0.65.13 — langroid[lancedb] installs on Python 3.13 again, LanceDB FTS fixed

This release unpins lancedb and pyarrow. Two pins had drifted into an
outright conflict that made the lancedb extra uninstallable on Python 3.13,
and lifting them surfaced a LanceDB API rename that had quietly broken
full-text search in LanceDocChatAgent.

pip install -U langroid

The pin conflict (#1073)

lancedb<0.9.0 pulled in pylance==0.12.1, which requires pyarrow<12 —
directly contradicting the pyarrow>=15.0.0 that langroid[vecdbs]
declares. The two extras were only ever co-installable by resolution luck.

The practical consequence: pyarrow 15 has no cp313 wheel, so on Python
3.13 the resolver fell back to building it from source, which fails. Installing
langroid[lancedb] (or anything pulling it in, including langroid[all]) was
broken on 3.13.

Both floors are raised with no upper cap:

| | before | after |
|---|---|---|
| lancedb | >=0.8.2,<0.9.0 | >=0.9.0 |
| pyarrow | >=15.0.0,<16.0.0 | >=15.0.0 |

which resolves to lancedb 0.34.0 and pyarrow 25.0.0, and drops pylance
entirely. It also clears a high-severity pyarrow advisory (use-after-free
when reading an IPC file with pre-buffering, patched in 23.0.1).

LanceDB renamed the FTS score column

Somewhere between 0.8.2 and 0.34.0, LanceDB renamed the full-text-search
relevance column from score to _score. LanceDocChatAgent's BM25 path read
it by name, so on current LanceDB it raised KeyError: 'score'. Confirmed
against a live table:

FTS result columns:    ['vector', 'text', 'id', '_score']
vector result columns: ['vector', 'text', 'id', '_distance']

LanceDocChatAgent.get_similar_chunks_bm25 now accepts either name, so it
works across the supported range rather than pinning us to one LanceDB
generation. Two previously-failing tests in test_lance_doc_chat_agent.py pass
again.

Upgrade notes

• If you pin lancedb yourself, note the floor is now 0.9.0.
• This is a large LanceDB jump (0.8.2 → 0.34.0). If you have existing local
  .lancedb collections and hit schema errors, re-creating the collection is
  the quickest path.
• No Langroid API changes.

Verification

13 LanceDB vector-store tests and the LanceDocChatAgent suite pass; black,
ruff, and mypy -p langroid are clean.

Also since 0.65.11

Four security advisories were published against 0.65.11 and are fixed in that
release and later — see
Security Advisories
and the rewritten
SECURITY.md,
which now states the threat model for agents that execute LLM-generated
SQL/Cypher/AQL/pandas, and what is in and out of scope for vulnerability
reports.

Upgrade

pip install -U langroid

Full changelog:
0.65.12...0.65.13