chore(deps): clear Dependabot alerts in uv.lock and move dev tooling to pytest 9 - #799

…ce tests (#802)

## Motivation

Every Dependabot PR fails CI on two jobs, Service Tests and Notebook
Validation, regardless of what it bumps. Dependabot pushes its branches
to this repository, so its PRs pass the same-repository guard that keeps
fork PRs away from secret-dependent jobs. GitHub, however, gives runs
that Dependabot triggers no Actions secrets, so those jobs start with
every API key empty. On #751, Service Tests stops at the Google Cloud
authentication step for want of `GOOGLE_CREDENTIALS`, and the notebooks
fall through to `getpass` prompts that cannot run in CI. The same two
jobs failed on #744, #749, #751 and #799.

## Changes

This PR treats Dependabot PRs the way fork PRs are already treated: the
secret-dependent jobs skip, and a maintainer runs them with secrets
after reading the change.

- `.github/workflows/test.yml`: Service Tests and Notebook Validation
also skip when `github.actor` is `dependabot[bot]`. The guard keys on
the actor because that is what GitHub withholds secrets on, so a
maintainer's push to a Dependabot branch still runs both jobs with
secrets.
- `.github/workflows/test-fork-pr.yml`: the dispatch-only workflow now
accepts PRs opened by `dependabot[bot]` as well as fork PRs, and still
rejects other same-repository PRs.
- `CONTRIBUTING.md`: a short section telling maintainers to run `gh
workflow run test-fork-pr.yml -f pr_number=<n>` before merging a fork or
Dependabot PR.

## Notes

- A skipped job shows as passing, so the manual dispatch is a
convention, not an enforced gate. Copying the API keys into the
Dependabot secrets store would make the jobs run automatically, but it
would also hand those keys to newly bumped dependency code before anyone
has reviewed it, which defeats the purpose of waiting for a maintainer.
- The check run keeps the name "Fork PR - Service Tests" so that any
branch-protection rule or tooling referring to it keeps matching.
- Notebook Validation has no manual equivalent, as is already the case
for fork PRs. It still runs on `main` after merge and nightly.

## Reviewer Brief

**Start here:** `.github/workflows/test.yml:25`, the Service Tests `if:`
guard. It decides which PR runs get secret-dependent jobs, and the
Notebook Validation guard at `:152` repeats it.

**Where it could fail**
- `.github/workflows/test-fork-pr.yml:46-51`: the new acceptance checks
who opened the PR (`pr.data.user.login`), not who wrote its commits, so
a write-access user's commit on a Dependabot branch would also be tested
with secrets; that user can already run code with secrets from any
same-repository branch.

**Not verified:** neither workflow has run with this change. The
`github.actor` guard and the Dependabot acceptance in `test-fork-pr.yml`
can only be confirmed on a real Dependabot PR plus a manual dispatch.
actionlint was not available; both files parse as YAML, and the `setup`
script passes `node --check`.

**Beyond CI:** the logs of run 37937957172 (#751) show every secret
empty on a Dependabot-triggered run, Service Tests failing at Google
Cloud authentication, and Notebook Validation failing on `getpass`
API-key prompts, which confirms that both jobs need secrets and lose no
working coverage by skipping.

**Since the last brief:** `a59789b7` passes `GEMINI_API_KEY` to the
dispatched service tests, matching `test.yml`, so the Google GenAI
fixture exercises the Gemini backend there too.

<sub>Reviewed `d8a7d3a7` · Claude Code (claude-opus-5-5) · lenses:
correctness, security, design, tests, docs, Redis behaviour</sub>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Workflow and contributor-doc changes only; no application or
secret-handling logic changes, though skipped jobs still report as
passing until a maintainer runs the dispatch workflow.
> 
> **Overview**
> Dependabot PRs were hitting **Service Tests** and **Notebook
Validation** with no Actions secrets (same-repo branches, but GitHub
withholds secrets on Dependabot-triggered runs), so CI failed on empty
API keys. This PR aligns Dependabot with the existing fork PR pattern.
> 
> **`test.yml`** skips those secret-dependent jobs when `github.actor`
is `dependabot[bot]` (while still running them for maintainer pushes on
the same branch). **`test-fork-pr.yml`** now allows manual dispatch for
Dependabot PRs as well as forks, with updated validation and comments.
**`CONTRIBUTING.md`** documents running `gh workflow run
test-fork-pr.yml -f pr_number=<n>` before merge.
> 
> The fork-pr workflow also wires **`GEMINI_API_KEY`** into the
service-tests env alongside the other provider secrets.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a59789b. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

## Motivation

RedisVL declares `Requires-Python >=3.10,<3.15`, so `pip install
redisvl` fails on Python 3.15.0, which is now final (#757). RedisVL's
own code runs unchanged on 3.15: a full-suite trial found nothing in
`redisvl/` that 3.15 removed or broke. The blockers were the version cap
itself and a handful of locked dependencies that either publish no 3.15
wheel or fail to import on it. This PR lifts the cap, brings those
dependencies forward, and adds 3.15 to CI with every extra installed.

## Changes

### Dependencies that block 3.15

Three locked packages had no usable 3.15 build. torch gained 3.15 wheels
in 2.15.0, and the locked scipy 1.17.1 had none either, so scipy moves
to 1.18.1 and scikit-learn to 1.9.1 alongside it. Together they let the
`sentence-transformers` extra install. rpds-py 0.30.0, pulled in through
the docs group, has no 3.15 wheel and fails to build from source, so it
moves to 2026.9.1.

beartype is different, because it installs but breaks at import. fastmcp
depends on it indirectly, and beartype releases before 0.23 import
`typing.no_type_check_decorator`, which 3.15 removed. Under such a
release fastmcp fails to import on 3.15, and the RedisVL MCP server
silently falls back to a stand-in class that cannot serve tools. The
`mcp` extra therefore now requires `beartype>=0.23.1`, which protects
installs from PyPI as well as this lock.

Re-resolving the lock also moves older Pythons. On 3.11–3.14, torch
moves to 2.15.0. On 3.14, the Google packages move to
google-cloud-aiplatform 1.154.0, grpcio 1.85.1 and protobuf 6.33.6,
collapsing a 3.14-only fork that had held them back. Python 3.10 keeps
its current versions throughout.

### CI and packaging

3.15 joins the test and style-check matrices as a blocking leg,
installing every extra like the other legs. uv moves from 0.12.3 to
0.13.1 in all four workflows, since 0.13.0 is the first release that
ships CPython 3.15.0 final. The lock moves to uv's revision 5 format,
which uv 0.12.3 and later still read.

### Minor changes

- `requires-python` is now `<3.16`, with a 3.15 classifier and a `py315`
black target. The black dev floor rises to 26.5.0, the first release
that accepts `py315`.
- One test asserted on the wording of CPython's `TypeError` for `**`
applied to a non-mapping, which 3.15 rewords from "argument after **" to
"Value after **". It now matches both.
- The SemanticRouter repr unit tests pass a stub vectorizer instead of
building `HFTextVectorizer`, so they no longer load a model.
- HF-dependent integration tests that lacked the `requires_hf` marker
now carry it. The marker stays informational, as on `main`.
- CONTRIBUTING gives the supported range as Python 3.10 through 3.15,
replacing a stale "3.9 and above".
- The installation guide notes that `pip` refuses the `voyageai` and
`sql-redis` extras on newer Pythons, because those packages declare
`<3.15` and `<3.14` respectively.

## Notes

The beartype floor applies on every Python version, although only 3.15
needs it. beartype 0.23.1 supports Python 3.10 and later, and one
unconditional floor is simpler to reason about than a `python_version`
marker that someone has to remember to remove once fastmcp or its
dependencies set their own floor.

## Release Notes

Python 3.15 is supported, with every extra installable. The `mcp` extra
now requires `beartype>=0.23.1`, and on Python 3.15 `pip` still refuses
the `voyageai` extra (and on 3.14 and later the `sql-redis` extra)
because of those packages' own Python bounds.

## Reviewer Brief

**Start here:** `uv.lock`, the `torch`, `scipy` and `scikit-learn`
entries. They are what let the 3.15 leg install every extra, and they
move 3.11–3.14 to torch 2.15.0 as well.

**Where it could fail**
- `uv.lock`: on 3.15, about 15 locked packages have no 3.15 wheel and
are compiled from source during install. Four of them (pydantic-core,
jiter, orjson, uuid-utils) need a Rust toolchain. They built on macOS
arm64; check that the first 3.15 CI legs build them on Linux.
- `uv.lock`, the 3.14 Google packages: the move to
google-cloud-aiplatform 1.154.0 and protobuf 6.33.6 is covered only by
unit tests, because the Vertex AI tests that exercise it need API keys.

**Not verified:** Linux and Windows installs on 3.15; live provider
APIs; cluster tests; the Sphinx build of the installation-guide note.

**Beyond CI:** the full suite on CPython 3.15.0 (macOS arm64, Redis 8.4)
gave 2,705 passed and 144 skipped, the same counts as 3.13. A plain `pip
install` of the built wheel with `[mcp,sentence-transformers]` on 3.15
loads the real fastmcp and embeds text with torch 2.15.0. redis-py 6.4.0
and 7.4.1 import cleanly on 3.15.

**Since the last brief:** rebased onto `main` at `6a81e13b` with no
changes to the PR's commits; the reviewed `ff863e25` is now `9ebe43ad`
and the fix commit `28b0e5c8` is now `159a5d26`. The full suite on
3.15.0, including the MCP code tools that `main` added, gave 2,835
passed and 144 skipped, the same as 3.13.

**Since the last brief:** merged `main` at `ee4c1834` (#799), which
moves the dev group to pytest 9 and pytest-asyncio 1.x. pytest-asyncio
1.4.1 emits none of the asyncio deprecation warnings on 3.15, so the
PR's `filterwarnings` entry for them is gone. `uv.lock` was regenerated
from `main`'s lock with this PR's 3.15 upgrades re-applied; on 3.14 and
later grpcio now resolves to 1.85.1. The full suite on 3.15.0 and 3.13
gave 2,838 passed and 144 skipped on each.

<sub>Reviewed `ff863e25`, fixes in `28b0e5c8` · Claude Code
(claude-opus-5-5) · lenses: correctness, security, design, tests, docs,
Redis behaviour</sub>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Broad CI and lockfile dependency moves (torch/scipy/MCP stack) affect
all supported Python versions; 3.15 legs may hit source builds for
packages without Linux wheels.
> 
> **Overview**
> **RedisVL can be installed and tested on Python 3.15.** Packaging now
allows `>=3.10,<3.16` with a 3.15 Trove classifier, Black `py315`
target, and a higher Black dev floor (`>=26.5.0`).
> 
> **CI and tooling:** All four GitHub workflows bump **uv** to
**0.13.1** (needed for CPython 3.15). Lint and the main test matrix add
a blocking **3.15** leg alongside 3.10–3.14.
> 
> **Dependencies:** The **`mcp`** extra explicitly requires
**`beartype>=0.23.1`** so fastmcp imports on 3.15 (older beartype used
APIs removed in 3.15).
> 
> **Docs:** CONTRIBUTING lists supported Python as **3.10–3.15**
(replacing stale 3.9 wording). The installation guide notes that
**`pip`** may refuse **`voyageai`** / **`sql-redis`** (and **`all`**) on
newer Pythons while **`uv`** still resolves them.
> 
> **Tests:** Connection-kwargs **`TypeError`** assertion matches CPython
3.15’s reworded message; **`SemanticRouter`** repr unit tests inject a
**`CustomVectorizer`** stub instead of default HF setup;
HuggingFace-dependent integration cases gain
**`@pytest.mark.requires_hf`** where they were missing.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
11e9341. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->