security(deps): bump cloudpathlib from 0.24.0 to 0.25.0

Bumps [cloudpathlib](https://github.com/drivendataorg/cloudpathlib) from 0.24.0 to 0.25.0.
- [Release notes](https://github.com/drivendataorg/cloudpathlib/releases)
- [Changelog](https://github.com/drivendataorg/cloudpathlib/blob/master/HISTORY.md)
- [Commits](https://github.com/drivendataorg/cloudpathlib/compare/v0.24.0...v0.25.0)

---
updated-dependencies:
- dependency-name: cloudpathlib
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

docs/guides/semantic-extraction.md

@@ -100,14 +100,15 @@ ner = NamedEntityRecognizer(
     methods=["llm", "ml", "pattern"],
     confidence_threshold=0.75,
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
 )
 entities = ner.extract_entities(report)
 
 for e in entities:
     print("[{:>5.2f}]  {:15s}  {}".format(e.confidence, e.label, e.text))
 
-# Expected output (abbreviated):
+# Illustrative output — exact labels and scores depend on the method and model.
+# Abbreviated:
 # [ 0.94]  THREAT_ACTOR    GAMMA-7
 # [ 0.91]  THREAT_ACTOR    DELTA-3
 # [ 0.97]  MALWARE         HAMMERTOSS
@@ -262,16 +263,18 @@ from semantica.semantic_extract import TripletExtractor
 tri = TripletExtractor(
     method="llm",
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
     include_temporal=True,       # attach time context to triplets when available
     include_provenance=True,     # embed source document reference in each triplet
+    validate=False,              # return raw triplets; validate explicitly below
 )
 
 # Feed in the entities and relations you already extracted — the extractor
-# uses them to constrain and validate what it produces
+# uses them to constrain what it produces
 triplets = tri.extract_triplets(report, entities, relations)
 
 # Filter malformed triplets before serialisation
+# (extract_triplets validates automatically unless validate=False, as above)
 valid = tri.validate_triplets(triplets)
 print("Valid: {}/{}".format(len(valid), len(triplets)))
 
@@ -320,7 +323,7 @@ def ingest_intel_report(
         methods=[method, "pattern"],
         confidence_threshold=0.70,
         provider="anthropic",
-        llm_model="claude-sonnet-4-6",
+        llm_model="claude-sonnet-5",
     )
     entities = ner.extract_entities(text)
     classified = ner.classify_entities(entities)
@@ -335,7 +338,7 @@ def ingest_intel_report(
         relation_types=["deployed", "targets", "exploits", "operates_from", "provided_to"],
         confidence_threshold=0.65,
         provider="anthropic",
-        llm_model="claude-sonnet-4-6",
+        llm_model="claude-sonnet-5",
     )
     relations = rel.extract_relations(text, entities)
 
@@ -347,9 +350,10 @@ def ingest_intel_report(
     tri = TripletExtractor(
         method=method,
         provider="anthropic",
-        llm_model="claude-sonnet-4-6",
+        llm_model="claude-sonnet-5",
         include_temporal=True,
         include_provenance=True,
+        validate=False,          # keep raw triplets so the summary can report rejections
     )
     triplets = tri.extract_triplets(text, entities, relations)
     valid    = tri.validate_triplets(triplets)
@@ -377,6 +381,7 @@ def ingest_intel_report(
         "coref_chains":   len(chains),
         "relations":      len(relations),
         "events":         len(events),
+        "triplets_total": len(triplets),
         "triplets_valid": len(valid),
         "graph_nodes":    graph_stats.get("graph_nodes", 0),
         "graph_edges":    graph_stats.get("graph_edges", 0),
@@ -402,7 +407,7 @@ for text, doc_id in reports:
         summary["relations"],
         summary["events"],
         summary["triplets_valid"],
-        len(summary["rdf_turtle"]),
+        summary["triplets_total"],
     ))
 ```
 
@@ -421,7 +426,7 @@ ner = NamedEntityRecognizer(
     methods=["llm", "pattern"],
     confidence_threshold=0.75,
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
 )
 entities = ner.extract_entities(fintel_text)
 grouped  = ner.classify_entities(entities)
@@ -438,14 +443,14 @@ rel = RelationExtractor(
     relation_types=["operates_from", "deployed", "targets", "exploits"],
     confidence_threshold=0.70,
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
 )
 relations = rel.extract_relations(fintel_text, entities)
 
 tri = TripletExtractor(
     method="llm",
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
     include_temporal=True,
     include_provenance=True,
 )
@@ -544,14 +549,14 @@ rel = RelationExtractor(
     relation_types=["treats", "causes_adverse_event", "has_efficacy", "evaluated_in"],
     confidence_threshold=0.65,
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
 )
 relations = rel.extract_relations(paper, entities)
 
 tri = TripletExtractor(
     method="llm",
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
     triplet_types=["treats", "has_efficacy", "causes_adverse_event"],
     include_temporal=True,
     include_provenance=True,
@@ -595,7 +600,7 @@ ner = NamedEntityRecognizer(
     methods=["llm", "ml", "pattern"],
     confidence_threshold=0.70,
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
 )
 entities = ner.extract_entities(credit_memo)
 grouped  = ner.classify_entities(entities)
@@ -612,14 +617,14 @@ rel = RelationExtractor(
     relation_types=["guaranteed_by", "secured_by", "classified_as", "exposed_to"],
     confidence_threshold=0.65,
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
 )
 relations = rel.extract_relations(credit_memo, entities)
 
 tri = TripletExtractor(
     method="llm",
     provider="anthropic",
-    llm_model="claude-sonnet-4-6",
+    llm_model="claude-sonnet-5",
     include_temporal=True,
     include_provenance=True,
 )

docs/reference/reasoning.md

@@ -323,7 +323,7 @@ all_facts = datalog.derive_all()
 
 # Query with variable pattern: variables start with uppercase or ?
 results = datalog.query("ancestor(alice, ?Z)")
-# → [{"Z": "bob"}, {"Z": "charlie"}, {"Z": "dave"}]
+# → a list of binding dicts: [{"Z": "bob"}, {"Z": "charlie"}, {"Z": "dave"}] (order not guaranteed)
 
 # Clear and start over
 datalog.clear()

pyproject.toml

@@ -47,7 +47,11 @@ dependencies = [
   "numpy>=2.0.2",
   "pandas>=1.3.0",
   "scipy>=1.13.1",
-  "scikit-learn>=1.7.2",
+  # scikit-learn dropped Python 3.9 support at 1.7.0 (requires_python >=3.10),
+  # so an unqualified >=1.7.2 floor is unsatisfiable on 3.9. Cap 3.9 to the
+  # last 3.9-compatible release line; 3.10+ is left unconstrained.
+  "scikit-learn>=1.6.1,<1.7.0; python_version < '3.10'",
+  "scikit-learn>=1.7.2; python_version >= '3.10'",
   "umap-learn>=0.5.12",
   # thinc (spacy's core dep) dropped Python 3.9 wheels at 8.3.10, and later
   # spacy patch releases (3.8.8+) require thinc>=8.3.9-only-on-3.10+ ranges,
@@ -66,24 +70,49 @@ dependencies = [
   "seaborn>=0.13.2",
   "plotly>=6.8.0",
   "ipywidgets>=8.0.0",
-  "requests>=2.34.2",
+  # requests dropped Python 3.9 support at 2.33.0 (requires_python >=3.10),
+  # so an unqualified >=2.34.2 floor is unsatisfiable on 3.9. Cap 3.9 to the
+  # last 3.9-compatible release; 3.10+ is left unconstrained.
+  "requests>=2.32.5,<2.33.0; python_version < '3.10'",
+  "requests>=2.34.2; python_version >= '3.10'",
   "GitPython>=3.1.58",
-  "chardet>=7.4.3",
+  # chardet dropped Python 3.9 support at 6.0.0 (requires_python >=3.10), so
+  # an unqualified >=7.4.3 floor is unsatisfiable on 3.9. Cap 3.9 to the last
+  # 3.9-compatible release; 3.10+ is left unconstrained.
+  "chardet>=5.2.0,<6.0.0; python_version < '3.10'",
+  "chardet>=7.4.3; python_version >= '3.10'",
   "protobuf>=5.29.1,<8.0",
-  "grpcio>=1.81.1",
+  # grpcio dropped Python 3.9 support at 1.81.0 (requires_python >=3.10), so
+  # an unqualified >=1.81.1 floor is unsatisfiable on 3.9. Cap 3.9 to the last
+  # 3.9-compatible release; 3.10+ is left unconstrained.
+  "grpcio>=1.80.0,<1.81.0; python_version < '3.10'",
+  "grpcio>=1.81.1; python_version >= '3.10'",
   "beautifulsoup4>=4.15.0",
   "lxml>=6.1.1",
   "python-docx>=1.2.0",
   "openpyxl>=3.1.5",
-  "pillow>=12.2.0",
+  # pillow dropped Python 3.9 support at 12.0.0 (requires_python >=3.10), so
+  # an unqualified >=12.2.0 floor is unsatisfiable on 3.9. Cap 3.9 to the last
+  # 3.9-compatible release; 3.10+ is left unconstrained.
+  "pillow>=11.3.0,<12.0.0; python_version < '3.10'",
+  "pillow>=12.2.0; python_version >= '3.10'",
   "librosa>=0.9.0",
   "opencv-python>=4.13.0.92",
   "faiss-cpu>=1.7.0",
   "fastembed>=0.2.0",
-  "onnxruntime>=1.20.1",
+  # onnxruntime stopped shipping cp39 wheels at 1.20.0 (its PyPI metadata
+  # still claims requires_python >=3.9, but no matching wheel exists), so an
+  # unqualified >=1.20.1 floor is unsatisfiable on 3.9. Cap 3.9 to the last
+  # release with a cp39 wheel; 3.10+ is left unconstrained.
+  "onnxruntime>=1.19.2,<1.20.0; python_version < '3.10'",
+  "onnxruntime>=1.20.1; python_version >= '3.10'",
   "tokenizers>=0.15.0",
   "pydantic>=2.13.4",
-  "click>=8.4.2",
+  # click dropped Python 3.9 support at 8.2.0 (requires_python >=3.10), so an
+  # unqualified >=8.4.2 floor is unsatisfiable on 3.9. Cap 3.9 to the last
+  # 3.9-compatible release; 3.10+ is left unconstrained.
+  "click>=8.1.8,<8.2.0; python_version < '3.10'",
+  "click>=8.4.2; python_version >= '3.10'",
   "rich>=12.5.0",
   "tqdm>=4.68.3",
   "pyyaml>=6.0",

requirements-ci.txt

@@ -782,9 +782,9 @@ click-repl==0.3.0 \
     --hash=sha256:17849c23dba3d667247dc4defe1757fff98694e90fe37474f3feebb69ced26a9 \
     --hash=sha256:fb7e06deb8da8de86180a33a9da97ac316751c094c6899382da7feeeeb51b812
     # via celery
-cloudpathlib==0.24.0 \
-    --hash=sha256:b1c51e2d2ec7dc4fed6538991f4aea849d6cf11a7e6b9069f86e461aa1f9b5b4 \
-    --hash=sha256:c521a984e77b47e656fe78e20a7e3e260e0ab45fc69e33ac01094227c979e34a
+cloudpathlib==0.25.0 \
+    --hash=sha256:63612e17778c5e3a51b472def8d785d0aaaf347486d6b6786dc7be627556d4c6 \
+    --hash=sha256:8faef3ed3a0dd71d134e8617b4fdc5ce56a12a6b485c080cfe80106e5f1d1f5d
     # via weasel
 colorlog==6.12.0 \
     --hash=sha256:2a7924c1dadf18b22a0eb8b06d1c7b01d5341707ec1641eb6fcc4fde0c3e8e5f \