Migrate to anthropic 1.x (pinned to <1 as a stopgap)

[JSv4]

anthropic published 1.0.0 (previous release 0.125.0). It reached us unannounced and turned main red — see #2272 for the incident and the immediate fix.

Stopgap now in place

requirements/analyzers/claude_highlighter.txt is pinned to anthropic>=0.45.2,<1, and the mypy hook's additional_dependencies carries the same ceiling so CI type-checks against the major the image actually ships.

Note <2 would not have worked — 1.0.0 < 2, so it resolves straight to 1.0.0. Verified:

anthropic>=0.45.2        -> 1.0.0
anthropic>=0.45.2,<2     -> 1.0.0     # no-op
anthropic>=0.45.2,<1     -> 0.125.0   # holds the line

This is a stopgap, not the fix. It freezes us on the 0.x line rather than migrating.

What "doing it right" needs

• Read the 1.0.0 release notes end to end. We only found the temperature removal because it happened to break mypy. A major release almost certainly changed more than the one thing that tripped a type check — the absence of other errors is not evidence of their absence, since most of our SDK surface isn't type-checked at that depth.
• Audit every SDK call site against the new contract. Currently only two direct messages.create() calls (doc_analysis_tasks.py), but check for client.* usage elsewhere and in analyzers.
• Check pydantic-ai's anthropic integration. It pulls anthropic transitively via pydantic-ai-slim[...,anthropic,...]; confirm which major it supports before we lift our ceiling, or the two constraints will fight.
• Re-evaluate the sampling-parameter removal. temperature/top_p/top_k are gone from the API on Opus 4.7+ and rejected on Sonnet 5. fix: anthropic 1.0.0 broke messages.create — drop temperature, pin <1 (unblocks main) #2272 drops the two usages; decide whether anything else depended on them for determinism, and what replaces that (prompting, or output_config.effort).
• Lift the <1 ceiling in both places once the above is done.

Related, surfaced by the same investigation

• CLAUDE_ANALYZER_DEFAULT_MODEL = "claude-3-5-sonnet-latest" (constants/llm.py:65) names a model retired 2025-10-28. That default 404s unless every deployment overrides ANTHROPIC_MODEL via ANALYZER_KWARGS. Independent of the SDK bump.
• Consider a constraints/lock file. There is none, so every image build re-resolves to latest. anthropic>=0.45.2 was the only unbounded direct dependency that could move a major — worth a sweep of requirements/ to confirm, and worth deciding whether pinning-by-convention is enough or we want a lock.

Why this bit CI before anything else

pre-commit rebuilds its hook environments from scratch on every run, so CI resolves fresh dependencies constantly while the django image only re-resolves when it is rebuilt. That is why main went red with no commit touching the code — and why a green deployment can be running a different anthropic than the one CI just tested against.

[JSv4]

Sweep result: anthropic was not the outlier

I claimed in review that anthropic was the only unbounded direct dependency. That was wrong — swept requirements/**/*.txt and found 47 direct requirements with no upper bound. Correcting it here so the checkbox above isn't scoped from a false premise.

They are not all equal risk, though. Three groups:

1. Security floors — intentionally floor-only, leave alone. Capping these would block security updates, which is the opposite of what they're for:

urllib3>=2.7.0, zipp>=4.1.0, tornado>=6.5.7, sqlparse>=0.6.0, setuptools>=84.0.0, twisted>=26.4.0, ipython>=9.16.1, pillow>=12.3.0, Twisted[tls,http2]>=26.4.0, brotli>=1.2.0 — repeated across base.txt, local.txt, production.txt.

2. Docs tooling — bare, but blast radius is the docs build only:

mkdocs-material, mkdocs-click, mkdocs-glightbox, mkdocs-minify-plugin, mkdocs-git-revision-date-localized-plugin, mike, mkdocstrings[python], django-cprofile-middleware.

3. Libraries whose API we call directly — the group that can break us the way anthropic just did:

spec	file
spacy	base.txt:60 (bare — no floor either)
django-guardian	base.txt:71 (bare)
python-docx / openpyxl / python-pptx	local.txt:49-51 (bare)
pytesseract	local.txt:57 (bare)
pgvector>=0.5.0	base.txt:26
pdfplumber>=0.11.10	base.txt:61
shapely>=2.1.2	base.txt:62
pdf2image>=1.17.0	base.txt:42
Pillow>=12.3.0	base.txt:1
llama-parse>=0.5.0	ingestors/llama_parse.txt:2
pdfredact>=0.0.6	postprocessors/redact.txt:1

spacy and django-guardian are the ones I'd look at first — both bare, both with real API surface we depend on, and spacy majors have historically been breaking.

This strengthens the lock/constraints-file case in the checkbox above: bounding 11+ dependencies by hand is a standing maintenance cost that a resolved constraints file solves once. Worth deciding which way to go before adding ceilings one at a time.