[Copilot]

Description

This sweep updates direct dependencies to the newest releases that are at least 7 days old and available on the Microsoft feed proxy. It also refreshes uv.lock. Two library upgrades required small typing changes in graphrag-llm.

Related Issues

Automated dependency sweep.

Proposed Changes

• Dev group (root pyproject.toml): coverage~=7.17, ipykernel~=7.4, mkdocs-material~=9.8, poethepoet~=0.49, ruff~=0.17.
• Runtime (packages/*): pydantic~=2.14, azure-identity~=1.26, azure-cosmos~=4.17, azure-storage-blob~=12.31, devtools~=0.13, json-repair~=0.64, markitdown[pdf]~=0.1.9, lancedb~=0.40.0, pyarrow~=26.0.
• litellm: exact pin moved from 1.100.1 to 1.106.3.
• uv.lock: regenerated with uv lock --upgrade. The 7-day cutoff (--exclude-newer) was applied when resolving but is not saved in the lockfile.
• Changes needed for ruff 0.17: the new rule UP052 asks that @contextmanager functions return Generator[T, None, None] instead of Iterator[T]. This applies to 5 sites in graphrag-llm.
• Changes needed for litellm 1.106: its type hints now say completion() and embedding() may return a Coroutine. Both calls are wrapped in typing.cast:

  response = cast("ModelResponse | CustomStreamWrapper", litellm.completion(**new_args))
  response = cast("EmbeddingResponse", litellm.embedding(**new_args))

• Changelog: added a semversioner patch entry.

Not bumped:

Package	Reason
graspologic-native <1.3, nltk ~=3.9.0	Newer versions change outputs and break the stored expected test data.
numpy ~=2.4, networkx ~=3.6, mkdocs-jupyter ~=0.26	The next versions require Python ≥3.12; the workspace still supports 3.11.
pandas	3.1.0 is not yet eligible on the proxy, so the lock has 3.0.6.

Checklist

• I have tested these changes locally.
• I have reviewed the code changes.
• I have updated the documentation (if necessary).
• I have added appropriate unit tests (if applicable).

Additional Notes

• Needs a decision before merge: litellm ≥1.106 no longer sets TIKTOKEN_CACHE_DIR when it is imported. Its bundled offline tokenizer files are now loaded only when needed.
  • Before this bump, graphrag's tiktoken.get_encoding("o200k_base") worked offline only because of that import.
  • Now the encoding is downloaded on first use. Seven unit tests hit this (test_chunker, test_sort_context, test_encoding). They were confirmed passing only with TIKTOKEN_CACHE_DIR pointed at litellm/litellm_core_utils/tokenizers. They should pass on networked CI runners, but CI has not run yet.
  • Air-gapped users will now need network access or that variable set. Decide whether this is acceptable, or whether to set TIKTOKEN_CACHE_DIR explicitly.
• Integration tests: the 4 Azure blob storage integration tests were not exercised locally because the storage emulator (Azurite) was not running.

• Fixes Update Dependencies Sweep #2617