0.69.18

Dependencies / security

• Refreshed uv.lock to clear 12 Dependabot alerts (#1281). authlib
  1.7.2 → 1.9.1 (8 alerts, 1 critical), litellm 1.93.2 → 1.100.4 (2 high),
  msgpack 1.2.1 → 1.2.3 (1 high), nltk 3.10.3 → 3.10.4 (1 high). Each
  package moved to the minimum fixed version, so no unrelated new releases
  were pulled in, and no pyproject.toml range was touched — nothing
  changes for users installing via pip, since the lockfile is not shipped in
  the wheel or sdist. It matters for anyone who builds from this repo, and for
  CI.

  Side effect worth knowing: uv lock --check now passes. On the previous
  lock it failed, so every uv sync in CI had been silently re-resolving the
  dependency graph.

  Still open upstream and deliberately not forced: alerts gated on a release
  that requires Python ≥ 3.11 (langroid supports ≥ 3.10) — pillow,
  filelock, tornado, dnspython — plus a handful with no upstream fix at
  all (accelerate, chromadb, transformers, nltk #321). Forcing those
  would downgrade the whole web stack on Python 3.10 rather than fix anything.

No library code changed in this release; the full test suite was run on the
merge commit and passed.

Full Changelog: 0.69.17...0.69.18