chore(deps): bump python from 3.14.9-slim to 3.15.0-slim

Bumps python from 3.14.9-slim to 3.15.0-slim.

---
updated-dependencies:
- dependency-name: python
  dependency-version: 3.15.0-slim
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Dockerfile

@@ -1,6 +1,6 @@
 # Both stages need the fixed native decoder, including curl in the builder and
 # distro Node in the runtime. A cached Python base may predate the Debian fix.
-FROM python:3.14.9-slim AS brotli-base
+FROM python:3.15.0-slim AS brotli-base
 COPY scripts/check_brotli.py /usr/local/bin/check-brotli.py
 COPY scripts/check_ca_trust.py /usr/local/bin/check-ca-trust.py
 # Check inherited trust before the first HTTPS package request, retaining Debian's

requirements-optional.txt

@@ -1,7 +1,7 @@
 # Optional dependencies — install only if you use the corresponding feature.
 # Local OCR for screenshots, scans, labels, and coordinate-grounded text extraction.
-rapidocr==3.10.0
-onnxruntime>=1.31.0,<2
+rapidocr==3.9.2
+onnxruntime>=1.20,<2
 # The app handles their absence gracefully (clear error message on first use).
 #
 # Note: chromadb-client + fastembed moved to requirements.txt — RAG, semantic
@@ -46,7 +46,7 @@ PyMuPDF
 # magika (onnxruntime), already a core dep via fastembed. We avoid the
 # [all]/Azure/audio extras (cloud + heavy). Pinned to a release >30 days old per
 # the dependency-age discussion in issue #485.
-markitdown[docx,pptx,xlsx,xls]==0.1.9
+markitdown[docx,pptx,xlsx,xls]==0.1.6
 
 # Photoshop PSD opening / flattened previews / layer inspection.
 psd-tools

requirements.txt

@@ -5,9 +5,9 @@ python-dotenv
 httpx
 # HTTPS clients using certifi must distrust the compromised eMudhra CA paths.
 certifi>=2026.10.23
-httpcore>=1.0.9,<2.0
-pydantic>=2.14.1
-pydantic-settings>=2.16.1
+httpcore>=1.0,<2.0
+pydantic>=2.13.4
+pydantic-settings>=2.14.1
 SQLAlchemy
 pypdf
 pypdfium2
@@ -25,7 +25,7 @@ numpy
 # ChromaDB service); fastembed runs local ONNX embeddings.
 chromadb-client
 # gRPC vendors independent roots; 1.84.1 removes the incident trust anchors.
-grpcio>=1.85.0
+grpcio>=1.84.1
 fastembed>=0.9.1
 youtube-transcript-api
 yt-dlp
@@ -51,7 +51,7 @@ bcrypt
 # Built-in servers use the v1 low-level Server decorator API. MCP SDK v2 is a
 # breaking rewrite, so keep fresh installs on the maintained v1 line until the
 # servers are migrated together.
-mcp<3
+mcp<2
 pyotp
 qrcode[pil]
 croniter