 updates

autobot-backend/requirements.txt

@@ -2,9 +2,9 @@
 -c ../constraints/shared.txt  # single source of truth for shared versions (#10524); pins transitive numpy
 
 # Core
-apscheduler>=3.11.2             # Issue #6590: hourly LLM key rotation job
+apscheduler>=3.11.3             # Issue #6590: hourly LLM key rotation job
 croniter>=6.2.2                 # GH#9027: required by LLC RoutineScheduler and routines API
-fastapi>=0.138.0                # SECURITY UPDATE - requires starlette >=0.52.1
+fastapi>=0.138.1                # SECURITY UPDATE - requires starlette >=0.52.1
 uvicorn>=0.49.0
 websockets>=15.0,<16       # Issue #3098: desktop_streaming_manager + slm_client; relaxed from >=16.0 (#10386): both files use only legacy-compat API (WebSocketServerProtocol type annotation, ConnectionClosed/WebSocketException, connect(subprotocols=)) present in 15.x. CI already pins 15.0.1. websockets<16 satisfies langgraph-sdk 0.4.2 (>=14,<16), unblocking langchain >=1.3.10.
 python-dotenv>=1.2.2
@@ -18,29 +18,29 @@ psutil>=7.2.2  # Issue #927: CPU monitoring for wake word optimization
 
 # Database
 sqlalchemy>=2.0.51
-alembic>=1.18.4
-aiosqlite>=0.21.0
+alembic>=1.18.5
+aiosqlite>=0.22.1
 asyncpg>=0.31.0  # Async PostgreSQL driver — required for RBAC user modes (single_company+) (#9713)
 
 # Document Generation (MVA-2174)
-python-docx>=1.1.0  # DOCX export for transcripts
+python-docx>=1.2.0  # DOCX export for transcripts
 reportlab>=5.0.0    # PDF export for transcripts
 PyPDF2>=3.0.1       # PDF testing for transcript export
 openpyxl>=3.1.0     # Excel file parsing for OneDrive connector (GH#9004)
 python-pptx>=0.6.23 # PowerPoint file parsing for OneDrive connector (GH#9004)
 
 # AI/ML
-openai>=2.43.0
-anthropic>=0.111.0
-boto3>=1.43.34                       # GH#9010: AWS Bedrock provider
+openai>=2.44.0
+anthropic>=0.112.0
+boto3>=1.43.36                       # GH#9010: AWS Bedrock provider
 chromadb>=1.5.9,<2.0.0             # upper bound guards against breaking API changes; 1.5.5+ uses regenerated protos compatible with protobuf 5.x (#4053)
-protobuf>=6.33.6,<7.0.0           # capped <7.0: opentelemetry-proto (otel 1.42) requires protobuf<7.0; Dependabot's 7.35.1 is unsatisfiable. 6.33.6 = latest installable (#4061)
+protobuf>=7.35.1,<8.0.0           # capped <7.0: opentelemetry-proto (otel 1.42) requires protobuf<7.0; Dependabot's 7.35.1 is unsatisfiable. 6.33.6 = latest installable (#4061)
 sentence-transformers>=5.6.0
 torch==2.12.1  # embeddings/transcriber/multimodal; installed CPU-only in the default image (#10251). GPU build via requirements-gpu.txt
 torchvision==0.27.1  # paired with torch 2.12.1; CPU-only by default (#10251)
 # torchaudio removed (#10251): not imported anywhere in the backend, and its 2.11.0 pin mismatched torch 2.12.0
 torchmetrics>=1.9.0  # Issue #904: Training metrics
-opencv-python-headless>=4.10.0  # numpy<2 cap lifted (#10524): graspologic removed, so numpy>=2 is now resolvable
+opencv-python-headless>=4.13.0.92  # numpy<2 cap lifted (#10524): graspologic removed, so numpy>=2 is now resolvable
 vanna>=2.0.2  # Issue #723: Natural language to SQL via Vanna.ai
                # SECURITY: CVE unpatched in all published releases (Dependabot alert #298,
                # dismissed tolerable_risk 2026-04-04, Issue #3445). Monitor
@@ -60,26 +60,26 @@ tree-sitter-javascript>=0.25.0
 -r ../requirements.txt
 
 # Issue #858: Additional runtime dependencies for Python 3.13
-xxhash>=3.7.0          # Hash functions for LLM caching
+xxhash>=3.8.0          # Hash functions for LLM caching
 structlog>=26.1.0      # Structured logging for service auth
-llama-index>=0.14.22,<0.15.0          # Migrated from 0.13.x; floor aligned to 0.14.19 (#2642)
-llama-index-core>=0.14.22,<0.15.0     # Explicit core pin matching ecosystem (#2642)
+llama-index>=0.14.23,<0.15.0          # Migrated from 0.13.x; floor aligned to 0.14.19 (#2642)
+llama-index-core>=0.14.23,<0.15.0     # Explicit core pin matching ecosystem (#2642)
 llama-index-llms-ollama>=0.10.1,<1.0.0       # Ollama LLM integration
 llama-index-embeddings-ollama>=0.9.0,<1.0.0  # Ollama embeddings
 llama-index-vector-stores-chroma>=0.5.5,<1.0.0  # ChromaDB vector store
 # LangChain 1.x ecosystem — migrated from 0.3.x to fix SSRF CVE (#1572)
-langchain>=1.3.10,<2.0.0               # Issue #1572 + #10386: bumped from 1.3.1 — unblocked by websockets relaxation to >=15,<16; 1.3.10 requires langgraph>=1.2.5 + langchain-core>=1.4.7
-langchain-core>=1.4.7,<2.0.0          # Issue #1572 + #10386: bumped from 1.3.3 — langchain 1.3.10 requires >=1.4.7
+langchain>=1.3.11,<2.0.0               # Issue #1572 + #10386: bumped from 1.3.1 — unblocked by websockets relaxation to >=15,<16; 1.3.10 requires langgraph>=1.2.5 + langchain-core>=1.4.7
+langchain-core>=1.4.8,<2.0.0          # Issue #1572 + #10386: bumped from 1.3.3 — langchain 1.3.10 requires >=1.4.7
 langchain-community>=0.4.2,<0.5.0     # Issue #1572 + #10386: bumped from 0.4.1 — aligned with ai-stack canonical (#2808)
 langchain-ollama>=1.1.0,<2.0.0        # Issue #1572: ChatOllama for QA chain
-langgraph>=1.2.5,<2.0.0               # Issue #1043 + #10386: bumped from 1.2.0 — langchain 1.3.10 requires >=1.2.5; langgraph 1.2.6 pulls langgraph-sdk 0.4.2 (websockets>=14,<16) now satisfied by websockets>=15,<16
-langgraph-checkpoint-redis>=0.4.1,<1.0.0  # Issue #1043: Redis checkpointer for thread persistence
+langgraph>=1.2.6,<2.0.0               # Issue #1043 + #10386: bumped from 1.2.0 — langchain 1.3.10 requires >=1.2.5; langgraph 1.2.6 pulls langgraph-sdk 0.4.2 (websockets>=14,<16) now satisfied by websockets>=15,<16
+langgraph-checkpoint-redis>=0.5.0,<1.0.0  # Issue #1043: Redis checkpointer for thread persistence
 markdownify>=1.2.2  # HTML to Markdown conversion
-mcp>=1.28.0            # MCP protocol for skill subprocesses (Issue #731)
+mcp>=1.28.1            # MCP protocol for skill subprocesses (Issue #731)
 PyYAML>=6.0.3            # SKILL.md frontmatter parsing (Phase 3 sync engine)
 
 # Community growth skill (Issue #1161)
-praw>=8.0.1             # Reddit OAuth API for CommunityGrowthSkill
+praw>=8.0.2             # Reddit OAuth API for CommunityGrowthSkill
 
 # Web push notifications (GH#4459)
 pywebpush>=2.3.0        # VAPID/RFC8291 browser push delivery

autobot-browser-worker/requirements.txt

@@ -1,4 +1,4 @@
 -e ../autobot_shared
 
 # Browser automation
-playwright>=1.60.0
+playwright>=1.61.0

requirements-ci/ai-ml.txt

@@ -1,8 +1,8 @@
 # AI/ML frameworks — heavy native deps, numpy-sensitive
-openai==2.6.1
+openai==2.44.0
 tiktoken==0.13.0   # >=0.13 ships cp314 wheels (0.11 builds pyo3-ffi from source, caps at py3.13) — #9825
-transformers==5.3.0
-sentence-transformers==5.3.0
+transformers==5.12.1
+sentence-transformers==5.6.0
 -c ../constraints/shared.txt  # single source of truth for shared versions (#10524)
 numpy  # version from constraints/shared.txt
 pillow==12.2.0

requirements-ci/automation.txt

@@ -3,4 +3,4 @@ pyautogui==0.9.54
 mouseinfo==0.1.3
 opencv-python==4.13.0.92
 pygetwindow==0.0.9
-playwright==1.59.0
+playwright==1.61.0

requirements-ci/document.txt

@@ -1,8 +1,8 @@
 # Document processing and text extraction
-python-docx==1.1.2
+python-docx==1.2.0
 pypdf==6.14.2
 reportlab>=4.0.0            # MVA-2174: PDF export for transcripts
-markdown==3.8.2
+markdown==3.10.2
 nltk==3.9.4
-beautifulsoup4==4.14.3
-markdownify==1.2.0
+beautifulsoup4==4.15.0
+markdownify==1.2.2

requirements-ci/framework.txt

@@ -1,8 +1,8 @@
 # Core web framework — tightly coupled versions
 # fastapi pins starlette range; keep these in sync
-fastapi==0.133.0
+fastapi==0.138.1
 starlette==1.3.1
 python-multipart==0.0.32
-uvicorn==0.47.0
-pydantic[email]==2.12.3
+uvicorn==0.49.0
+pydantic[email]==2.13.4
 websockets==15.0.1

requirements-ci/langchain.txt

@@ -1,7 +1,7 @@
 # LangChain ecosystem — tightly coupled versions
-langchain==1.3.9                 # GH#8675: bumped from 1.2.18 — PVE-2026-88512 SQL injection fix (1.2.24 does not exist on PyPI; 1.3.1 is lowest published version with fix)
-langchain-classic==1.0.7
+langchain==1.3.11                 # GH#8675: bumped from 1.2.18 — PVE-2026-88512 SQL injection fix (1.2.24 does not exist on PyPI; 1.3.1 is lowest published version with fix)
+langchain-classic==1.0.8
 langchain-community==0.4.1
-langchain-core>=1.2.31,<2.0.0    # #7049: floor bumped from ==1.2.28 — langchain-text-splitters 1.1.2 requires >=1.2.31
+langchain-core>=1.4.8,<2.0.0    # #7049: floor bumped from ==1.2.28 — langchain-text-splitters 1.1.2 requires >=1.2.31
 langchain-text-splitters==1.1.2
 langsmith==0.9.3                 # GH#8325: bumped from 0.7.31 — security fix

requirements-ci/llama-index.txt

@@ -1,5 +1,5 @@
 # LlamaIndex ecosystem — unified at 0.14.x (#2669, #2642, #2822)
-llama-index-core>=0.14.19,<0.15.0
+llama-index-core>=0.14.23,<0.15.0
 llama-index-llms-ollama>=0.10.1,<1.0.0
 llama-index-embeddings-ollama>=0.9.0,<1.0.0
 llama-index-vector-stores-chroma>=0.5.5,<1.0.0

requirements-ci/monitoring.txt

@@ -1,6 +1,6 @@
 # Observability, logging, and CLI utilities
-prometheus-client==0.20.0
-structlog==25.5.0
-rich==14.2.0
-tqdm==4.67.1
+prometheus-client==0.25.0
+structlog==26.1.0
+rich==15.0.0
+tqdm==4.68.3
 python-json-logger==4.1.0

requirements-ci/security.txt

@@ -1,5 +1,5 @@
 # Security tooling and cryptography
-pre-commit==4.2.0
+pre-commit==4.6.0
 detect-secrets==1.5.0
 pycryptodome==3.23.0
 cryptography==49.0.0

requirements-ci/storage.txt

@@ -1,6 +1,6 @@
 # Databases, caches, and ORMs
 redis>=5.0,<6.0
 chromadb==1.5.9
-sqlalchemy==2.0.50
-aiosqlite==0.21.0
-alembic==1.18.4  # migration-gate static tests import migrations.baseline (#10001)
+sqlalchemy==2.0.51
+aiosqlite==0.22.1
+alembic==1.18.5  # migration-gate static tests import migrations.baseline (#10001)

requirements-ci/utilities.txt

@@ -1,6 +1,6 @@
 # General-purpose utilities
-pyyaml==6.0.2
+pyyaml==6.0.3
 python-dotenv==1.2.2
-click==8.4.1
+click==8.4.2
 jsonschema==4.26.0
 psutil==7.2.2

requirements-dev.txt

@@ -7,5 +7,5 @@
 
 # Explicit re-declaration ensures both packages are present in the dev venv
 # even when pip resolves the -r chain in unexpected order.
-structlog>=25.5.0    # service_auth_enforcement, service_auth_logging, service_client
-aiosqlite>=0.21.0   # memory/storage/general_storage, memory/storage/task_storage, utils/async_database_pool
+structlog>=26.1.0    # service_auth_enforcement, service_auth_logging, service_client
+aiosqlite>=0.22.1   # memory/storage/general_storage, memory/storage/task_storage, utils/async_database_pool

requirements-gpu.txt

@@ -15,9 +15,9 @@
 #
 # Requires: CUDA-compatible GPU, Python 3.12.
 
-vllm>=0.21.0
+vllm>=0.23.0
 
 # vLLM pins these exact torch builds (CUDA). They intentionally override the
 # CPU torch installed in the default image when this GPU extra is used.
 torch==2.12.1
-torchvision==0.27.0
+torchvision==0.27.1

requirements.txt

@@ -4,12 +4,12 @@ paramiko>=5.0.0
 tenacity>=9.1.4
 
 # Async SSH for PKI certificate distribution (Issue #166)
-asyncssh>=2.23.1
+asyncssh>=2.24.0
 
 # opentelemetry-proto>=1.40.0 requires protobuf>=5.0,<7.0 — relaxed upper bound to <7.0.0 (#3971)
 # TensorFlow is not a project dependency; former <6.0.0 cap caused pip conflicts with protobuf 6.x
 # Bumped to 5.29.6+ for JSON recursion depth bypass fix (#3933)
-protobuf>=6.33.6,<7.0.0  # capped <7.0: opentelemetry-proto (otel 1.42) requires protobuf<7.0; the Dependabot 7.35.1 bump is unsatisfiable. 6.33.6 = latest installable.
+protobuf>=7.35.1,<8.0.0  # capped <7.0: opentelemetry-proto (otel 1.42) requires protobuf<7.0; the Dependabot 7.35.1 bump is unsatisfiable. 6.33.6 = latest installable.
 
 # vLLM (GPU inference) is an OPTIONAL extra — NOT a default dependency (#10251).
 # It pulls the full CUDA toolkit (cuda-toolkit, nvidia-*, flashinfer, CUDA torch),