fix(deps): make backend hash lock pip-installable on Python 3.14 (PR 1390)

[seonghobae]

Description

Follow-up for Dependabot #1390. The backend-python hash lock was not pip install --require-hashes installable on Python 3.14:

1. pydantic==2.13.4 requires exact pydantic-core==2.46.4, but the lock floated pydantic-core==2.48.0 (ResolutionImpossible).
2. After that pair was corrected, openai==3.0.0 requires hashed httpx2, which was missing from the lock.
3. An unconstrained recompile also pulled ruff==0.16.3 (large lint-rule churn) and langsmith>=0.10.18 (pytest plugin uses deprecated asyncio.iscoroutinefunction, fatal under PYTHONWARNINGS=error).

This commit (373d9cd8) is also pushed to dependabot/pip/backend/backend-python-d344204b7b so #1390 can go green without a squash or empty requeue.

Recompiles backend/requirements-hashes.txt with backend/requirements-compile-constraints.txt:

• pydantic-core==2.46.4
• ruff==0.15.21
• langsmith==0.10.2

Contract tests and the container-provenance doc now assert the pydantic/pydantic-core pair, httpx2==2.10.0, langsmith==0.10.2, and ruff==0.15.21. Does not bump VERSION. Does not touch #1376 or #1392.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Verification

python -m pip install --require-hashes -r backend/requirements-hashes.txt
cd backend
ruff check .
PYTHONWARNINGS=error DISABLE_BACKGROUND_WORKERS=1 python -m pytest \
  tests/test_container_dependency_pin_contract.py \
  tests/test_release_governance.py -q
PYTHONWARNINGS=error DISABLE_BACKGROUND_WORKERS=1 python -m pytest -q

Local Python 3.14.7 evidence:

• pip install --require-hashes of the repaired lock: success
• ruff check .: All checks passed
• pin/governance tests: 37 passed
• full backend suite: 1732 passed, 32 skipped, no Timeout/Fatal/Warn/Denied

PR 1390 pin contract tests

  

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fc6847c8-5f07-46b7-b954-fc89816b10d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate is not ready for 373d9cd8abb267ce4390958941dd038be6223b7e:

• Draft PR: merge automation is paused.
• Required check security is FAILURE on the current head.

[seonghobae]

중복 repair lane 정리: 현재 Dependabot #1390 head 866f8d511c19fe4ab77576738bb94ae9d688ad4e가 이 repair head 373d9cd8abb267ce4390958941dd038be6223b7e를 직접 ancestor로 포함하고 있어, hash-lock/Python 3.14 수정은 이미 canonical Dependabot branch에 보존되었습니다. 별도 repair PR은 추가 고유 변경이 없으므로 superseded로 종료합니다. #1390의 current-head Checks/review/병합 조건은 별도로 다시 검증해야 합니다.