fix(deps): make backend hash lock pip-installable on Python 3.14 (PR 1390)

CHANGELOG.md

@@ -1,4 +1,5 @@
 ## [Unreleased]
+- backend hash lock을 pip `--require-hashes`가 Python 3.14에서 설치 가능하게 다시 고정합니다: `pydantic==2.13.4`의 정확한 `pydantic-core==2.46.4`, `openai==3.0.0`이 요구하는 `httpx2`, 그리고 `PYTHONWARNINGS=error`를 깨는 `langsmith>=0.10.18` pytest plugin 대신 검증된 `langsmith==0.10.2`. lint 규칙이 바뀌는 `ruff==0.16.3` 범프는 `0.15.21`에 유지합니다.
 - EmailDetail 테스트가 지원하지 않는 스레드 병합/분리 버튼을 `textContent`뿐 아니라 `aria-label`과 `title` 접근 가능 이름으로도 검출하도록 바꿔, 아이콘 전용 버튼 회귀를 놓치지 않습니다.
 ### 주제 측정 경계 (Topic Measurement)
 

backend/pyproject.toml

@@ -4,45 +4,45 @@ version = "0.14.4"
 description = "Naruon FastAPI backend"
 requires-python = ">=3.12"
 dependencies = [
-  "fastapi==0.139.0",
-  "starlette==1.3.1",
-  "uvicorn==0.51.0",
+  "fastapi==0.141.1",
+  "starlette==1.6.0",
+  "uvicorn==0.52.3",
   "httpx==0.28.1",
-  "pydantic-settings==2.14.2",
+  "pydantic-settings==2.15.0",
   "aiosmtplib==5.1.2",
   "aioimaplib==2.0.1",
-  "sqlalchemy==2.0.51",
-  "alembic==1.18.5",
-  "greenlet==3.5.3",
+  "sqlalchemy==2.0.52",
+  "alembic==1.19.1",
+  "greenlet==3.5.5",
   "asyncpg==0.31.0",
   "pgvector==0.5.0",
   "rankweave==0.1.0",
-  "openai==2.45.0",
+  "openai==3.0.0",
   "langchain-text-splitters==1.1.2",
   "tiktoken==0.13.0",
   "google-api-python-client==2.198.0",
-  "google-auth-httplib2==0.4.0",
+  "google-auth-httplib2==0.4.1",
   "google-auth-oauthlib==1.4.0",
   "email-validator==2.3.0",
   "cryptography==50.0.0",
   "python-multipart==0.0.32",
-  "prometheus-fastapi-instrumentator==8.0.2",
-  "opentelemetry-api==1.43.0",
-  "opentelemetry-sdk==1.43.0",
-  "opentelemetry-instrumentation-fastapi==0.64b0",
-  "opentelemetry-exporter-otlp==1.43.0",
+  "prometheus-fastapi-instrumentator==8.1.0",
+  "opentelemetry-api==1.44.0",
+  "opentelemetry-sdk==1.44.0",
+  "opentelemetry-instrumentation-fastapi==0.65b0",
+  "opentelemetry-exporter-otlp==1.44.0",
   "protobuf==7.35.1",
-  "setuptools==83.0.0",
-  "wheel==0.47.0",
-  "websockets==16.1",
+  "setuptools==84.0.0",
+  "wheel==0.48.0",
+  "websockets==17.0.1",
   "PyJWT==2.13.0",
-  "icalendar==7.2.0",
+  "icalendar==7.2.2",
   "defusedxml==0.7.1",
 ]
 
 [dependency-groups]
 dev = [
-  "coverage==7.15.1",
+  "coverage==7.15.4",
   "pytest==9.1.1",
   "pytest-asyncio==1.4.0",
   "ruff==0.15.21",

backend/requirements-agent.txt

@@ -14,28 +14,32 @@
 # ``OpenAIModel`` in 2.x) and constructs the model via ``OpenAIProvider``.
 # Version 2.8.0 is the newest 2.x release compatible with the core
 # requirements-hashes.txt pin of openai==2.44.0; 2.9.0 requires openai>=2.45.0.
-pydantic-ai-slim[openai]==2.9.0 \
-    --hash=sha256:11b812833eb75cfcc31c86b6e2db75e28cade6bb746844e28a40eb51b04a09d3 \
-    --hash=sha256:560a860cb67cf7732b16fb40e1d9205d75c02934e75e41db7ccb104ebc9ea266
+pydantic-ai-slim[openai]==2.30.0 \
+    --hash=sha256:0125bd525f0ff24127ff62c9da9b7a530b58110ce5c84fc8a1dce5c35e7565bd \
+    --hash=sha256:d7619f28f11b5a035047229bbdf67047fc755c27b01be5d6f36672be117625b7
     # via -r backend/requirements-agent.txt
-genai-prices==0.0.71 \
-    --hash=sha256:1d13111563af2b1ce43ccfacf77b7ac3216ad704c644408a56e11b181fe0d128
+genai-prices==0.1.2 \
+    --hash=sha256:930ffd34e3b65e32d24818073a2fb65f0174c4de7f6afbebfee1efdf8b003877 \
+    --hash=sha256:bdcdb9b358de01d9c3d4337a86b8dbfbf4e8044c2c064e6e3c4a6fef2f640382
     # via pydantic-ai-slim
 griffelib==2.1.0 \
     --hash=sha256:cc7b3d2d2865ad0b909fcc38086e3f554b5ea7acbaa7bbb7ecaa3f5dfb7d9f00
     # via pydantic-ai-slim
-httpcore2==2.5.0 \
-    --hash=sha256:5ce35188de461d31e8d000bfb8ef8bf22c6c16587a211e5571deaa5e9bdf842a
+httpcore2==2.10.0 \
+    --hash=sha256:13c0cc3d1919d4f28457f60cd2c2abe04113a8af184ccf1142811beba936f9dc \
+    --hash=sha256:7df06cfb34070cae4f7c89be69dc1095eca138e9704ceffb98d25c1912ab6f01
     # via httpx2
-httpx2==2.5.0 \
-    --hash=sha256:3d2d4d9cf4b61f1a1f46a95947cfdb47e80cb56a2f91c6256ac8f58e4891df41
+httpx2==2.10.0 \
+    --hash=sha256:5e3194a432701e1cc6f69a8b1b2fa199ef907013fede8d9a09a2c5b7b8141a18 \
+    --hash=sha256:8741d7329fe2c7885fc9ceb61c8217acfb87a85f75723714b89ebf7ad7196338
     # via genai-prices
-logfire-api==4.37.0 \
-    --hash=sha256:1d756f8ba23aa56d438e0ba2c0f529a00fcac975b8785c561b058267f9465088
+logfire-api==4.40.0 \
+    --hash=sha256:f4631d5ca6af95e9d4dadc4f63619ebb8f2300eecfca0ca99c84403d6ea605de \
+    --hash=sha256:f8b7309235a942368b927f00e0a1869ff0820833f264a30e77a35f1da829c130
     # via pydantic-graph
-pydantic-graph==2.9.0 \
-    --hash=sha256:0ee8ad7b69d628037f3194d506b6c7099e416f25e477f9590da110cdaf48c649 \
-    --hash=sha256:a6d146cfd97b086e4334afc6717b2d078a3f102631cfe05e421fda2ca5a7046f
+pydantic-graph==2.30.0 \
+    --hash=sha256:8282c1091fc03f2d4f40e83ab7ca09e3c117df6b645bbd6cd433561a8064e361 \
+    --hash=sha256:9bf43c1e2785598399b4679a2837173c0e3018c8167d86c2f99713685e4ba845
     # via pydantic-ai-slim
 truststore==0.10.4 \
     --hash=sha256:adaeaecf1cbb5f4de3b1959b42d41f6fab57b2b1666adb59e89cb0b53361d981

backend/requirements-compile-constraints.txt

@@ -0,0 +1,6 @@
+# Keep `uv pip compile` of backend/requirements-hashes.txt installable on
+# Python 3.14 with `pip install --require-hashes` and warning-clean under
+# PYTHONWARNINGS=error. Do not float these pins without a matching test update.
+pydantic-core==2.46.4
+ruff==0.15.21
+langsmith==0.10.2