build(deps): bump the all-dependencies group across 1 directory with 10 updates

autobot-backend/requirements.txt

@@ -7,7 +7,7 @@ croniter>=6.2.4                 # GH#9027: required by LLC RoutineScheduler and
 fastapi>=0.141.1                # SECURITY UPDATE - requires starlette >=0.52.1
 uvicorn>=0.52.3
 websockets>=15.0.1,<16       # Issue #3098 + #10386: CAP <16 — langgraph-sdk 0.4.2 requires websockets >=14,<16, so >=16 makes langgraph unresolvable (ResolutionImpossible). Dependabot #10997 wrongly bumped this to >=16,<17 (bypassing the <16 cap in dependabot.yml) and broke every PR's Docker build. desktop_streaming_manager + slm_client use only legacy-compat API present in 15.x; CI pins 15.0.1. DO NOT bump past <16 until langgraph-sdk widens its cap.
-python-dotenv>=1.2.2
+python-dotenv>=1.2.3
 aiofiles>=25.1.0
 pydantic>=2.13.4
 email-validator>=2.3.0  # Issue #2953: required by pydantic for EmailStr validation
@@ -36,12 +36,12 @@ reportlab>=5.0.0    # PDF export for transcripts
 # loosens the constraint and the OneDrive connector's parsers still install (#14228, GH#9004).
 
 # AI/ML
-openai>=2.53.0
+openai>=3.2.0
 anthropic>=0.122.0
-boto3>=1.43.71                       # GH#9010: AWS Bedrock provider
+boto3>=1.43.73                       # GH#9010: AWS Bedrock provider
 chromadb>=1.5.9,<2.0.0             # upper bound guards against breaking API changes; 1.5.5+ uses regenerated protos compatible with protobuf 5.x (#4053)
 protobuf>=7.35.1,<8.0.0           # capped <7.0: opentelemetry-proto (otel 1.42) requires protobuf<7.0; Dependabot's 7.35.1 is unsatisfiable. 6.33.6 = latest installable (#4061)
-sentence-transformers>=5.7.0
+sentence-transformers>=6.0.0
 torch==2.13.0  # embeddings/transcriber/multimodal; installed CPU-only in the default image (#10251). GPU build via requirements-gpu.txt
 torchvision==0.28.0  # paired with torch 2.12.1; CPU-only by default (#10251)
 # torchaudio removed (#10251): not imported anywhere in the backend, and its 2.11.0 pin mismatched torch 2.12.0
@@ -66,7 +66,7 @@ tree-sitter-javascript>=0.25.0
 -r ../requirements.txt
 
 # Issue #858: Additional runtime dependencies for Python 3.13
-xxhash>=4.0.0          # Hash functions for LLM caching
+xxhash>=4.0.1          # Hash functions for LLM caching
 structlog>=26.1.0      # Structured logging for service auth
 llama-index>=0.14.23,<0.15.0          # Migrated from 0.13.x; floor aligned to 0.14.19 (#2642)
 llama-index-core>=0.14.23,<0.15.0     # Explicit core pin matching ecosystem (#2642)
@@ -75,7 +75,7 @@ llama-index-embeddings-ollama>=0.9.0,<1.0.0  # Ollama embeddings
 llama-index-vector-stores-chroma>=0.5.5,<1.0.0  # ChromaDB vector store
 # LangChain 1.x ecosystem — migrated from 0.3.x to fix SSRF CVE (#1572)
 langchain>=1.3.15,<2.0.0               # Issue #1572 + #10386: bumped from 1.3.1 — unblocked by websockets relaxation to >=15,<16; 1.3.10 requires langgraph>=1.2.5 + langchain-core>=1.4.7
-langchain-core>=1.5.4,<2.0.0          # Issue #1572 + #10386: bumped from 1.3.3 — langchain 1.3.10 requires >=1.4.7
+langchain-core>=1.5.6,<2.0.0          # Issue #1572 + #10386: bumped from 1.3.3 — langchain 1.3.10 requires >=1.4.7
 langchain-community>=0.4.2,<0.5.0     # Issue #1572 + #10386: bumped from 0.4.1 — aligned with ai-stack canonical (#2808)
 langchain-ollama>=1.1.0,<2.0.0        # Issue #1572: ChatOllama for QA chain
 langgraph>=1.2.11,<2.0.0               # Issue #1043 + #10386: bumped from 1.2.0 — langchain 1.3.10 requires >=1.2.5; langgraph 1.2.6 pulls langgraph-sdk 0.4.2 (websockets>=14,<16) now satisfied by websockets>=15,<16
@@ -129,6 +129,6 @@ defusedxml>=0.7.1       # MVA-2039: XML parsing for WebDAV (Nextcloud connector)
 # langsmith>=0.1.0       # Set LANGSMITH_API_KEY to activate
 
 # Content Reach optional source backends (#10932) — lazy-imported; backend starts without them
-ddgs>=9.14.4               # #10932 content-reach: keyless web search (optional, lazy)
+ddgs>=9.15.0               # #10932 content-reach: keyless web search (optional, lazy)
 trafilatura>=2.2.0        # #10932 content-reach: readable article extraction (optional, lazy)
 yt-dlp>=2026.7.4        # #10932 content-reach: YouTube caption extraction (optional, lazy)

requirements-ci/ai-ml.txt

@@ -1,8 +1,8 @@
 # AI/ML frameworks — heavy native deps, numpy-sensitive
-openai==2.53.0
-tiktoken==0.13.0   # >=0.13 ships cp314 wheels (0.11 builds pyo3-ffi from source, caps at py3.13) — #9825
+openai==3.2.0
+tiktoken==0.14.0   # >=0.13 ships cp314 wheels (0.11 builds pyo3-ffi from source, caps at py3.13) — #9825
 transformers==5.15.0
-sentence-transformers==5.7.0
+sentence-transformers==6.0.0
 -c ../constraints/shared.txt  # single source of truth for shared versions (#10524)
 numpy  # version from constraints/shared.txt
 pillow==12.3.0

requirements-ci/langchain.txt

@@ -2,6 +2,6 @@
 langchain==1.3.15                 # GH#8675: bumped from 1.2.18 — PVE-2026-88512 SQL injection fix (1.2.24 does not exist on PyPI; 1.3.1 is lowest published version with fix)
 langchain-classic==1.0.8
 langchain-community==0.4.1
-langchain-core>=1.5.4,<2.0.0    # #7049: floor bumped from ==1.2.28 — langchain-text-splitters 1.1.2 requires >=1.2.31
+langchain-core>=1.5.6,<2.0.0    # #7049: floor bumped from ==1.2.28 — langchain-text-splitters 1.1.2 requires >=1.2.31
 langchain-text-splitters==1.1.2
 langsmith==0.11.0                 # GH#8325: bumped from 0.7.31 — security fix

requirements-ci/monitoring.txt

@@ -3,4 +3,4 @@ prometheus-client==0.26.0
 structlog==26.1.0
 rich==15.0.0
 tqdm==4.70.0
-python-json-logger==4.1.0
+python-json-logger==4.2.0

requirements-ci/networking.txt

@@ -7,7 +7,7 @@ asyncssh>=2.24.0,<3.0.0   # production dep (requirements.txt); pki/distributor.p
 # #14551: production dep (autobot-backend/requirements.txt, #10932 content-reach
 # keyless web search, lazy). tests/content_reach/sources/test_web_search.py
 # gates on pytest.importorskip/find_spec("ddgs") — silently skipping without this.
-ddgs>=9.14.4
+ddgs>=9.15.0
 # #14551: production dep (autobot-backend/requirements.txt, #10932 content-reach
 # YouTube caption extraction, lazy). tests/content_reach/sources/test_youtube.py
 # gates on pytest.importorskip("yt_dlp") — silently skipping without this.

requirements-ci/utilities.txt

@@ -1,6 +1,6 @@
 # General-purpose utilities
 pyyaml==6.0.3
-python-dotenv==1.2.2
+python-dotenv==1.2.3
 click==8.4.2
 jsonschema==4.26.0
 psutil==7.2.2

requirements-dev.txt

@@ -9,4 +9,4 @@
 # even when pip resolves the -r chain in unexpected order.
 structlog>=26.1.0    # service_auth_enforcement, service_auth_logging, service_client
 aiosqlite>=0.22.1   # memory/storage/general_storage, memory/storage/task_storage, utils/async_database_pool
-fakeredis[lua]>=2.37.0    # llm_shared provider-degradation cross-worker tests (#11519); [lua] for evalsha/register_script tests (#11604)
+fakeredis[lua]>=2.37.1    # llm_shared provider-degradation cross-worker tests (#11519); [lua] for evalsha/register_script tests (#11604)