chore(release): prepare 0.9.0 and refresh dependencies #379

Objective

Release Graphon 0.9.0 for Dify 1.19.0 and prepare the downstream API and Agent dependency updates.
The release includes the merged provider-state, incremental result accumulation, frame event, streaming callback, and container output changes in #261, #355, #366, #376, and #344.

Scope

Alongside the version bump, refresh all dependencies to their latest stable releases supported by the project and upstream requirements.
This includes runtime and development packages, transitive dependencies, the build backend, and pinned GitHub Actions.
Record any packages that upstream constraints prevent from reaching the latest stable version, including known security implications.
Continue the dependency work already merged in #372.
Pillow 13.0.0 from #359 is already present on main and remains current.

Preparation results

Preparation PR: #382.

Updated Graphon to 0.9.0 and refreshed all 130 locked third-party packages against PyPI, upgrading 20 packages.
The build backend uv_build remains current at 0.13.6.
Checked all ten external GitHub Actions against their latest stable releases and commit SHAs; updated astral-sh/setup-uv to v10.3.3 throughout the workflows.

Three transitive packages remain below the latest stable release because of upstream requirements:

The existing filelock alerts #71 (high), #72, and #73 (low) remain unresolved.
Their patched versions start at 4.2.1, outside the latest unstructured requirement.
Resolving this upstream constraint or deciding how to handle it remains a release follow-up.

Validation passed on 2026-11-02:

• just test: 1,148 passed on Python 3.12.13.
• uv run --locked --python 3.13 pytest in an isolated environment: 1,148 passed on Python 3.13.15.
• just check: lockfile, formatting, lint, types, and import boundaries passed.
• uv build --no-create-gitignore --no-sources: wheel and source distribution built, with matching version, Python requirements, and runtime dependency metadata.

Both test runs report the two existing pandas Excel deprecation warnings.
All checks on PR #382 passed for commit ceb3f45, including the Python matrix and repository checks, CodeQL, and CLA validation.

Release checklist

• Update pyproject.toml and uv.lock to version 0.9.0.
• Refresh dependency versions and verify the remaining upstream constraints.
• Pass repository checks and the Python 3.12 and 3.13 test suites.
• Build the wheel and source distribution and verify their release metadata.
• Resolve or explicitly assess the remaining filelock security alerts before publication.
• Merge the release preparation PR chore(release): prepare 0.9.0 and refresh dependencies #382.
• Prepare release notes, create v0.9.0 from the merged release commit, and complete TestPyPI and PyPI publication through the release workflow.
• Update the Dify API and Agent dependencies and lockfiles, remove temporary Graphon Git pins, and complete downstream validation in fix(agent): preserve complete model messages dify#44502.

Milestone

Tracked in Graphon's 1.19.0 milestone, which supports Dify 1.19.0.
The preparation PR advances this issue; publication and downstream rollout remain tracked until completed.