[laithalsaadoon]

Gets every red PR and every open dependency alert to green in one branch. Supersedes #59, #60, #62, #63, #64, #69, #70, #71 and #72.

Why the Dependabot PRs were red

• chore(deps): bump filelock from 3.32.7 to 4.2.1 #72 (filelock 4.2.1): litellm caps filelock<4.0 in every release through 1.106.6, so Dependabot's resolver downgraded litellm 1.104.2 to 1.103.7 to reach filelock 4, and test_pricing_identity found only 110 of 260 vendored entries matching the older litellm's table.
• chore(deps): bump the python-minor-patch group across 1 directory with 12 updates #71 (python-minor-patch group): ty 0.0.90 reports 55 truthiness-test-of-none-union sites; litellm 1.106.2 moved its price data and its threshold scan; and Trivy flagged the pillow, certifi and filelock CVEs still on main's lock.

uv.lock

uv lock --upgrade inside the 7-day cooldown moves 47 packages: litellm 1.106.3, pillow 13.0.0, pyarrow 26.0.0, certifi 2026.10.23, filelock 4.2.4, setuptools 84.2.1, lancedb 0.40.0, ty 0.0.91, ruff 0.17.2, hypothesis 6.170.9 and their transitives. lancedb's ceiling moves to <0.41 and uv_build's to <0.14 (#71, #62).

• filelock: a [tool.uv] override-dependencies = ["filelock>=4.2.1"] admits filelock 4 past litellm's cap. litellm is a dev-only oracle, and a fresh install of the published package already resolves filelock 4 through huggingface-hub and torch, so the lock now matches what users get. The comment says to delete it once litellm lifts the cap.
• ty: truthiness-test-of-none-union = "ignore" in [tool.ty.rules], so ty moves off 0.0.84. Every one of the 55 sites is an if value: that treats None and empty alike, and the converter's mirror harbor's. Turning a site on is a None-versus-empty decision at that site.

Price table and threshold scan, litellm v1.106.3

scripts/update_prices.py --ref v1.106.3: 28 new ids (Claude Haiku 5.5 and Sonnet 5.5 direct and in every Bedrock region, GPT-6.1 Sol, a few OpenAI previews), GPT-6 Astra ultrafast rates, flex and priority rates for the four Bedrock gpt-oss ids, and no above-200k rates for claude-sonnet-4-5 and the two Bedrock claude-3-5-sonnet ids.

litellm 1.106.2 (commit d7db18589ddd, backport of 312479739914) changed _get_token_base_cost's threshold scan. A threshold now counts when any of the four rate families prices above it, or the request's own tier variant does, and every exceeded threshold applies lowest first. The identity grid caught it on GPT-6 Astra and GPT-6.1 Sol ultrafast above 272k: ours billed the base rates, litellm six times them.

• domain.pricing ports the new scan, the balanced service tier, and the seven ModelInfoBase fields 1.106 names.
• The current table holds no other key that tells the two scans apart, so TestSyntheticThresholds prices three synthetic entries through both litellm and the fast path. Each of four planted defects in the port (one rate family only, highest threshold first, no tier keys, no balanced tier) fails it. The grid now runs the balanced tier too.
• CONVERTER_SCHEMA_VERSION 10 -> 11, since costs change for the models above; a corpus re-converts on its next materialize.

Actions and the docs site

• ci(deps): bump the actions-minor-patch group across 1 directory with 7 updates #59's seven action bumps, cherry-picked unchanged (codeql-action 4.39.0, mise-action 5.2.1, scorecard-action 2.5.0, upload/download-artifact patches).
• Site: undici 8.12.3, vite 8.3.5, fast-uri 3.1.9, zod 4.6.7 via pnpm update and pnpm dedupe under pnpm 12.10.1. The dedupe leaves one rolldown (1.2.16) and one postcss (8.5.32). package.json is unchanged.

Verification

• mise run check and mise run docs:gate pass locally.
• docs:citations:fix rewrote the 101 citations the pyproject.toml line moves shifted; the docs that state the lancedb and uv_build ranges and the litellm tag follow.