chore(deps): fix uv audit vulnerabilities

uv audit reported 56 known vulnerabilities across 9 packages.
Relax over-constrained pins so the resolver can pick fixed versions:

- black ==26.3.0 -> >=26.3.1 (GHSA-3936-cmfr-pm3m, fixed in 26.3.1;
  resolves to 26.10.0)
- setuptools ~=80.9 -> >=80.9 (GHSA-h35f-9h28-mq5c, fixed in 83.0.0;
  resolves to 84.0.0)

Transitive deps pick up fixes on re-resolve with no constraint
changes needed:
- aiohttp 3.13.5 -> 3.14.4, fsspec 2026.3.0 -> 2026.9.0,
  idna 3.11 -> 3.20, multidict 6.7.1 -> 6.9.1, torch 2.11.0 -> 2.14.1,
  urllib3 2.6.3 -> 2.8.0, virtualenv 21.6.0 -> 21.14.5

Also bump the explicit black==26.3.0 pins in .github/workflows/ci.yml
to black==26.10.0 to match the audited version.

Verified: uv audit reports no known vulnerabilities; black --check
passes on src_py and test. Full test suite left to CI.

Author: adsharma

.github/workflows/ci.yml

@@ -113,7 +113,7 @@ jobs:
       - name: Check formatting (black)
         working-directory: ladybug/tools/python_api
         run: |
-          uv pip install black==26.3.0
+          uv pip install black==26.10.0
           .venv/bin/black --check src_py test
 
       - name: Run ruff check
@@ -184,7 +184,7 @@ jobs:
       - name: Check formatting (black)
         working-directory: ladybug/tools/python_api
         run: |
-          uv pip install black==26.3.0
+          uv pip install black==26.10.0
           .venv/bin/black --check src_py test
 
       - name: Run ruff check

pyproject.toml

@@ -24,8 +24,8 @@ dev = [
     "pytest",
     "pytest-asyncio~=1.0",
     "pytest-xdist~=3.0",
-    "setuptools~=80.9",
-    "black==26.3.0",
+    "setuptools>=80.9",
+    "black>=26.3.1",
     "ruff==0.15.19",
     "mypy==1.16.0",
     "torch>=2.5.0",