⬆️ chore(deps): upgrade all dependencies to latest versions

[luiscosio]

Proactive "update everything to latest" pass. There were 0 open Dependabot alerts, so this is hygiene rather than a security fix.

Manifest change

requirements.txt had exactly one pinned entry:

• whisperx 3.7.4 -> 3.8.6

The other four entries (tiktoken, python-dotenv, openai, transformers) are unpinned. A fresh install already resolves them to latest, so there is nothing to bump textually. I kept the existing mixed pinning style instead of converting them to == pins, since that would be a policy change beyond a version bump. Resolved versions on a clean install today:

Package	Version
torch / torchaudio / torchvision	2.8.0 / 2.8.0 / 0.23.0
numpy	2.5.1 (numpy 2.x)
transformers	4.57.6
openai	2.46.0
tiktoken	0.13.0
python-dotenv	1.2.2
pyannote-audio	4.0.7
faster-whisper / ctranslate2	1.2.1 / 4.8.1

numpy 1.x -> 2.x boundary

Clean: whisperx 3.8.6 itself requires numpy>=2.1.0, and the whole resolved tree (torch 2.8, pyannote-audio 4.x, faster-whisper, scipy 1.18, pandas) is numpy-2 native. No pin needed.

Pinned back / not upgraded

transformers stays at 4.57.6 — latest is 5.14.1. This is an upstream conflict, not a local choice:

Because whisperx==3.8.6 depends on huggingface-hub<1.0.0 and
transformers==5.14.1 depends on huggingface-hub>=1.5.0,<2.0, we can
conclude that transformers==5.14.1 and whisperx==3.8.6 are incompatible.

transformers can move to 5.x only once whisperx relaxes its huggingface-hub<1.0.0 cap. The resolver picks the highest compatible version automatically, so no explicit pin was added to the manifest.

torch is likewise held at 2.8.x by whisperx's torch~=2.8.0.

Code changes required

None. The two upgraded APIs the code actually touches are unchanged:

• secure_speech_to_text.py uses OpenAI(base_url=, api_key=) + client.chat.completions.create(...) — stable across openai 2.x.
• utils/token_counter.py uses tiktoken.encoding_for_model / get_encoding — unchanged.

The only other change is adding __pycache__/ and *.py[cod] to .gitignore so verification runs don't dirty the tree.

Verification

Environment: macOS / Apple Silicon (arm64), Python 3.13.11 via uv venv --python 3.13. Note the system default is Python 3.14, which whisperx does not support (requires_python: >=3.10,<3.14); 3.13 matches the Dockerfile.

Everything below was run against a from-scratch venv rebuilt from requirements.txt (rm -rf .venv && uv venv --python 3.13 && uv pip install -r requirements.txt), which resolved and installed cleanly.

Command	Result
uv pip install -r requirements.txt	PASS — clean resolve+install, no conflicts
import secure_speech_to_text, best_effort_delete, utils, utils.token_counter	PASS
import whisperx, torch, transformers, openai, tiktoken, dotenv, numpy	PASS
python secure_speech_to_text.py --help	PASS (exit 0)
python best_effort_delete.py --help	PASS (exit 0)
python -m utils.token_counter --help	PASS (exit 0)
whisperx --help	PASS (exit 0)
python -m utils.token_counter <sample.txt> (real tiktoken encode)	PASS — 132 chars -> 37 tokens, gpt-4 encoding
best_effort_delete.py <throwaway file>	PASS — file overwritten, renamed, unlinked
generate_executive_summary() against a local mock OpenAI-compatible server	PASS — request accepted, executive_summary.md written correctly

The last three are real functional tests, not just imports: tiktoken actually encoded text, the shredder actually destroyed a scratch file, and the openai 2.x request/response path ran end-to-end against a stub server on 127.0.0.1.

What was NOT verified

• There is no test suite in this repo. No tests/, no test_*.py. python -m pytest reports No module named pytest (pytest isn't a dependency). I did not add tests. The verification above is what I ran in its place.
• There is no CI. No .github/workflows/ directory exists, so there were no CI commands to reproduce.
• No real transcription was run. Per scope, I deliberately did not download Whisper or pyannote model weights or transcribe an audio file. WhisperX is verified to install, import, and expose its CLI — the actual inference path is unexercised.
• No real LLM call. The summary path was tested against a mock server, not a live LM Studio / OpenAI endpoint.
• CPU/arm64 only. The CUDA Dockerfile path (GPU, torch+cuDNN 9.x on linux/x86_64) was not built or run. triton is a linux-x86_64-only dep and was never installed here.