Dependency updates in v26.10.11

This maintenance release adopts the book toolchain's PyYAML>=6.0.3,<7 from Dependabot PR #197. It retains SQLAlchemy>=2.0.50 instead of raising the supported minimum to 2.1.6 as proposed by PR #198. The repository lock already selects SQLAlchemy 2.1.6 and PyYAML 6.0.3. No application API migration is required from v26.10.10; Pydantic AI 2.59.0, Monty 0.0.23 and the existing compatibility caps remain in place. This release also includes previously unreleased dependency metadata from Dependabot PR #196: OpenAI/Azure embedding extras now require openai>=3.36.0, the binary extra requires pypdf>=6.21.2, and the FastAPI extra requires fastapi>=0.158.0. The v26.10.10 lock already selected OpenAI 3.37.0, pypdf 6.21.2 and FastAPI 0.162.0; the changed metadata makes those minimum requirements explicit. SQLAlchemy's locked selection advances from 2.1.4 to 2.1.6 while its supported 2.0.50 minimum stays intact. PR #196 also introduced the native uv project updater and separate pip documentation updater.

If an application selects one of these extras, reconcile any direct SDK pins below its new minimum before resolving the full graph, then test that adapter. Applications that do not select those extras do not need to add those SDKs. The declared constraints are in pyproject.toml; uv.lock records the exact repository selection. Applications must resolve and validate their own locks. Python 3.12 and 3.13 remain the qualification targets.

Repository dependency automation

Dependabot uses the uv ecosystem so Python updates include uv.lock, matching CI's uv sync --locked checks. The lockfile-only strategy updates resolved versions within existing requirements and leaves declared compatibility floors unchanged. Review requirement changes separately with the affected adapter's minimum-version and current-version qualification lanes. The Python dependency group includes both runtime and development dependencies. On the next native uv updater run, inspect its job payload and confirm lockfile-only: true; checked-in configuration records intent, not proof that the updater applied it. An earlier run reported requirements-update-strategy: null and lockfile-only: false, so that run does not establish an upstream strategy bug.

The separate pip entry keeps maintaining the documentation requirements while excluding pyproject.toml and uv.lock, which belong to the uv entry.

Intentional changes to Agentic extra requirements must also update the reviewed contracts in scripts/agentic-migration-manifest.json. Regenerate the lock and run scripts/verify_agentic_migration.py before submitting those changes. Explicitly pinned Pydantic AI and Monty upgrades require this deliberate manifest review and adapter qualification; lockfile-only automation cannot advance those pins. Keep the SQLAlchemy 2.0.50 floor and the separate 2.0/2.1 qualification lanes; a newer locked patch does not require dropping supported application combinations.

See uv's Dependabot integration and GitHub's versioning strategies.

Native redaction and Presidio removal

The pii extra, Presidio backend and its source-pinned anonymizer dependency are removed. Native regex redaction remains enabled by default. Remove pii from your PyFly extras, remove pyfly.logging.redaction.presidio, and select engine: regex. Legacy auto selects regex; explicit presidio is rejected. Recreate the application environment from the new lock to remove unused Presidio/spaCy packages. See the logging migration.

The previous Git/GitHub source-build and spaCy-model requirements no longer apply to redaction. Historical v26.10.05–08 facts remain in the changelog; do not reuse their removed backend installation instructions for this hotfix.

Compatibility boundaries

Dependency	Current selection	Compatibility boundary
OpenAI SDK (agentic-openai-embeddings, agentic-azure-embeddings)	>=3.36.0; lock 3.37.0	Reconcile lower application pins when selecting either embedding extra.
pypdf (agentic-binary)	>=6.21.2; lock 6.21.2	Reconcile lower application pins for binary ingestion.
FastAPI (fastapi)	>=0.158.0; lock 0.162.0	Reconcile lower application pins when selecting the FastAPI adapter.
SQLAlchemy	>=2.0.50; lock 2.1.6	Preserve qualified 2.0 applications while exercising the newer 2.1 selection in repository environments.
PyYAML (book toolchain)	>=6.0.3,<7; installed 6.0.3	Keep documentation parsing within the supported 6.x series.
asyncmy	>=0.2.11; lock 0.2.16	Keep the proven MySQL/MariaDB driver minimum while installing the newer compatible patch in repository environments.
openfeature-flagd-core	>=1.0.0,<2	Preserve the shared PyFly/LaraFly fractional cohort contract; 2.x changes the hash input and shifts existing assignments.
Pydantic AI	==2.59.0	Preserve provider extras and the native runtime contracts.
NumPy	>=2.5.4	The removed NLP dependency graph no longer imposes its NumPy restriction.
pydantic-monty	==0.0.23	Worker-backed adapter with per-run pool/session ownership, direct sync/async host tools, memory/recursion limits and a parent wall-clock budget. Non-None max_allocations is rejected because upstream removed that control.
Ragas	>=0.2.6,<0.2.7	Ragas 0.4 introduces Instructor's rich<15 constraint, conflicting with the CLI's Rich 15 baseline.
LangChain community	>=0.3.31,<0.4	Retain the compatible community adapter alongside Ragas 0.2.6; provider adapters resolve independently.
LangChain provider adapters	Anthropic >=1.7.6, Ollama >=1.1.0, OpenAI >=1.7.2	These 1.x adapters resolve with the retained community adapter; the community cap does not hold all LangChain packages at 0.3.
datasets	>=5.0.1	Retain the compatible release: 5.1 requires an hf-xet range incompatible with Pydantic AI's Hugging Face integration (hf-xet<1.5).

The last row is a compatible minimum, not a claim that every newer release can coexist with all extras. Let the resolver honor the complete graph rather than forcing individual requested major versions. Keep optional evaluation and sandbox dependencies out of installations that do not need them.

Monty 0.0.23 execution migration

The agentic-script-execution extra includes Monty's SDK runtime binary package, pydantic-monty-runtime. Keep that optional dependency installed alongside the SDK. Binary discovery uses the SDK's locator; an explicit SDK MONTY_BIN setting must identify a compatible executable. Missing binaries fail with installation guidance instead of falling back to CPython or a remote execution service.

MontyEnvironment and SecureScriptRunner retain their public call signatures. The adapter owns an AsyncMonty(max_processes=1, min_processes=0) pool and a fresh checkout for each run, closes both on every exit path, and preserves direct guest calls to sync and async external functions. The default 30-second wall-clock budget includes waiting for host callbacks; guest VM time, memory and recursion limits remain available. Remove max_allocations values before upgrading: Monty 0.0.23 no longer supports that control and PyFly raises ValueError before starting workers. See the execution tutorial.

Feature-flag cohort compatibility

The feature-flags extra retains openfeature-flagd-core>=1.0.0,<2. Version 2 changes fractional bucketing from raw flagKey + targetingKey input to a canonical CBOR array. That changes cohort assignments for existing users and fails the shared PyFly/LaraFly conformance vectors. Preserve the established vectors and application targeting keys when upgrading this hotfix; changing those fixtures to match the new dependency would hide a rollout behavior change.

A future 2.x adoption requires an explicit shared-contract migration and cross-framework qualification before changing cohort behavior. The current constraint intentionally defers that major version while allowing compatible 1.x fixes.

The MySQL extra also preserves its qualified asyncmy>=0.2.11 minimum alongside SQLAlchemy 2.0.50. The lock already selects asyncmy 0.2.16; raising the declared minimum to that patch would exclude supported application combinations without changing the version exercised by the repository tests.

Earlier v26.10.05 refresh

The earlier release consolidated Dependabot PR #171 and PR #157. The following adapter notes and version table describe that earlier refresh; the current hotfix's declared constraints and lock take precedence.

Adapter and tooling compatibility

Redis 8 introduces a five-second default socket timeout. PyFly's Redis Streams consumer explicitly keeps its blocking socket read unbounded so finite long polls and block_ms=0 remain valid; stop() cancels the consumer. Explicit socket settings in the Redis URL retain precedence. Legacy stream response shapes are selected for both RESP2 and RESP3. A real-server regression exercises idle reads longer than five seconds, event delivery, and cancellation.

Click, jsonpath-ng, and mypy changes are accommodated without changing public framework APIs. Testcontainers configuration tests isolate the Docker client; real backend tests remain in the integration lanes. Installer tests isolate PATH configuration from the user's shell profiles.

All 14 actions/setup-python uses are pinned to v7.0.0 commit 5fda3b95a4ea91299a34e894583c3862153e4b97. The removed pip-install input was not used by these workflows. At that release, book builds used WeasyPrint 70 and CairoSVG 2.9.1 or later, including the upstream security fixes; both English and Spanish PDF/EPUB editions are rebuilt from the software tag.

Historical v26.10.05 requested updates and resolved versions

The requested floor comes from the original Dependabot proposal. The resolved version is the release lock, or the separately installed site/book toolchain. This table records v26.10.05, not the current hotfix lock. Removed Presidio packages are omitted; their original release record remains in the changelog. SQLAlchemy's proposal changed only a comment: its floor then remained >=2.0.50.

Package	Dependabot requested floor	Resolved version
aio-pika	aio-pika>=10.0.4	10.1.1
aiosmtpd	aiosmtpd>=1.4.6	1.4.6
alembic	alembic>=1.20.0	1.20.0
argon2-cffi	argon2-cffi>=25.1.0	25.1.0
asyncmy	asyncmy>=0.2.15	0.2.16
azure-storage-blob	azure-storage-blob>=12.30.3	12.31.0
beanie	beanie>=2.2.0	2.2.0
boto3	boto3>=1.43.103	1.43.114
click	click>=8.5.0	8.5.0
coverage	coverage[toml]>=7.16.1	7.16.2
croniter	croniter>=6.2.4	6.2.4
cryptography	cryptography>=50.0.1	50.0.2
fastapi	fastapi>=0.141.1	0.143.1
gitpython	GitPython>=3.1.62	3.2.1
granian	granian>=2.8.3	2.8.4
grpcio	grpcio>=1.84.0	1.84.0
markdown	Markdown>=3.11,<4	3.11.1
mkdocs-material	mkdocs-material>=9.7.7,<10	9.7.7
mypy	mypy>=2.3.1	2.4.0
opentelemetry-api	opentelemetry-api>=1.45.0	1.45.1
opentelemetry-exporter-otlp-proto-http	opentelemetry-exporter-otlp-proto-http>=1.45.0	1.45.1
opentelemetry-instrumentation-starlette	opentelemetry-instrumentation-starlette>=0.66b0	0.66b1
opentelemetry-sdk	opentelemetry-sdk>=1.45.0	1.45.1
pika	pika>=1.4.4	1.4.4
prometheus-client	prometheus-client>=0.26.0	0.26.0
pydantic	pydantic>=2.13.5	2.14.1
pygments	Pygments>=2.21.0,<3	2.21.0
pyjwt	pyjwt[crypto]>=2.15.0	2.15.1
pymdown-extensions	pymdown-extensions>=12.1,<13	12.2
pyotp	pyotp>=2.10.0	2.10.0
pytest	pytest>=9.1.1	9.1.1
pytest-asyncio	pytest-asyncio>=1.4.0	1.4.0
python-multipart	python-multipart>=0.0.32	0.0.32
redis	redis[hiredis]>=8.1.0	8.1.0
respx	respx>=0.23.1	0.23.1
ruff	ruff>=0.16.9	0.17.0
sqlalchemy	sqlalchemy[asyncio]>=2.0.50 (lock >=2.1.1)	2.1.4
starlette	starlette>=1.7.0	1.8.0
structlog	structlog>=26.1.0	26.1.0
testcontainers	testcontainers>=4.15.0	4.15.0
uvicorn	uvicorn[standard]>=0.54.0	0.54.0
weasyprint	WeasyPrint>=70.0,<71	70.0
websockets	websockets>=17.1	17.2
cairosvg (additional security update)	CairoSVG>=2.9.1,<3	2.9.1

CairoSVG is additionally raised from >=2.9,<3 to >=2.9.1,<3 to exclude the affected 2.9.0 release. Package minimums allow compatible newer releases; use uv.lock for the repository's exact dependency selection. Consumers should maintain and validate their own application lockfiles when upgrading.