SDK-92: Fix docs CSP syntax for Firefox-based browsers

[benglewis]

User description

Motivation

• Firefox and Firefox-based browsers misparse the existing comma-separated CSP meta directive default-src 'self', frame-ancestors 'none', causing styles/scripts/resources to be blocked and breaking the rendered docs.
• The Sphinx-generated .rst pages included the invalid comma-separated directive in several docs pages, so a coordinated docs fix was required to restore correct asset loading.

Description

• Replaced the invalid comma-separated CSP directive default-src 'self', frame-ancestors 'none' with the valid semicolon-separated form default-src 'self'; frame-ancestors 'none' across 16 Sphinx .rst files under docs/, including docs/index.rst and the module pages.
• This is a documentation-only change and does not modify any runtime code or library behavior.
• The change ensures the CSP meta tag uses correct syntax so Firefox will apply styles and run scripts normally.

Testing

• No automated lint/type/test runs (ruff, basedpyright, pytest) were executed because this is a documentation-only change per repository guidelines.

---

Codex Task

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Fix the Sphinx docs CSP metadata by switching the Content-Security-Policy meta directive to default-src 'self'; frame-ancestors 'none' so Firefox-based browsers load assets. Update the dependency metadata in pyproject.toml and the lockfiles plus the supporting guidance/tests to pull newer requests, transformers, and related packages that resolve multiple CVEs.

Topic	Details
Dependency Hygiene	Refresh dependency pins, lockfiles, and the vulnerability guidance plus add the Hugging Face pipeline tests so requests, transformers, tooling, and their downstream transitive dependencies meet the newest CVE fixes while still validating get_hf_pipeline_for_run_given_model with the updated loader APIs. Modified files (5) AGENTS.md VULNERABILITIES.md pyproject.toml tests/unlearning-llm/llm_pipeline_transformers_test.py uv.lock Latest Contributors(2) User Commit Date blewis@hirundo.io SDK-87: Migrate to `uv... February 11, 2026 github-actions[bot] v0.2.3.post2 (#210) February 05, 2026
Docs CSP Fix	Correct the Content-Security-Policy meta directive across the Sphinx docs so the semicolon-separated default-src 'self'; frame-ancestors 'none' syntax allows Firefox-based browsers to apply styles and scripts. Modified files (16) docs/hirundo.cli.rst docs/hirundo.dataset_enum.rst docs/hirundo.dataset_qa.rst docs/hirundo.dataset_qa_results.rst docs/hirundo.git.rst docs/hirundo.labeling.rst docs/hirundo.llm_behavior_eval.rst docs/hirundo.llm_behavior_eval_results.rst docs/hirundo.llm_bias_type.rst docs/hirundo.logger.rst docs/hirundo.rst docs/hirundo.storage.rst docs/hirundo.unlearning_llm.rst docs/hirundo.unzip.rst docs/index.rst docs/modules.rst Latest Contributors(1) User Commit Date blewis@hirundo.io SDK-86: Fix docs bug i... February 04, 2026

This pull request is reviewed by Baz. Review like a pro on (Baz).

[eliran-hirundo]

LGTM

[baz-reviewer]

hirundo[transformers] now requires transformers>=5.0.0rc3, so pip install hirundo[transformers] in the README is no longer compatible with consumers pinned to transformers<5; should we publish a migration path or adjust the dependency floor to keep the documented extra installable?

_{Finding type: Breaking Changes | Severity: 🟢 Low}

---

Prompt for AI Agents:

Before applying, verify this suggestion against the current code. In pyproject.toml
around lines 54-59 (the `[project.optional-dependencies]` `transformers` extra), the
dependency pin changed to `transformers>=5.0.0rc3`, which will break consumers that
still install with `transformers<5`. Update the `transformers` extra to preserve
backward compatibility (e.g., allow the previous 4.x line as well) or create a separate
extra/versioned extra for Transformers v5 while keeping `hirundo[transformers]`
installable for existing users. Also ensure the README/public installation docs and any
migration notes are updated to reflect the new behavior and how users should upgrade.

[benglewis]

We cannot support Transformers v4 while not having any vulnerabilities. How do you think that we should document this? What is the standard?

[baz-reviewer]

Document the change in the README (and release notes if you have them) by saying that the hirundo[transformers] extra now requires transformers>=5.0.0rc3 to resolve CVE-2026-1839, and point users at pyproject.toml or VULNERABILITIES.md for the mitigation details plus any upgrade guidance (token/PEFT compatibility, etc.). Use the same vulnerability-note style from VULNERABILITIES.md so the rationale is clear and consistent, and add a short migration note that advises pinned-<5 users to either upgrade to transformer 5.x or continue using a fixed hirundo version until they can.