Sweep 3 requirements files to latest (fixes CRITICAL sentence-transformers CVE, 3 CVEs unfixable upstream)

[odosk]

⚠️ This PR was created by an AI assistant (Claude). Please review all changes carefully before merging.

Once approved, please merge it — this is an automated dependency-update PR and merging is the final step that closes out the linked Mend/Jira findings.

Summary

Sweeps the three Mend-flagged requirements files to their latest resolvable PyPI versions. The headline fix is sentence-transformers 5.5.1 → 6.0.0, which resolves a CRITICAL CVE (CVE-2026-68770, CVSS 9.3): arbitrary code execution via an import_module_class trust-gate bypass, fixed in commit ae1acc3 (huggingface/sentence-transformers#3807), shipped in the 6.0.0 release.

Three other Mend findings in this sweep have no released upstream fix and are called out below under "Cannot fix in this PR."

Changed Files

visual-retrieval-colpali/src/legacy-requirements.txt

Package	Old	New
sentence-transformers	5.5.1	6.0.0
peft	0.19.1	0.20.0
accelerate	1.13.0	1.14.0
aiohappyeyeballs	2.6.2	2.7.1
annotated-types	0.7.0	0.8.0
anyio	4.13.0	4.14.2
apsw	3.53.2.0	3.53.4.0
cachetools	7.1.4	7.1.7
certifi	2026.5.20	2026.7.22
cffi	2.0.0	2.1.1
charset-normalizer	3.4.7	3.5.1
click	8.4.1	8.4.2
cloudpathlib	0.24.0	0.25.0
colpali-engine	0.3.17	0.3.18
cryptography	50.0.0	50.0.1
docker	7.1.0	7.2.0
fastcore	1.13.3	2.2.15
filelock	3.29.3	3.32.4
fsspec	2026.4.0	2026.7.0
google-api-core	2.31.0	2.34.0
google-api-python-client	2.197.0	2.199.0
google-auth	2.53.0	2.57.0
google-auth-httplib2	0.4.0	0.4.2
googleapis-common-protos	1.75.0	1.75.2
grpcio	1.81.0	1.83.0
grpcio-status	1.81.0	1.83.0
hf-xet	1.5.1	1.6.0
hpack	4.1.0	4.2.0
huggingface-hub	1.18.0	1.28.0
idna	3.18	3.19
lxml	6.1.1	6.1.2
matplotlib	3.10.9	3.11.1
mteb	2.15.3	2.20.2
numpy	2.4.6	2.5.2
packaging	26.2	26.3
pandas	3.0.3	3.0.5
pip	26.2	26.2.1
polars	1.41.2	1.44.0
proto-plus	1.28.0	1.28.4
protobuf	7.35.0	7.36.0
pyarrow	24.0.0	25.0.1
pydantic-core	2.47.0	2.48.0
pygments	2.20.0	2.21.0
pypdf	6.15.0	6.16.2
python-dotenv	1.2.2	1.2.3
python-fasthtml	0.14.2	0.14.12
pytz	2026.2	2026.3.post1
pyvespa	1.2.1	1.2.4
regex	2026.5.9	2026.7.19
scipy	1.17.1	1.18.1
sentencepiece	0.2.1	0.2.2
setuptools	83.0.0	84.0.0
smart-open	7.6.1	8.0.1
soupsieve	2.8.4	2.9.2
spacy	3.8.14	3.8.16
starlette	1.3.1	1.6.0
tqdm	4.68.2	4.70.0
transformers	5.12.0	5.15.1
typer	0.26.7	0.27.1
typing-extensions	4.15.0	4.16.0
tzdata	2026.2	2026.3
uvicorn	0.49.0	0.52.4
vespacli	8.703.17	8.738.17
websockets	16.0	17.0.1
wrapt	2.2.1	2.3.0
xxhash	3.7.0	4.0.1
yarl	1.24.2	1.24.5

reverse-image-search/script/requirements.txt

No changes — every entry in this file uses a floating >= constraint (no == pins), so there is nothing for the sweep to bump. torchvision>=0.20.0 already floats to the latest resolvable release (currently 0.28.0) with no upper bound.

examples/agentic-streamlit-chatbot/advanced_app/requirements.txt

No package-version changes — this file has no version pins at all (langchain_community and its siblings are listed bare). Only a trailing-newline normalization from the sweep tool.

CVEs Addressed

Package	CVE(s)	Severity	Fix version reached
sentence-transformers	CVE-2026-68770	critical	6.0.0

⚠️ Cannot fix in this PR

Project	Package	CVE	Reason
reverse-image-search	torchvision @ 0.28.0	CVE-2026-65918	No released fix — affected through 0.28.0 (latest); fixed in unreleased commit 4e05dc2 (pytorch/vision#9520). Tracking upstream.
visual-retrieval-colpali	peft @ 0.20.0	CVE-2026-71281	No released fix — 0.20.0 is latest and still calls torch.load without weights_only in LoRA-GA/CorDA init (GHSA-g7pc-47rc-wvwf). Bumped 0.19.1→0.20.0 as part of the sweep; residual exposure remains.
examples/agentic-streamlit-chatbot	langchain-community @ 0.4.2	CVE-2026-72848	No released fix — 0.4.2 is latest; SitemapLoader nested-sitemap SSRF unpatched upstream (langchain issue #38814).

Implementation Notes

• sentence-transformers 5.5.1 → 6.0.0 is a major-version bump. Please review the 6.0.0 changelog for breaking API changes before merging, particularly around model loading/trust-gate behavior since that's the area the CVE fix touched.
• huggingface-hub jumped 1.18.0 → 1.28.0 and fastcore jumped 1.13.3 → 2.2.15 as side effects of the sweep — both are larger-than-patch bumps worth a second look.
• torch itself was not touched in this sweep (stayed at 2.13.0 in legacy-requirements.txt; floating >=2.13.0 in reverse-image-search).
• The two files with no == pins (reverse-image-search/script/requirements.txt and examples/agentic-streamlit-chatbot/advanced_app/requirements.txt) were run through the same sweep tool but had nothing to rewrite, since floating/unpinned requirements already resolve to latest at install time.

Verification

$ grep -E "^(sentence-transformers|peft)==" visual-retrieval-colpali/src/legacy-requirements.txt
peft==0.20.0
sentence-transformers==6.0.0

$ grep -E "^torchvision" reverse-image-search/script/requirements.txt
torchvision>=0.20.0

$ grep -E "langchain_community|langchain-community" examples/agentic-streamlit-chatbot/advanced_app/requirements.txt
langchain_community

Local test suites not run — these are demo/sample apps requiring Vespa services and model downloads; not replicable in an isolated environment. CI on this PR is the verification gate.

CI note: the test / htmlproofer failure (Link checker workflow) is pre-existing — the same workflow fails on master in its three most recent runs (2026-08-24 through 2026-08-26), unrelated to this requirements sweep.

[radu-gheorghe]

LGTM. I see that build passes as well. Merging.