build: raise vulnerable dependency floors

Author: JetXu-LLM

.github/workflows/tests.yml

@@ -66,7 +66,7 @@ jobs:
             "langchain-openai==1.1.14" "langchain-text-splitters==1.1.2" \
             "nest-asyncio==1.6.0" "numpy==1.26.4" "pydantic==2.10.0" \
             "python-dateutil==2.9.0.post0" "requests==2.33.0" \
-            "tokenizers==0.22.1" "transformers==5.3.0" "urllib3==2.7.0" \
+            "tokenizers==0.22.1" "transformers==5.5.0" "urllib3==2.7.0" \
             "pytest>=9.0.3,<10" "pytest-asyncio>=1.3,<2" "pip-audit>=2.10,<3"
       - run: python -m pip check
       - run: python -m pip_audit
@@ -84,7 +84,7 @@ jobs:
       - name: Build with the declared backend floor
         run: |
           python -m pip install --upgrade pip
-          python -m pip install "setuptools==77.0.3" wheel build twine
+          python -m pip install "setuptools==83.0.0" wheel build twine
           python -m build --no-isolation
           python -m twine check dist/*
 

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 - Enforced the 2 MiB product cap both from GitHub size metadata and while streaming raw bytes
 - Kept binary, generated, minified, and sensitive paths outside the new opt-in surface
+- Raised the tested `setuptools` and `transformers` lower bounds to versions that clear the current dependency-audit security gate
 
 ## [0.4.1] - 2026-07-12
 

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=77.0.3", "wheel"]
+requires = ["setuptools>=83.0.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -36,7 +36,7 @@ dependencies = [
   "python-dateutil>=2.9,<3",
   "requests>=2.33,<3",
   "tokenizers>=0.22.1,<1",
-  "transformers>=5.3,<6",
+  "transformers>=5.5,<6",
   "urllib3>=2.7,<3",
 ]