chore: bump dependencies to latest

[onmete]

Summary

• Reset chore/deps-update from latest upstream/main
• Bump ~150 Python packages in uv.lock / requirements.txt
• Pin langchain-community to >=0.3.81,<0.4.2 per Pin langchain community to 0.4.2 #2976 (resolves to 0.4.1)
• Bump python-multipart to 0.0.32 per fix: resolve CVE-2026-42561 — bump python-multipart to 0.0.32 #2989 (CVE-2026-42561)
• Regenerate requirements.hashes.source.txt for Konflux hermetic builds

langchain-community pin (from #2976)

# TODO: Remove upper bound once ragas fixes compatibility with langchain-community >= 0.4.2
# See: https://github.com/vibrantlabsai/ragas/issues/2741
"langchain-community>=0.3.81,<0.4.2",

Resolves to 0.4.1.

python-multipart CVE fix (from #2989)

Bumps python-multipart 0.0.22 → 0.0.32 (CVE-2026-42561, CVSS 7.5).

Konflux hermetic requirements

File	Status
requirements.hashes.source.txt	Regenerated — PyPI source packages with hashes
requirements.hashes.wheel.txt	Unchanged from main — RHOAI wheels (torch, scipy, sklearn, etc.)
requirements-build.txt	Unchanged from main — local pybuild-deps fails on meson==1.11.1 (no PyPI sdist)

scikit-learn==1.8.0 added to requirements.overrides.txt to keep Konflux resolution aligned with RHOAI wheel hashes.

Notable package updates

Package	Old	New
langchain	1.2.14	1.3.12
langchain-community	0.3.31	0.4.1
python-multipart	0.0.22	0.0.32
fastapi	0.135.3	0.139.0
torch (uv.lock)	2.12.1	2.13.0
transformers (uv.lock)	5.5.0	5.13.0
mypy	1.20.0	2.2.0

RHOAI-overridden packages (torch, transformers, scipy, etc.) stay at pinned versions in the container image per requirements.overrides.txt.

Verification

• make verify
• make test-unit (1146 passed)
• make test-integration (124 passed)
• Konflux pipeline (on PR)

Test plan

• uv lock --check
• make verify
• make test-unit
• make test-integration

Closes #2976
Closes #2989

Summary by CodeRabbit

• Bug Fixes

  • Updated the langchain-community version constraint to improve compatibility across supported installation environments.

• Chores

  • Improved release packaging to avoid including NVIDIA CUDA-related packages in source-generated artifacts, relying on the standard wheel distributions instead for cleaner, more reliable installs.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Updates the langchain-community requirement range, documents its temporary upper bound, and strips CUDA/NVIDIA packages from generated source requirements before source hash generation.

Changes

Requirements updates

Layer / File(s)	Summary
Dependency constraint and compatibility note pyproject.toml	Updates langchain-community to >=0.3.81,<0.4.2 and adds temporary compatibility notes.
Source requirement package filtering scripts/konflux_requirements.sh	Defines NVIDIA/CUDA packages and removes matching entries from requirements.source.txt before source hash generation.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	scripts/konflux_requirements.sh adds CUDA package stripping, which is unrelated to the linked dependency issues.	Move the Konflux hash-generation change into a separate PR or link it to an issue that covers the hash-handling work.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the PR’s dependency bump theme.
Linked Issues check	✅ Passed	The langchain-community pin and python-multipart bump satisfy the two linked issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign blublinsky for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

🧹 Nitpick comments (1)

scripts/konflux_requirements.sh (1)

22-23: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Validate the allowlist against both final inputs.

Add a generation-time check that every stripped package exists in requirements.hashes.wheel.txt and is absent from requirements.hashes.source.txt. Otherwise, a typo or omission can either retain an unavailable source artifact or remove a dependency from both installation inputs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/konflux_requirements.sh` around lines 22 - 23, Validate
STRIP_FROM_SOURCE during generation by checking each listed package exists in
requirements.hashes.wheel.txt and does not exist in
requirements.hashes.source.txt. Fail generation with a clear package-specific
error if either condition is violated, ensuring the check runs after both
requirement inputs are produced or available for validation.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/konflux_requirements.sh`:
- Around line 22-23: Validate STRIP_FROM_SOURCE during generation by checking
each listed package exists in requirements.hashes.wheel.txt and does not exist
in requirements.hashes.source.txt. Fail generation with a clear package-specific
error if either condition is violated, ensuring the check runs after both
requirement inputs are produced or available for validation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4180f020-efc1-482e-9082-357502f5c640

📥 Commits

Reviewing files that changed from the base of the PR and between 390263e and 2bc2550.

⛔ Files ignored due to path filters (2)

• requirements.hashes.source.txt is excluded by !requirements.hashes.source.txt
• requirements.overrides.txt is excluded by !requirements.overrides.txt

📒 Files selected for processing (1)

• scripts/konflux_requirements.sh

[JoaoFula]

/lgtm

[openshift-ci]

New changes are detected. LGTM label has been removed.

[onmete]

/retest

[openshift-ci]

@onmete: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ols-cluster	d8f2326	link	true	/test e2e-ols-cluster

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.