LocalSetup 4.49.2

LocalSetup 4.49.2

LocalSetup 4.49.2 integrates two reviewed dependency-maintenance slices, including the follow-on pull request discovered during validation. The framework runtime and independently installed storage skills retain synchronized, hash-pinned dependency exports and integrity records.

Highlights

• Refresh the selected framework runtime: the final locked resolution uses OpenAI 3.31.0, Pydantic 2.14.1, pydantic-core 2.50.1, genai-prices 0.1.12, and logfire-api 5.2.0. The declared framework runtime dependency ranges and vendored SDK source remain unchanged.
• Keep optional storage runtimes aligned: the S3 group selects Boto3 1.43.113 and botocore 1.43.114. Both storage skills receive the same regenerated hash-pinned requirements; the reviewed export guard follows the accepted version, while the current lock format is preserved.
• Keep dependency maintenance evidence aligned: the SDK ownership guide distinguishes historical adoption evidence from dated target checks and requires exports and the integrity receipt alongside the source lock. The obsolete branding exception for the removed version-pin test is retired without weakening validation.

Compatibility

The CLI, adapter-preservation, OpenPGP, verified-file-reader, and vendored SDK interfaces are unchanged. Ordinary wheel dependency ranges remain unchanged; unconstrained installers can select versions other than this repository's locked resolution.

Exact-version checks against OSV, GitHub Advisory Database, and registry evidence on 2026-10-17 found no reported vulnerabilities for the selected update targets. These dated checks are not a blanket safety guarantee or all-platform qualification.

Sequential release arithmetic counts the first accepted maintenance slice as 4.49.1 and the follow-on slice as 4.49.2. The combined release is 4.49.2; the intermediate 4.49.1 candidate was not tagged or published. Documentation corrections and generated receipts add no version increment. Previously published tags and assets remain unchanged.

Update

For an explicit source directory or extracted release archive, use --sync-env to provision its locked Python runtime. Follow the multi-platform install guide and preserve custom adapter content.

Maintain the framework SDK exports and receipt through the SDK ownership guide. Optional storage skills have their own shipped requirements; a framework lockfile update alone does not refresh those independent runtimes.

Verification

Before publication, require successful hosted validation of the exact final candidate, including every Python shard, automated smoke checks, framework audit, generated-document checks, and deterministic review. Earlier candidate success does not establish the final candidate's readiness.

Exercise the owning provider client over local HTTP with a synthetic credential and a Pydantic-validated response. Exercise the updated Boto3 and botocore client with a signed local S3 request and parsed response. These checks do not qualify a live provider or storage account.

Verify the signed tag, downloaded archive, .sha256 checksum and .cdx.json SBOM sidecars, exact source binding, and cryptographic provenance. Exercise an isolated installation from the actual downloaded artifact before publishing the verified draft.

Download the archive with its .sha256 checksum and .cdx.json SBOM sidecars, then follow the release guide.