[Copilot]

Description

This is the automated dependency sweep. The PR makes no net changes yet. The bumped specifiers were committed and then reverted because uv lock --upgrade never resolved through the Microsoft feed proxy, and leaving them in would leave pyproject.toml out of sync with uv.lock.

Related Issues

Automated "Update Dependencies Sweep" issue.

Proposed Changes

Nothing has landed yet. These are the planned bumps, each the newest release more than 7 days old on PyPI:

• Root dev group: coverage 7.17, ipykernel 7.4, mkdocs-material 9.8, mkdocs-jupyter 0.27, pandas-stubs 3.1, poethepoet 0.49, pytest 9.2, ruff 0.17
• packages/*: pydantic 2.14, azure-identity 1.27, azure-cosmos 4.17, azure-storage-blob 12.31, pandas 3.1, pyarrow 26, lancedb 0.41, devtools 0.13, json-repair 0.64, markitdown 0.1.9, litellm ==1.106.6, fastapi >=0.162.0, orjson >=3.13.0
• Held where they are:
  • numpy ~=2.4 and networkx ~=3.6: newer versions require Python 3.12+.
  • nltk ~=3.9.0: 3.10 breaks the noun-phrase extraction golden data.
  • graspologic-native <1.3: 1.3 breaks the Leiden clustering golden data.

Checklist

• I have tested these changes locally. (Baseline only: poe check and poe test_unit passed before any change; nothing was tested after the bumps.)
• I have reviewed the code changes.
• I have updated the documentation (if necessary).
• I have added appropriate unit tests (if applicable).

Additional Notes

Two problems with the feed proxy blocked the lock:

1. Missing wheel metadata. The proxy only fetches a wheel after it is first requested, so .whl.metadata returns 404 until then (seen with spacy 3.8.17/3.8.18, thinc 8.3.14 and preshed 3.0.15). Retrying moves past one wheel at a time, but the lock never finished in the time available.
2. Upload dates. --exclude-newer filters on the date the proxy fetched each wheel, which can be days after the PyPI release. litellm 1.106.6 (PyPI 10-28, proxy 11-04), pandas-stubs 3.1 (PyPI 10-29, proxy 11-05) and pytest 9.2 (proxy 11-03) were rejected even though PyPI released them more than 7 days ago.

To finish:

uv lock --upgrade --exclude-newer <7-days-ago> \
  --exclude-newer-package litellm=<date> \
  --exclude-newer-package pandas-stubs=<date> \
  --exclude-newer-package pytest=<date>
# repeat until it resolves, then:
uv lock && uv sync --all-packages

After that: fix any breakage from the upgrades, add a semversioner patch entry, and re-run poe check and poe test_unit. Likely breakage includes new ruff 0.17 rules, and litellm ≥1.106 may need typing.cast around its completion()/embedding() calls in graphrag-llm.

• Fixes Update Dependencies Sweep #2622