Refresh uv.lock to releases at least a week old

[thesanogoeffect]

Requested by Jakub · project thread

Before: some parts of uv.lock were months behind: transformers 5.14.1, tokenizers 0.22.2, onnxruntime 1.27.0, anthropic 0.118.0, google-genai 2.13.0, instructor 1.15.4, pyarrow 25.0.0, mlx-lm 0.31.3. Renovate's lock maintenance is off, so nothing was moving the lock.

After: every locked package is at its newest release published before 2026-10-10, which matches Renovate's 7-day minimumReleaseAge. 164 packages change. pyproject.toml is untouched, since bibr already requires transformers>=5.0.0.

Held back on purpose:

• transformers < 5.18, torch 2.13.0: vLLM 0.31.0 requires transformers<5.18 and torch==2.13.0. Without the hold, uv forks the lock: 5.17 on Linux, and 5.19 + torch 2.14 + huggingface-hub 2.x elsewhere. Holding keeps one version on every platform.
• onnxruntime-gpu 1.26.0 and its nvidia-* CUDA libraries: 1.26.0 is the last CUDA 12 build, and the docs and tests pin the reinstall to it.
• openai < 3: on macOS/Windows it would have jumped to 3.3.0 under instructor's OpenAI-compatible path (vllm-mlx, llama.cpp). That deserves its own PR.
• ruff 0.15.22: 0.17 reformats Python code blocks inside Markdown docs and adds LOG004.

One test changed. anthropic 0.125 dropped claude-opus-4-1-20250805 from its non-streaming token table, so the cap test now uses claude-opus-4-0, which is still listed. bibr reads that table, so runtime behaviour follows the SDK.

How: I ran uv lock --upgrade --exclude-newer 2026-10-10T00:00:00Z, re-pinned the holds with uv lock -P, then ran uv lock without --exclude-newer so the lock doesn't record a cutoff. PR CI is green. The Maintenance workflow, dispatched on this branch, passed the macOS and Windows core suites and the scheduled audit. Its advisory full-repo mypy job fails, as it does on main: 786 errors here vs 794 on main, with no new error kinds.

[thesanogoeffect]

Advisory / full mypy debt (Maintenance workflow) fails here, but it isn't this PR's. That job runs full-repo mypy over existing typing debt and is continue-on-error. On main (cd7150a), it reports 794 errors locally. With this lock it reports 786: 8 fewer and no new error kinds, just reworded messages from newer mypy/pandas-stubs and a tokenizers stub warning gone. The blocking strict-core mypy step in CI passes. No fix to port, and I'm leaving it as is.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.55%. Comparing base (cd7150a) to head (5ac757c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #208   +/-   ##
=======================================
  Coverage   90.55%   90.55%           
=======================================
  Files         309      309           
  Lines       57282    57282           
  Branches    10374    10374           
=======================================
  Hits        51873    51873           
  Misses       3450     3450           
  Partials     1959     1959           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.