ancongui · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -2,7 +2,7 @@ version: 2
 updates:
   - package-ecosystem: uv
     directory: "/"
-    versioning-strategy: increase-if-necessary
+    versioning-strategy: lockfile-only
     schedule:
       interval: weekly
     groups:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
+## v26.10.11 (2026-10-24)
+
+### Changed
+
+- Include the previously unreleased dependency metadata from Dependabot PR #196:
+  `agentic-openai-embeddings` and `agentic-azure-embeddings` require
+  `openai>=3.36.0`, `agentic-binary` requires `pypdf>=6.21.2`, and the `fastapi`
+  extra requires `fastapi>=0.158.0`. The v26.10.10 lock already selected OpenAI
+  3.37.0, pypdf 6.21.2 and FastAPI 0.162.0; these changes raise declared
+  minimums without introducing an application API change. PR #196 also separates
+  native uv project updates from pip documentation updates.
+- Preserve the qualified SQLAlchemy `>=2.0.50` minimum while the repository lock
+  selects 2.1.6. Use Dependabot's `lockfile-only` strategy for project dependency
+  updates so compatible lock refreshes do not raise application requirements.
+  Keep documentation requirements under the separate pip updater and retain
+  the existing SDK and feature-flag compatibility caps.
+- Raise the book toolchain's PyYAML requirement to `>=6.0.3,<7` from Dependabot
+  PR #197; the installed version remains 6.0.3.
+- Refresh the Lumen and native Agentic book companion locks against 26.10.11,
+  including the current SDK pins, so their documented locked installs work.
+
+### Documentation
+
+- Refresh current release installation examples and download links, document
+  dependency-floor maintenance, and rebuild the aligned English/Spanish books.
+  Native Agentic APIs, Monty 0.0.23 examples and canonical artwork are preserved.
+
 ## v26.10.10 (2026-10-24)
 
 ### Fixed

diff --git a/README.md b/README.md
@@ -13,7 +13,7 @@
   <a href="https://github.com/fireflyframework"><img src="https://img.shields.io/badge/Firefly_Framework-official-ff6600?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI+PHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0xMiAyQzYuNDggMiAyIDYuNDggMiAxMnM0LjQ4IDEwIDEwIDEwIDEwLTQuNDggMTAtMTBTMTcuNTIgMiAxMiAyeiIvPjwvc3ZnPg==" alt="Firefly Framework"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/python-3.12%2B-blue?logo=python&logoColor=white" alt="Python 3.12+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="License: Apache 2.0"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-26.10.10-brightgreen" alt="Version: 26.10.10"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-26.10.11-brightgreen" alt="Version: 26.10.11"></a>
   <a href="https://mypy-lang.org/"><img src="https://img.shields.io/badge/type--checked-mypy%20strict-blue?logo=python&logoColor=white" alt="Type Checked: mypy strict"></a>
   <a href="https://docs.astral.sh/ruff/"><img src="https://img.shields.io/badge/code%20style-ruff-purple?logo=ruff&logoColor=white" alt="Code Style: Ruff"></a>
   <a href="#philosophy"><img src="https://img.shields.io/badge/async-first-brightgreen" alt="Async First"></a>
@@ -61,7 +61,7 @@
 
 It covers the whole stack: dependency injection, configuration & profiles, the web layer, the Spring-Data `Repository` (derived queries, pagination, specifications, projections), DDD aggregates & `Money`, CQRS, domain events & event sourcing, messaging, HTTP clients, sagas, caching & resilience, security, observability, testing, scheduling, and going to production. Spring developers get a **Spring parity** callout at every turn.
 
-**📥 Download the books shipped with v26.10.10:** **[English PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example.pdf)** · **[English EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example.epub)** · **[Spanish PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example-es.pdf)** · **[Spanish EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example-es.epub)**. For a specific version, use its [tagged release](https://github.com/fireflyframework/fireflyframework-pyfly/releases), or build from source with `bash book/build/run.sh --out-dir book/release-output`. Run the companion sample with `cd samples/lumen && uv run --extra dev pytest` and `uv run pyfly run --server uvicorn`.
+**📥 Download the books shipped with v26.10.11:** **[English PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example.pdf)** · **[English EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example.epub)** · **[Spanish PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example-es.pdf)** · **[Spanish EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example-es.epub)**. For a specific version, use its [tagged release](https://github.com/fireflyframework/fireflyframework-pyfly/releases), or build from source with `bash book/build/run.sh --out-dir book/release-output`. Run the companion sample with `cd samples/lumen && uv run --extra dev pytest` and `uv run pyfly run --server uvicorn`.
 
 ---
 
@@ -851,7 +851,9 @@ See **[`samples/lumen/`](samples/lumen/README.md)** for an end-to-end DDD micros
 
 > **Note:** PyFly is distributed exclusively via [GitHub Releases](https://github.com/fireflyframework/fireflyframework-pyfly/releases). It is **not** published to PyPI.
 
-**Upgrading to v26.10.10:** Optional script execution now uses Monty 0.0.23 with an owned worker and fresh session per run. Existing Code Mode calls keep their direct tool syntax. Remove non-`None` `max_allocations` limits; use memory, recursion and time budgets instead. See the [execution guide](docs/modules/agentic/execution.md).
+**Upgrading to v26.10.11:** This maintenance release preserves application APIs and the SQLAlchemy 2.0.50 minimum while refreshing the repository lock and book toolchain. Resolve and test your application lock. See the [dependency update notes](docs/dependency-updates.md).
+
+**From v26.10.10:** Optional script execution now uses Monty 0.0.23 with an owned worker and fresh session per run. Existing Code Mode calls keep their direct tool syntax. Remove non-`None` `max_allocations` limits; use memory, recursion and time budgets instead. See the [execution guide](docs/modules/agentic/execution.md).
 
 **From v26.10.09:** Native pattern redaction remains enabled by default; the `pii` extra and Presidio backend are removed. Remove the `presidio` configuration block and use `engine: regex`; legacy `auto` selects regex. See the [logging migration](docs/modules/logging.md#upgrading-from-the-removed-presidio-backend).
 
@@ -869,13 +871,13 @@ hotfix baseline and the migration from the removed Presidio backend.
 
 ```bash
 # Install the latest release (uv)
-uv add "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.10-py3-none-any.whl"
+uv add "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.11-py3-none-any.whl"
 
 # Install with specific extras
-uv add "pyfly[web,data-relational,cache] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.10-py3-none-any.whl"
+uv add "pyfly[web,data-relational,cache] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.11-py3-none-any.whl"
 
 # Or with pip
-pip install "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.10-py3-none-any.whl"
+pip install "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.11-py3-none-any.whl"
 ```
 
 ### One-Line Install (CLI + Framework)
@@ -1206,6 +1208,7 @@ The git tag and human-readable display use the leading-zero form (`v26.05.01`);
 
 The full release history lives in **[CHANGELOG.md](CHANGELOG.md)** ([Keep a Changelog](https://keepachangelog.com/) format). Recent highlights:
 
+- **`v26.10.11`** (2026-10-24) — preserve supported dependency minimums, keep automated project updates in the lockfile, and refresh the book toolchain and both editions.
 - **`v26.10.10`** (2026-10-24) — adapt optional sandbox execution to Monty 0.0.23, preserve direct sync/async Code Mode tools, and refresh the English/Spanish execution tutorials.
 - **`v26.10.09`** (2026-10-24) — remove Presidio and the `pii` extra while keeping native pattern redaction enabled, refresh compatible dependencies, and reduce the admin logo size.
 - **`v26.10.08`** (2026-10-24) — integrate the native optional `pyfly.agentic` module, application-owned runtime and agents/tools/knowledge/workflows, with complete migration guidance and English/Spanish book chapters.

diff --git a/book/README.md b/book/README.md
@@ -7,10 +7,10 @@ wallet offer route, shared targeting fixture, runtime gates and operator workflo
 
 | Edition | PDF | EPUB |
 |---|---|---|
-| English | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example.epub) |
-| Spanish | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example-es.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.10/pyfly-by-example-es.epub) |
+| English | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example.epub) |
+| Spanish | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example-es.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.11/pyfly-by-example-es.epub) |
 
-These books are rebuilt from the `v26.10.10` software tag. The independently
+These books are rebuilt from the `v26.10.11` software tag. The independently
 published [2026-10-14 edition](https://github.com/fireflyframework/fireflyframework-pyfly/releases/tag/books-26.10.14)
 retains its original assets. For other editions, open the
 [tagged releases](https://github.com/fireflyframework/fireflyframework-pyfly/releases)
@@ -23,7 +23,10 @@ native HTTP/events/plugins and the guarded Agentic admin console. The hotfix
 refresh replaces the removed Presidio setup with native regex
 redaction and migration guidance in both languages. The v26.10.10 refresh adds
 a runnable Monty 0.0.23 computation and Code Mode tutorial to Chapter 19 in both
-editions, including worker/session ownership and supported resource limits. Local candidate builds must
+editions, including worker/session ownership and supported resource limits. The
+v26.10.11 maintenance refresh keeps those APIs, preserves supported dependency
+minimums and updates the book toolchain to PyYAML 6.0.3 or later within 6.x.
+Local candidate builds must
 record the checkout commit and dirty source hashes until the release is published.
 
 ## Sources and examples

diff --git a/book/manuscript-es/19-agentic-agents.md b/book/manuscript-es/19-agentic-agents.md
@@ -13,9 +13,15 @@ de la aplicación: versiones posteriores de Ragas y datasets tienen conflictos
 de API o dependencias descritos en las
 [notas de dependencias](https://fireflyframework.github.io/fireflyframework-pyfly/docs/dependency-updates/).
 
+La versión de mantenimiento v26.10.11 conserva estas API y el mínimo de
+SQLAlchemy 2.0.50. El lock del repositorio selecciona 2.1.6; cada aplicación
+conserva y prueba su propio lock de dependencias. Las actualizaciones automáticas
+del proyecto cambian el lockfile; modificar requisitos exige revisar compatibilidad
+por separado.
+
 ## 19.1. Activar el módulo de forma explícita
 
-Instala el núcleo opcional desde el wheel oficial de v26.10.10, seleccionando
+Instala el núcleo opcional desde el wheel oficial de v26.10.11, seleccionando
 `pyfly[agentic]`, como indica la
 [guía de instalación](https://fireflyframework.github.io/fireflyframework-pyfly/docs/modules/agentic/getting-started/installation/).
 PyFly se distribuye mediante GitHub Releases. Una instalación base no necesita
@@ -180,7 +186,7 @@ de SQLite con una fila de negocio y un hecho asíncrono.
 
 ## 19.10. Ejecutar scripts limitados con Code Mode
 
-Instala `pyfly[agentic,agentic-script-execution]` desde el wheel de v26.10.10.
+Instala `pyfly[agentic,agentic-script-execution]` desde el wheel de v26.10.11.
 Este extra opcional instala `pydantic-monty==0.0.23` y el binario de
 `pydantic-monty-runtime`. El SDK localiza el binario instalado y admite
 `MONTY_BIN` para indicar un ejecutable compatible. Si falta el runtime,

diff --git a/book/manuscript/19-agentic-agents.md b/book/manuscript/19-agentic-agents.md
@@ -12,9 +12,14 @@ community 0.3 adapter and datasets >=5.0.1. Resolve the complete application
 graph: newer Ragas and datasets releases have API or dependency conflicts in the
 [dependency notes](https://fireflyframework.github.io/fireflyframework-pyfly/docs/dependency-updates/).
 
+The v26.10.11 maintenance release preserves these APIs and the SQLAlchemy
+2.0.50 minimum. The repository lock selects 2.1.6; applications keep and test
+their own dependency locks. Automated project updates change the lockfile;
+requirement changes need separate compatibility review.
+
 ## 19.1. Enable the module deliberately
 
-Install the optional core from the official v26.10.10 release wheel, selecting
+Install the optional core from the official v26.10.11 release wheel, selecting
 `pyfly[agentic]`, as shown in the
 [installation guide](https://fireflyframework.github.io/fireflyframework-pyfly/docs/modules/agentic/getting-started/installation/).
 PyFly is distributed through GitHub Releases. Base installations need no AI SDK. Enable managed integration in the effective configuration tree:
@@ -178,7 +183,7 @@ actual SQLite transaction containing both a business row and an async fact.
 
 ## 19.10. Execute bounded scripts with Code Mode
 
-Install `pyfly[agentic,agentic-script-execution]` from the v26.10.10 release
+Install `pyfly[agentic,agentic-script-execution]` from the v26.10.11 release
 wheel. This optional extra installs `pydantic-monty==0.0.23` and the
 `pydantic-monty-runtime` binary. The SDK discovers its installed binary and
 honors `MONTY_BIN` for an explicit compatible executable. A missing runtime

diff --git a/docs/cli.md b/docs/cli.md
@@ -789,7 +789,7 @@ Missing optional tools are shown with a `-` dash indicator (dimmed), while missi
 Verifies that PyFly itself is importable and displays the installed version:
 
 ```
-✓ pyfly v26.10.10
+✓ pyfly v26.10.11
 ```
 
 ### Summary

diff --git a/docs/dependency-updates.md b/docs/dependency-updates.md
@@ -1,28 +1,51 @@
-# Dependency updates in v26.10.10
-
-This release adapts sandbox execution to Monty 0.0.23 from Dependabot
-[PR #195](https://github.com/fireflyframework/fireflyframework-pyfly/pull/195),
-following the compatible updates from Dependabot
-[PR #193](https://github.com/fireflyframework/fireflyframework-pyfly/pull/193).
+# Dependency updates in v26.10.11
+
+This maintenance release adopts the book toolchain's `PyYAML>=6.0.3,<7` from
+Dependabot [PR #197](https://github.com/fireflyframework/fireflyframework-pyfly/pull/197).
+It retains `SQLAlchemy>=2.0.50` instead of raising the supported minimum to
+2.1.6 as proposed by [PR #198](https://github.com/fireflyframework/fireflyframework-pyfly/pull/198).
+The repository lock already selects SQLAlchemy 2.1.6 and PyYAML 6.0.3. No
+application API migration is required from v26.10.10; Pydantic AI 2.59.0,
+Monty 0.0.23 and the existing compatibility caps remain in place.
+This release also includes previously unreleased dependency metadata from
+Dependabot [PR #196](https://github.com/fireflyframework/fireflyframework-pyfly/pull/196):
+OpenAI/Azure embedding extras now require `openai>=3.36.0`, the binary extra
+requires `pypdf>=6.21.2`, and the FastAPI extra requires `fastapi>=0.158.0`.
+The v26.10.10 lock already selected OpenAI 3.37.0, pypdf 6.21.2 and FastAPI
+0.162.0; the changed metadata makes those minimum requirements explicit.
+SQLAlchemy's locked selection advances from 2.1.4 to 2.1.6 while its supported
+2.0.50 minimum stays intact. PR #196 also introduced the native uv project
+updater and separate pip documentation updater.
+
+If an application selects one of these extras, reconcile any direct SDK pins
+below its new minimum before resolving the full graph, then test that adapter.
+Applications that do not select those extras do not need to add those SDKs.
 The declared constraints are in `pyproject.toml`; `uv.lock` records the exact
 repository selection. Applications must resolve and validate their own locks.
 Python 3.12 and 3.13 remain the qualification targets.
 
 ## Repository dependency automation
 
 Dependabot uses the `uv` ecosystem so Python updates include `uv.lock`, matching
-CI's `uv sync --locked` checks. The `increase-if-necessary` strategy retains an
-existing supported requirement when it already allows the updated dependency;
-it still updates the resolved lock. The Python dependency group includes both
-runtime and development dependencies.
+CI's `uv sync --locked` checks. The `lockfile-only` strategy updates resolved
+versions within existing requirements and leaves declared compatibility floors
+unchanged. Review requirement changes separately with the affected adapter's
+minimum-version and current-version qualification lanes. The Python dependency
+group includes both runtime and development dependencies. On the next native
+`uv` updater run, inspect its job payload and confirm `lockfile-only: true`;
+checked-in configuration records intent, not proof that the updater applied it.
+An earlier run reported `requirements-update-strategy: null` and
+`lockfile-only: false`, so that run does not establish an upstream strategy bug.
 
 The separate `pip` entry keeps maintaining the documentation requirements while
 excluding `pyproject.toml` and `uv.lock`, which belong to the `uv` entry.
 
 Intentional changes to Agentic extra requirements must also update the reviewed
 contracts in `scripts/agentic-migration-manifest.json`. Regenerate the lock and
-run `scripts/verify_agentic_migration.py` before submitting those changes. Keep
-the SQLAlchemy 2.0.50 floor and the separate 2.0/2.1 qualification lanes; a newer
+run `scripts/verify_agentic_migration.py` before submitting those changes.
+Explicitly pinned Pydantic AI and Monty upgrades require this deliberate
+manifest review and adapter qualification; lockfile-only automation cannot
+advance those pins. Keep the SQLAlchemy 2.0.50 floor and the separate 2.0/2.1 qualification lanes; a newer
 locked patch does not require dropping supported application combinations.
 
 See [uv's Dependabot integration](https://docs.astral.sh/uv/guides/integration/dependabot/)
@@ -45,6 +68,11 @@ do not reuse their removed backend installation instructions for this hotfix.
 
 | Dependency | Current selection | Compatibility boundary |
 | --- | --- | --- |
+| OpenAI SDK (`agentic-openai-embeddings`, `agentic-azure-embeddings`) | `>=3.36.0`; lock `3.37.0` | Reconcile lower application pins when selecting either embedding extra. |
+| pypdf (`agentic-binary`) | `>=6.21.2`; lock `6.21.2` | Reconcile lower application pins for binary ingestion. |
+| FastAPI (`fastapi`) | `>=0.158.0`; lock `0.162.0` | Reconcile lower application pins when selecting the FastAPI adapter. |
+| SQLAlchemy | `>=2.0.50`; lock `2.1.6` | Preserve qualified 2.0 applications while exercising the newer 2.1 selection in repository environments. |
+| PyYAML (book toolchain) | `>=6.0.3,<7`; installed `6.0.3` | Keep documentation parsing within the supported 6.x series. |
 | asyncmy | `>=0.2.11`; lock `0.2.16` | Keep the proven MySQL/MariaDB driver minimum while installing the newer compatible patch in repository environments. |
 | openfeature-flagd-core | `>=1.0.0,<2` | Preserve the shared PyFly/LaraFly fractional cohort contract; 2.x changes the hash input and shifts existing assignments. |
 | Pydantic AI | `==2.59.0` | Preserve provider extras and the native runtime contracts. |