chore(deps): bump the python-dependencies group with 7 updates

pyproject.toml

@@ -26,7 +26,7 @@ classifiers = [
 # silently pull an ancient (potentially vulnerable) release. The committed
 # uv.lock pins the tested transitive graph for CI and repeatable installs.
 dependencies = [
-    "fastapi>=0.139.2",
+    "fastapi>=0.140.0",
     "uvicorn>=0.51.0",
     "sqlmodel>=0.0.39",
     "jinja2>=3.1.6",
@@ -36,7 +36,7 @@ dependencies = [
     # it. Starlette TestClient has moved to the maintained httpx2 package; keep
     # both explicit until Authlib completes that transition.
     "httpx>=0.28.1",
-    "httpx2>=2.7.0",
+    "httpx2>=2.9.1",
     "pyjwt>=2.13",
     "pydantic-settings>=2.14.2",
     "redis>=6.4.0",
@@ -65,21 +65,21 @@ postgres = [
 # `bedrock` backend additionally needs the SDK's AWS auth deps. See CLAUDE.md
 # *Governed AI assist*.
 anthropic = [
-    "anthropic>=0.117.0",
+    "anthropic>=0.120.0",
 ]
 bedrock = [
-    "anthropic[bedrock]>=0.117.0",
+    "anthropic[bedrock]>=0.120.0",
 ]
 dev = [
     "pytest>=9.1.1",
     "pytest-cov>=7.1.0",
     "pytest-xdist>=3.8.0",
-    "ruff>=0.15.22",
+    "ruff>=0.16.0",
     "bandit>=1.9.4",
     "vulture>=2.16",
     "pip-audit>=2.10.1",
-    "pre-commit>=4.6.0",
-    "djlint>=1.42.1",
+    "pre-commit>=4.6.1",
+    "djlint>=1.42.3",
     "mypy>=2.3.0",
     # 3.3.1's published wheel omits the bundled OASIS JSON schemas, making
     # schema validation silently unusable. Pin the last complete release until