26.10.1: dependency compatibility and streaming fixes

This release resolves 23 outstanding dependency-update requests as one compatible graph and repairs the provider, archive and streaming behaviors exercised by the upgrade. Existing PostgreSQL schema, namespace-conflict rollback and pgvector/HNSW behavior are preserved; no database migration or re-embedding is required.

Compatibility and repairs

• Qualified Pydantic AI 2.55, FastMCP 4.1, MCP 2.3, OpenAI 3.31 and Starlette 1.7. Existing provider extras and endpoint selection remain available. Applications must resolve and qualify their own selected extras; the wheel does not embed the repository lock.
• Restore bounded in-memory 7z extraction with py7zr 1.1.4 and explicit HEIF decoder registration, retaining AVIF support.
• Preserve reasoning/sampling validation with Pydantic AI's renamed profile field, and close interrupted incremental text iterators before their native stream context exits.
• Restore Mistral 2 embeddings and repair optional provider/backend SDK compatibility and combine Chroma namespace/metadata predicates without allowing a filter to replace the namespace.
• Update pinned GitHub Actions, build through the declared PEP 517 backend, and include SHA256SUMS with the release assets.

The Pydantic AI minimum is 2.53, but rejected-fallback token accounting requires 2.55 or later. Aggregate fallback tokens do not establish separate dollar-cost attribution for every attempted provider/model. Cryptography 50 no longer supplies macOS Intel or Windows 32-bit wheels; qualify native dependencies on your target platform.

Remaining security restrictions

Six optional-package advisories remain: Ragas 0.2.6 has GHSA-v2xr-wvrv-p969 and GHSA-95ww-475f-pr4f; ChromaDB 1.5.9 has GHSA-36p7-vc44-83pf, GHSA-2wm9-hf6c-p5cr, GHSA-xph7-9rjv-w5fr and GHSA-f4j7-r4q5-qw2c, including critical server vulnerabilities. None was dismissed. Newer Ragas conflicts with the required OpenAI SDK or changes asyncio at import, and no patched Chroma release was available in the inspected registry.

Do not expose affected multimodal evaluators or Chroma servers to untrusted inputs/clients. Use isolated evaluation workers with restricted filesystem/egress and trusted Chroma configurations; separate trust domains need separate instances. Namespace metadata is not authorization, and Chroma does not inherit PostgreSQL's cross-namespace write-conflict protection. Select another supported backend when those restrictions cannot be met. This release does not claim zero vulnerabilities.

Read the migration guide, installation instructions, and complete resolution/advisory record before upgrading.

Validation

The final source passed 2,576 local tests with all optional packages installed, 580 installed-wheel tests, isolated PostgreSQL namespace-conflict/rollback checks, lint, types, pre-commit hooks, strict documentation checks and independent review. Linux CI passed 2,570 tests with six optional-package tests skipped and 32 nightly cases deselected. All ten PR checks passed on the integrated head. Documentation checks covered 36 pages, 10,569 links and 56 rendered diagrams.

Local SDK tests cover actual Mistral 2.10.1 and its effective minimum 2.9.2 through loopback HTTP, native MCP transports, concurrency/fallback behavior, archive/image fixtures and optional backend parsing. These checks do not establish hosted model-provider behavior, every operating system, or application-specific deployment acceptance.