v1.0.26

What's Changed

• Security: exclude litellm 1.107.0, which was published to PyPI with a credential stealer and backdoor, from every litellm requirement (the litellm, entity_resolution_llm and all extras, and the examples). The locked version stays 1.96.2, which is unaffected by @georgeh0 in #2576
• Preview works on real pipelines and writes nothing
  • Preview now handles target states under a container (rows in a Postgres / Qdrant / LanceDB table, and so on), so it no longer stops at once on most pipelines. A preview no longer stores, deletes or refreshes memos and no longer writes committed state, so it can't make the next real update skip work. Connector authors: TargetActionSink.from_fn(fn, child_handler=...) / from_async_fn(...) replace from_fn_with_children / from_async_fn_with_children, which now raise DeprecationWarning and don't support preview. Neo4j, FalkorDB and SurrealDB ConnectionFactory keep one connection per event loop and gain close() (neo4j, falkordb). FalkorDB now requires falkordb>=1.6.0 by @badmonster0 in #2510
• feat(engine): max_inflight_components now bounds every running component. A parent lends its slot to one child at a time, so wide fan-outs stay within the limit and a hierarchy of any depth can't deadlock by @georgeh0 in #2486
• feat(core): coco.logic_propagated_to_callers(fn) makes a callback's logic count toward its callers' memos, even when it is called through a library function that uses logic_tracking="self". Editing the callback now invalidates those memos by @georgeh0 in #2483 and #2529 (coco.logic_tracked remains as a deprecated alias)
• feat(code): Nix syntax support for splitting and structural code patterns by @mulatta in #2434
• Rust SDK fixes
  • Memoized calls join the enclosing caller's frame, so a memoized caller no longer returns stale values or deletes its children's outputs on a cache hit. Mounting inside #[function(memo)] is rejected, as in Python. use_mount! / mount_each! key by memo identity, so touching a file no longer re-runs every component. Connectors use one sink per handler instead of one apply per row by @badmonster0 in #2503
  • App::drop_state and normal updates now remove targets declared through root providers (directory files, Postgres/SQLite/LanceDB/Qdrant/… tables) when they're no longer declared. Breaking: the neo4j/falkordb table and relation target functions take &ContextKey<Graph> instead of &Graph by @badmonster0 in #2512
• fix(graph): cocoindex drop and un-declaring a table delete the Neo4j/FalkorDB nodes and relationships the app wrote, and a primary-key change rebuilds the table instead of leaving old-key nodes behind by @georgeh0 in #2498
• fix(neo4j): an apply batch retries on transient errors such as DeadlockDetected instead of failing the component by @georgeh0 in #2491
• fix(ops): LiteLLMEmbedder embeds text starting with data:…;base64,, gs:// or files/ as text rather than as a file reference. A request litellm refuses to build no longer retries until the 10-minute deadline; the batch is split to isolate the bad text by @georgeh0 in #2532
• fix(code_match): regex prefilters no longer drop nested alternatives, which made searches miss matches. regex_required_literals is now public by @georgeh0 in #2525
• fix(fn): @coco.fn(batching=...) / runner=... are now type errors (use @coco.fn.as_async), and a lone max_batch_size= on a sync function is rejected instead of ignored by @georgeh0 in #2493
• fix(env): on free-threaded Python 3.14, the background event loop no longer starts twice, and an environment can be reopened without close() after a localfs-reading app by @georgeh0 in #2490 and #2499
• fix(utils): internal errors show their full cause chain (e.g. db error: ERROR: deadlock detected instead of db error) by @georgeh0 in #2489
• Rust dependency security: drop the legacy rustls 0.21 stack from the S3 client (rustls-webpki advisories), take aws-smithy-json 0.62.7 (GHSA-8ffr-xgwf-xj56; MSRV is now 1.91.1), and bump rustls to 0.23.46 (GHSA-2mjx-qc3c-rqvc) by @georgeh0 in #2544, #2542 and #2543
• docs(telemetry): document the optional application tag by @georgeh0 in #2539
• docs(valkey): document that client_info_tag defaults to "cocoindex" by @Jonathan-Improving in #2480

New Contributors

• @mulatta made their first contribution in #2434
• @Jonathan-Improving made their first contribution in #2480

Full Changelog: v1.0.25...v1.0.26