Upgrade dependencies: 400 advisories down to 69

[adamjohnwright]

Everything reachable without a major-version migration. 151 packages moved; LangChain, chromadb and torch deliberately did not, and each has a reason.

	advisories
before	400 across 43 packages
after	69 across 17 packages

Removed: black and isort

ruff replaced both — the README and ci.yml already said so — but they stayed in the dev group. black carried three advisories for a tool nothing invokes.

Two caps added, each because the upgrade broke something real

transformers <5. transformers 5 requires torch>=2.5 and, finding the pinned 2.4.1+cpu, disables PyTorch rather than failing:

[transformers] Disabling PyTorch because PyTorch >= 2.5 is required but found 2.4.1+cpu

get_embedding("huggingfacelocal", ...) then raises NameError: name 'nn' is not defined from inside sentence-transformers. Caught by building that provider, not by the suite — which never touches it. Lifting the cap means moving torch first: platform markers, custom CPU wheel source, its own change.

posthog <6. chromadb 0.6 calls posthog.capture(user_id, name, props) positionally; posthog 6 takes capture(event, **kwargs). Nothing breaks — telemetry is off anyway — but chromadb logs the failure at ERROR on every startup and every collection open. An error log nobody can act on is one people learn to skip.

chainlit 2.0.602 → 2.11.0 changed three signatures we implement

All runtime breaks, not typing noise:

• oauth_callback is now async and takes the OIDC id_token as a fifth argument. The old sync four-argument version would have failed at login, not at import.
• set_chat_profiles passes the current user.
• StorageClient.upload_file gained content_disposition — forwarded, not dropped: it is what makes an attachment download under its original filename.

Also

pyasn1 ^0.5.1 → ^0.6.4 (8 advisories), lxml ^5 → ^6 (2).

A newer typeshed made ast.Constant.value str | bytes | int | ... rather than Any, which found a real latent bug in test_alliance_columns: " ".join over a list that could hold non-strings.

Verified beyond the gates

None of the above is caught by ruff/mypy/pytest, so:

• the chainlit app imports and registers its hooks
• the RAG chain answers a real question through both invoke and ainvoke
• the huggingfacelocal embedding provider builds
• BeautifulSoup still parses with lxml 6

186 tests pass, mypy clean, ruff clean.

What remains, and why

torch (23) needs 2.13 and a new wheel source. The LangChain family and chromadb need 1.x — that is the next piece of work, and it is now unblocked by the retriever rewrite, which is what the rewrite was for.