chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 8 updates

[dependabot]

Updates the requirements on langchain, langchain-core, llama-index, llama-index-core, huggingface-hub, uvicorn, googleapis-common-protos and sqlalchemy to permit the latest version.
Updates langchain to 1.4.2

Release notes

Sourced from langchain's releases.

langchain-openai==1.4.2

Changes since langchain-openai==1.4.1

release(openai): 1.4.2 (#39322) fix(openai): handle ContextWindowExceededError (#39300) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(openai): filter langchain-generated content block IDs (#39209) fix(openai): preserve Responses text options (#39204) fix(openai): redact MCP authorization (#39155) chore(model-profiles): refresh model profile data (#39050)

Commits

• a18de59 release(langchain): 1.4.2 (#40621)
• 5bf6a15 fix(langchain): preserve model-generated tool calls in HITL tool call edits a...
• a893bbd chore(model-profiles): refresh model profile data (#40600)
• fd4f161 chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/text-splitters (#40579)
• 3b81e02 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/chroma (#40582)
• fa369c9 chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/chroma (#...
• eb544d3 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/fireworks (#4...
• 5e8888f chore(deps): bump filelock from 3.32.5 to 4.0.0 in /libs/partners/chroma (#40...
• a62361a chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/fireworks...
• e2d39c4 chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/fireworks ...
• Additional commits viewable in compare view

Updates langchain-core to 1.6.5

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.5

Changes since langchain-core==1.6.4

release(core): 1.6.5 (#40816) fix(core): abbreviate long tool IDs in XML buffer strings (#40792)

Commits

• c5ab14d release(core): 1.6.5 (#40816)
• 5704d9d chore(model-profiles): refresh model profile data (#40804)
• 7622d3d release(openai): 1.6.6 (#40800)
• 2dd956b docs(infra): fix AGENTS.md root setup guidance and package doc accuracy (#40794)
• 49f4b40 fix(openai): raise on error events in stream path (#40791)
• 19cadaa fix(core): abbreviate long tool IDs in XML buffer strings (#40792)
• 798441e chore(anthropic): fix integration test cassette (#40790)
• a476942 release(openai): 1.6.5 (#40787)
• 46c6bdf release(anthropic): 1.7.4 (#40786)
• 290daba fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (#40785)
• Additional commits viewable in compare view

Updates llama-index to 0.14.25

Release notes

Sourced from llama-index's releases.

v0.14.25

Release Notes

[2026-09-21]

llama-index-agent-agentmesh [0.3.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-agent-azure [0.4.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-argilla [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-arize-phoenix [0.8.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-honeyhive [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-langfuse [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-literalai [1.5.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-openinference [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-opik [1.4.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-promptlayer [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-uptrain [0.7.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-wandb [0.6.0]

... (truncated)

Changelog

Sourced from llama-index's changelog.

llama-index-core [0.14.25]

• Remove deprecated ipex-llm and optimum-intel IPEX integrations (#22406)
• fix(core): fall back when metadata replacement target value is None (#22773)
• test(core): cover empty arguments in streamed tool calls (#22825)
• Fix: restore compact and refine streaming (#22836)
• fix(core): avoid retrying failed function tools (#22841)
• feat(core): add native async support to StructuredLLMRerank (#22842)
• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-adapter [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-alephalpha [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-alibabacloud-aisearch [0.5.0]

• fix: resolve a ton of security alerts (#22855)
• chore: re-lock the 93 manifests with stuck Dependabot alerts (#22921)

llama-index-embeddings-anyscale [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-autoembeddings [0.4.0]

• fix: resolve a ton of security alerts (#22855)
• chore: re-lock the 93 manifests with stuck Dependabot alerts (#22921)

llama-index-embeddings-azure-inference [0.6.0]

• fix: resolve a ton of security alerts (#22855)
• chore: re-lock the 93 manifests with stuck Dependabot alerts (#22921)

llama-index-embeddings-azure-openai [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-baseten [0.3.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-bedrock [0.9.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-clarifai [0.6.0]

... (truncated)

Commits

• f12d46a Release 0.14.25 (#23165)
• f475afd Fix: restore compact and refine streaming (#22836)
• ac010a0 Remove deprecated ipex-llm and optimum-intel IPEX integrations (#22406)
• c60937d docs: Update VoyageAI page with new models (#22871)
• b4fdfdd docs: Update MongoDB Key-Value Stores section (#22870)
• b13d30c docs: Minor edits MongoDB Document Stores section (#22869)
• 1dec9df docs: Update MongoDB Index Store section (#22868)
• fd4a517 docs: retire LlamaHub links (#23070)
• 0f43c00 Logan/make docs acutally build (#23061)
• aa27480 remove stale api reference (#23059)
• Additional commits viewable in compare view

Updates llama-index-core to 0.14.25

Release notes

Sourced from llama-index-core's releases.

v0.14.25

Release Notes

[2026-09-21]

llama-index-agent-agentmesh [0.3.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-agent-azure [0.4.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-argilla [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-arize-phoenix [0.8.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-honeyhive [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-langfuse [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-literalai [1.5.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-openinference [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-opik [1.4.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-promptlayer [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-uptrain [0.7.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-callbacks-wandb [0.6.0]

... (truncated)

Changelog

Sourced from llama-index-core's changelog.

llama-index-core [0.14.25]

• Remove deprecated ipex-llm and optimum-intel IPEX integrations (#22406)
• fix(core): fall back when metadata replacement target value is None (#22773)
• test(core): cover empty arguments in streamed tool calls (#22825)
• Fix: restore compact and refine streaming (#22836)
• fix(core): avoid retrying failed function tools (#22841)
• feat(core): add native async support to StructuredLLMRerank (#22842)
• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-adapter [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-alephalpha [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-alibabacloud-aisearch [0.5.0]

• fix: resolve a ton of security alerts (#22855)
• chore: re-lock the 93 manifests with stuck Dependabot alerts (#22921)

llama-index-embeddings-anyscale [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-autoembeddings [0.4.0]

• fix: resolve a ton of security alerts (#22855)
• chore: re-lock the 93 manifests with stuck Dependabot alerts (#22921)

llama-index-embeddings-azure-inference [0.6.0]

• fix: resolve a ton of security alerts (#22855)
• chore: re-lock the 93 manifests with stuck Dependabot alerts (#22921)

llama-index-embeddings-azure-openai [0.6.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-baseten [0.3.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-bedrock [0.9.0]

• fix: resolve a ton of security alerts (#22855)

llama-index-embeddings-clarifai [0.6.0]

... (truncated)

Commits

• f12d46a Release 0.14.25 (#23165)
• f475afd Fix: restore compact and refine streaming (#22836)
• ac010a0 Remove deprecated ipex-llm and optimum-intel IPEX integrations (#22406)
• c60937d docs: Update VoyageAI page with new models (#22871)
• b4fdfdd docs: Update MongoDB Key-Value Stores section (#22870)
• b13d30c docs: Minor edits MongoDB Document Stores section (#22869)
• 1dec9df docs: Update MongoDB Index Store section (#22868)
• fd4a517 docs: retire LlamaHub links (#23070)
• 0f43c00 Logan/make docs acutally build (#23061)
• aa27480 remove stale api reference (#23059)
• Additional commits viewable in compare view

Updates huggingface-hub to 2.0.0

Release notes

Sourced from huggingface-hub's releases.

[v2.0.0] The httpx2 release

See MIGRATION GUIDE in docs.

💔 Breaking Change: HTTP stack moves to httpx2

See migration plan in huggingface/huggingface_hub#4802 .

huggingface_hub v2.0 replaces its HTTP dependency with httpx2: clients and transport exceptions now come from httpx2/httpcore2 instead of httpx/httpcore. Custom client factories (via set_client_factory / set_async_client_factory) and any except clauses catching transport errors must use httpx2 types. For code that must support both v1.x (starting with v1.30.0) and v2.x, import the HTTP module from huggingface_hub.utils:

from huggingface_hub.utils import get_session, httpx
try:
response = get_session().get("https://huggingface.co/api/models/gpt2")
response.raise_for_status()
except httpx.HTTPError:
...

Note that httpx2 uses the operating system's certificate trust store by default (custom CA bundles via SSL_CERT_FILE / SSL_CERT_DIR still work), logging configuration should target the httpx2 and httpcore2 loggers, and the oauth extra now requires authlib>=1.8.0.

• [Release] Prepare huggingface_hub 2.0 by @​Wauplin in #4994
• huggingface/huggingface_hub#4921

💔 Breaking Change: deprecated APIs are removed

This release also removes all APIs deprecated in 1.x:

• upload_large_folder / HfApi.upload_large_folder → use upload_folder
• duplicate_space → use duplicate_repo
• request_space_storage / delete_space_storage → use the volume APIs (set_space_volumes, delete_space_volumes)
• repo_type_and_id_from_hf_id → use parse_hf_uri
• InferenceEndpointType.PROTECTED → use AUTHENTICATED (create_inference_endpoint(type="protected") now raises ValueError)
• list_models(model_name=...) → use list_models(search=...)
• create_repo / duplicate_repo(space_storage=...) → use space_volumes
• text_generation(stop_sequences=...) → use stop
• Boolean InferenceClient(token=...) → pass a token string or None

On the CLI side, the following entry points and options are gone: huggingface-cli (use hf), hf repo and hf repo-files delete (use hf repos and hf repos delete-files), hf upload-large-folder (use hf upload), hf repos create/duplicate --storage (use --volume), hf jobs ps and hf jobs scheduled ps -f/--filter (use --status/--label), and hf skills add/update --claude (Claude Code installation is now automatic).

A migration guide covering all of this is available at https://github.com/huggingface/huggingface_hub/blob/main/docs/source/en/concepts/migration_v2.md.

• [Release] Prepare huggingface_hub 2.0 by @​Wauplin in #4994
• huggingface/huggingface_hub#4955
• huggingface/huggingface_hub#4971
• huggingface/huggingface_hub#4985

🏗️ Internal

• [CI] Support major (pre-)releases in release workflow by @​Wauplin in #4991

... (truncated)

Commits

• 97c5f5f Release: v2.0.0
• e2d609e Release: v2.0.0.rc0
• 89ae51f unbump
• 9f51867 [Release] Prepare huggingface_hub 2.0 (#4994)
• c2e6e0a Post-release: bump version to 1.34.0.dev0 (#4993)
• fa26f34 [CI] Support major (pre-)releases in release workflow (#4991)
• ac3ed2f [Xet] Show Validating progress during shard finalization (#4478)
• b904b94 Apply the repo_id length limit to the namespace as well (#4988)
• 1e0c305 Send PrivateLink config under privateService in create_inference_endpoint (#4...
• da5e244 Scope GITHUB_TOKEN permissions per job (#4982)
• Additional commits viewable in compare view

Updates uvicorn to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• See full diff in compare view

Updates googleapis-common-protos to 1.75.4

Release notes

Sourced from googleapis-common-protos's releases.

googleapis-common-protos: v1.75.4

1.75.4 (2026-09-24)

Bug Fixes

• regenerate gencode with protobuf 6.33.5 (#18461) (9cb21d0)

Changelog

Sourced from googleapis-common-protos's changelog.

Changelog

PyPI History

3.15.0 (2026-06-02)

Features

• regenerate google-cloud-d packages (#17092) (d49a2b9412b4ee9105125db36104a3e18344e0ad)

3.14.0 (2026-04-02)

Features

• Update comments for proto fields (c36aa6169035fdb14bf84b0e56e4f81291600b5a)
• Added a fields for image and table annotation output (c36aa6169035fdb14bf84b0e56e4f81291600b5a)

3.13.0 (2026-03-26)

Features

• Allow Protobuf 7.x (1eb7c268482e55971966e284dac2cbeb903adcbb)

Bug Fixes

• Require Python 3.9 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Require google-api-core >= 2.11.0 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Improve type checking (1eb7c268482e55971966e284dac2cbeb903adcbb)

3.12.0 (2026-03-23)

Features

• Add a field for upgrading previous processor version when fine tuning (ee7dd7dc168ecf943440cef38efff348e8eff095)

3.11.0 (2026-03-05)

Features

• Added a field for enabling image and table annotation for layout parser processor (6120fb0db084f5e8d1502fb1bb37594ac9976f6e)

3.10.0 (2026-02-12)

... (truncated)

Commits

• c0208c6 chore: release main (#18421)
• e654dc2 chore(main): release google-auth 2.58.1 (#18462)
• 1665e68 fix(auth): allow mTLS retry when credentials raise NotImplementedError on ref...
• 89310be chore(main): release google-crc32c 1.9.0 (#18459)
• 9cb21d0 fix: regenerate gencode with protobuf 6.33.5 (#18461)
• 54f1019 feat: update API sources and regenerate (#18446)
• a04c831 feat(firestore): add BSONDecimal128 support (#18395)
• 1bf979a fix(crc32c): remove stale pypy reference from README (#18458)
• fdaa618 chore(crc32c): run manylinux wheel validation and upload in isolated Python 3...
• 5fe1ef3 feat: add 3.15 support to gapic library classifiers (#18450)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.1.0

Release notes

Sourced from sqlalchemy's releases.

2.1.0

Released: September 24, 2026

orm

• [orm] [feature] Added _orm.composite.column_template parameter to _orm.composite(). When the composite class is a dataclass, this parameter accepts a string template such as "person_%s", containing exactly one %s placeholder, that's used to generate column names for dataclass fields that don't otherwise have an explicit name, rather than using the bare field name. This removes the need to hand-write a _orm.mapped_column() for each field when the same composite dataclass is mapped multiple times on the same class with different column-name prefixes. Pull request courtesy Leonardo Rosa.

  References: #12575

• [orm] [bug] Fixed issue where pickling an ORM object that had an instance level lazy loader established, such as when the _orm.raiseload() option is used, would emit a spurious warning regarding the loader containing additional criteria, if the object had itself been unpickled from a previous serialization. This would occur for objects that cross more than one serialization boundary, such as when using multiprocessing.

  This change is also backported to: 2.0.53

  References: #13574

• [orm] [bug] Fixed issue where calling _orm.aliased() against an existing _orm.aliased() construct, without passing an explicit selectable, would disregard the selectable of the existing construct and produce an alias of the mapped table instead, if that selectable were anything other than a table or a plain subquery, leading to incorrect results and/or non-working queries.

  This includes _orm.aliased() against a _orm.with_polymorphic() construct, which would previously produce an alias of the base mapped class only, discarding the polymorphic selectable and additional mappers. The new construct now retains these, so that criteria against subclass attributes and the innerjoin and selectable parameters of _orm.with_polymorphic() take effect, and subclass columns are loaded up front. The SQL rendered for these constructs now includes the polymorphic selectable.

  This change is also backported to: 2.0.53

  References: #13583, #13584

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b6ff76a6-a6ff-487a-8cbe-55d5eb5087ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Retargeted to main (main-first flow, #11696). Dependabot security updates always open against the default branch; this workflow re-applies the retarget after every Dependabot push, so rebases cannot revert it.

[mrveiss]

Review: two reversals in one bump, both fixed locally — push held behind the queue gate

Fix is committed at 5861b1e1ce and not yet pushed: the PR queue gate has this PR at WAIT (width 2, currently running #17707 and #17708), so starting CI here would jump the queue. Recording the findings now so they do not depend on a session surviving.

1. sqlalchemy — third reversal of the same cap

-sqlalchemy>=2.0.54,<2.1
+sqlalchemy>=2.1.0,<2.2

requirements-ai.txt:92, four lines above, still reads "Do not raise this bound without running the SLM suite against 2.1.x first" — part of the #17445 cap recording that a fresh venv at 2.1.0 killed 27 tests inside SQLAlchemy's own cache-key machinery. Restored to >=2.0.54,<2.1.

This is the third occurrence: #17706, #17711, now this one. None of them could have been caught by the ignore rule, which is keyed on update-types: semver-major while 2.0 -> 2.1 is a minor. The durable fix is a versions: [">=2.1"] ignore, tracked on #17451 and still open. Recorded in the comment in-file so the next reader does not re-derive it and knows to expect a fourth.

2. huggingface-hub 1.x → 2.0 — held, and the reason is that CI cannot see it

-huggingface-hub>=1.32.0
+huggingface-hub>=2.0.0

A major boundary, raised in one of three files that declare this package:

file	line	floor
autobot-tts-worker/requirements.txt	8	huggingface_hub>=1.32.0
autobot-infrastructure/shared/docker/ai-stack/requirements-ai.txt	26	raised here
autobot-infrastructure/autobot-npu-worker/docker/requirements-npu.txt	26	huggingface-hub>=1.32.0

The ai-stack container would have resolved 2.x while tts-worker and npu-worker resolved 1.x. Note the separator differs (huggingface_hub vs huggingface-hub), so a grep for one spelling finds two of three.

The reason for holding is specific, not a general caution about majors. The only production call is huggingface_hub.login(token=..., add_to_git_credential=False), in two tts-worker ansible templates. The test covering it, autobot-tts-worker/tests/test_hf_token.py:101, does patch.dict("sys.modules", {"huggingface_hub": mock_hub}) with a MagicMock — which accepts any signature, so assert_called_once_with(token=..., add_to_git_credential=False) passes whatever 2.x does to that function. Rendered templates are imported by no test. So a signature change would surface first on a tts-worker deployment, not in CI.

Whether that signature is still valid in 2.x is UNKNOWN, and not answerable from this repo. Stated rather than guessed, and filed as #17847 with the call sites, the three declarations and an AC to replace the module-swap mock with something that cannot pass against a wrong signature.

Left as dependabot set them

langchain 1.4.2, langchain-core 1.6.5, llama-index 0.14.25, llama-index-core 0.14.25, uvicorn[standard] 0.54.0, googleapis-common-protos 1.75.4 — all minor or patch, no recorded decision against any of them.

Sequencing

The requirements-ci/ pins these need — langchain 1.4.1 → 1.4.2 and uvicorn 0.53.0 → 0.54.0 — are raised on #17711, not duplicated here. Editing the same CI files from two open PRs is the conflict the one-PR-per-file rule exists to prevent, so this branch rebases after #17711 lands.

Collision check, since a null result nearly fooled me

My first search for ansible declarations used autobot-infrastructure/ansible/, which does not exist — it returned nothing, and nothing would have read as "no ansible involvement". The real tree is autobot-slm-backend/ansible, and it is where both huggingface_hub call sites live. A grep over a non-existent path is not a measurement.

[mrveiss]

Red CI root-caused and fixed in this PR — 9a6c81ba8a

python-suite shard 9/12 failed on ansible_requirements_parity_test.py::test_every_cross_manifest_divergence_is_in_the_baseline:

autobot-slm-backend/ansible/roles/dependency_patching/defaults/main.yml::::langchain-core:
  ansible >=1.6.3,<2.0.0, ['<every manifest in the tree>'] state ['>=1.6.5,<2.0.0']

Why it surfaced here and not on main

This PR is what completed the bump. Before it:

file	langchain-core
autobot-backend/requirements.txt	>=1.6.5
requirements-ci/langchain.txt	>=1.6.5
.../ai-stack/requirements-ai.txt	>=1.6.3 ← this PR moves it to 1.6.5
ansible dependency_patching role	1.6.3

The ansible declaration agreed with the one manifest that had not caught up, so the guard stayed quiet. Moving requirements-ai.txt to 1.6.5 makes the agreement unanimous and leaves the ansible role as the sole dissenter.

So the guard is not complaining about this bump. It is reporting that the ansible role was already behind and had been hidden by the straggler. Worth saying plainly, because the natural reading of a red on a dependabot PR is "the bump broke something", and that reading would have led to reverting the correct change.

What was fixed, and what deliberately was not

The declaration, not the baseline — as the failure message itself demands:

ansible_pip_parity_baseline.txt only shrinks — adding a line to it to clear this failure is not the fix

Adding a line would have recorded the divergence as acceptable rather than removing it, and the guard would then be green while the ansible role still deployed a version with known serialization-injection, template-injection and SSRF fixes missing.

Verification

$ python -m pytest repo_tests/ansible_requirements_parity_test.py -q
8 passed

No other open PR touches that ansible file, so this does not collide. Pushed onto this branch rather than opened as a second PR.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.