build(nox): centralize dependency pins in pyproject.toml

[Abhijeet Prasad (AbhiPrasad)]

Migrate all nox session dependency pins and package metadata into py/pyproject.toml as the single source of truth:

• Replace setup.py with pyproject.toml (setuptools backend)
• Move base test deps, session auxiliary deps, lint deps, build deps, and dev deps into PEP 735 dependency groups
• Move provider version matrices into [tool.braintrust.matrix] custom table (read by noxfile at import time)
• Generate and commit uv.lock for reproducible auxiliary dep resolution
• Pin all previously-floating 'latest' versions to explicit versions
• Remove requirements-dev.txt, requirements-build.txt, requirements-optional.txt, and the install-optional Makefile target
• Switch Makefile and CI from uv pip install to uv sync
• Bump uv to 0.11.6 in .tool-versions
• Add daily dependency-updates.yml workflow that runs uv lock --upgrade and labels PRs based on whether provider SDKs changed
• Exclude uv.lock from codespell checks (false positive on astroid)
• Update AGENTS.md, CONTRIBUTING.md, and agent skill docs to reflect the new layout

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tqdm@​4.67.1
	temporalio@​1.25.0
	pytest-vcr@​1.0.2
	orjson@​3.11.3
	orjson@​3.11.5
	pytest@​9.0.2
	pytest@​8.4.2
	pre-commit@​4.3.0
	openai@​2.15.0
	uvicorn@​0.38.0
	opentelemetry-api@​1.37.0
	python-dotenv@​1.1.1
	python-dotenv@​1.2.1
	packaging@​25.0
	requests@​2.32.5
	opentelemetry-sdk@​1.37.0
	opentelemetry-exporter-otlp-proto-http@​1.37.0
	starlette@​0.49.3
	typing-extensions@​4.15.0
	pytest-asyncio@​1.2.0
	wrapt@​1.17.3
	wrapt@​2.0.0
	wrapt@​2.0.1
	sseclient-py@​1.8.0
	python-slugify@​8.0.4

View full report

[ViaDézo1er / cedric (viadezo1er)]

stamp