chore: bump all dependencies to latest versions

[LukeMainwaring]

Routine dependency refresh. No source changes were needed — every bump validated clean.

Why now

next 16.2.10 → 16.3.3 is a security release, patching two unauthenticated RCEs (one on Windows-hosted servers, one in the Image Optimization API via AVIF). That's the strongest reason not to sit on this batch.

What changed

Backend — pydantic-ai/pydantic-evals 2.11.0 → 2.35.3, librosa 0.11 → 1.0.0, transformers 5.14.1 → 5.16.1, numpy 2.4.6 → 2.5.2, fastapi 0.139.2 → 0.141.1, plus alembic, braindecode, modal, uvicorn, sqlalchemy, pydantic, scipy, and the ruff/mypy/pre-commit dev pins.

Frontend — 28 packages. motion 12.42.2 → 13.1.1 (major), next 16.2.10 → 16.3.3, ai 7.0.29 → 7.0.84, @ai-sdk/react 4.0.32 → 4.0.87, lucide-react 1.24 → 1.35, axios 1.18.1 → 1.20.0, @tanstack/react-query 5.101.2 → 5.102.8, recharts 3.9.2 → 3.10.1, ultracite 7.9.4 → 7.10.7, @biomejs/biome 2.5.4 → 2.5.11, plus Radix/React/types patches.

Docs — refreshed docs/pydantic-ai-llms-full.txt and docs/vercel-ai-sdk-ui.txt; reinstalled the library-skills symlinks against the new venv.

Breaking changes checked, none apply

Three were close calls:

• Motion 13.0 dropped the optional @emotion/is-prop-valid dep in favor of explicit MotionConfig isValidProp. We use neither — greeting.tsx and emotion-trajectory.tsx only import motion from motion/react.
• librosa 1.0 expired long-standing deprecations (.H, set_fftlib, note_to_hz quantization). Our only call is librosa.load(...) in ml/contrastive.py:150.
• Ruff 0.16 expanded default rules from 59 to 413. Irrelevant while backend/pyproject.toml pins select = ["I", "F401"] — but worth remembering if that explicit select ever goes away.

Also verified: NumPy 2.5 dropped Python 3.11 (we're on 3.13), and transformers 5.16's tensor-parallel / Fuyu / cache-cropping changes don't touch our ClapModel/ClapProcessor path.

The one deprecation in range — pydantic-ai 2.35.0 deprecating RunContext.capability_loaded and available_capability_ids — has no usages in the backend.

Verification

mypy --strict, ruff, 175 unit + 28 integration tests, frontend lint, tsc --noEmit, and a full next build all pass.

Follow-ups (not in this PR)

The pydantic-ai jump spans 24 minor versions and opens up some things worth doing separately:

• Deferred/hidden tools + load_capability (2.26.0) — the Spotify-library tool group is useless without a connection and irrelevant to most turns; deferring it would cut prompt size and misfire rate.
• AgentRun.cancel() / RunCancelled (2.26.0) — routers/agent.py has no disconnect handling, so closing a tab mid-stream keeps paying for the generation.
• ToolFailed (2.16.0) — the framework-native version of the sanctioned inline catch in retrieval_tools.py. Touches ADR-0003, so it needs its own discussion.
• cost on RunUsage / cost_limit on UsageLimits (2.23.0) — useful for tests/evals/.

🤖 Generated with Claude Code

https://claude.ai/code/session_015rKJasVuaxjg9o2pNtKRAf