chore(deps): update boxmot requirement from >=11.0 to >=21.0.0

[dependabot]

Updates the requirements on boxmot to permit the latest version.

Release notes

Sourced from boxmot's releases.

Release v21.0.0

Highlights

• Mask visualization — tracking results now render segmentation masks when available
• HuggingFace CLI downloads — model and dataset downloads switched to the hf CLI for faster, more reliable fetches
• Cleaner tracking UI — streamlined Rich terminal output with more discrete, focused panels
• Memory leak fix — BotSort's removed_stracks list could grow without bound; now capped via deque(maxlen=100)

---

New Features

Area	Change
Segmentation	Show masks overlay during tracking when using a seg model
Downloads	Use huggingface_hub CLI (hf download) for weights and datasets
Track UI	More discrete Rich panels — removed verbose parameter dumps
Logo	Updated project logo (higher resolution)

Bug Fixes

• BotSort memory growth — removed_stracks converted to a bounded deque(maxlen=100) to prevent unbounded RAM usage on long sequences
• Benchmark CI — fixed flaky workflow; added dedicated HF dataset download job with caching

Internal Improvements

• Tuner hardening — config parsing validates YAML structure and prints available trackers on FileNotFoundError; malformed param entries are warned and skipped instead of crashing
• Rich UI consolidation — shared formatters moved to boxmot/utils/rich/__init__.py; eval/tune/track reporters simplified
• Evaluator simplification — ~100 lines of dead code removed
• Timing module — removed legacy accumulation branches; cleaner cached-detection display ("loaded from cache (0 ms)")
• Dataset loader — simplified _collect_seq_info with direct fallback to seqinfo.ini
• CI benchmark — single ubuntu-latest runner with HF cache layer instead of full os×python matrix

Dependencies

• uv.lock refreshed
• pyproject.toml minor version bumps

---

Upgrade Notes

If you rely on raw timing dictionaries with keys preprocess / inference / postprocess, switch to detector_preprocess / detector_process / detector_postprocess. Dictionary access via the old names still works for reads (via _AliasedTotals) but will be removed in a future release.

Commits

• de459eb hf-integration (#2308)
• ea3b32d add how to import trackers into project
• e4097b9 Bumping version from 19.0.0 to 20.0.0
• 5e5cc79 Feat/reid training (#2300)
• 82ca9d9 feat: add show_trajectories param to model.track()
• a31cf94 Bumping version from 18.0.0 to 19.0.0
• 603f928 Feat/ordered embs n dets (#2297)
• 39ba97c feat: structured TrackResults output with named accessors and export API (#2296)
• e1d7459 fix: match ByteTrack val_half split limits and update det/seqinfo
• 8a4b827 fix (#2289)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)