ancongui · Oct 14, 2026 · Oct 14, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -40,7 +40,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -60,7 +60,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -89,7 +89,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -116,7 +116,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -139,7 +139,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -172,7 +172,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: uv sync --all-extras --no-extra pii --group dev
@@ -190,7 +190,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: uv build
@@ -204,7 +204,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - run: pip install -r requirements-docs.txt -r book/requirements.txt pytest
@@ -224,7 +224,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - run: uv sync --all-extras --no-extra pii --group dev --group browser

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: pip

diff --git a/.github/workflows/pii.yml b/.github/workflows/pii.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       # All extras (incl. pii=presidio and cli=click, which spaCy's CLI needs) + dev.

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: uv build
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install book build dependencies

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,39 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
+## v26.10.05 (2026-10-14)
+
+### Changed
+
+- Resolve the grouped Dependabot updates with refreshed runtime, development,
+  documentation, and book dependencies; pin all 14 Python setup workflow uses
+  to the v7.0.0 action commit. Preserve the qualified SQLAlchemy 2.0.50 and
+  asyncmy 0.2.11 minimums while updating their locked versions.
+- Upgrade cryptography to the patched 50 line. The optional `pii` extra uses
+  official Presidio commit `5e2fcea990aa3b99660d2aea9121d0ba74a8940b` because
+  the published anonymizer still caps cryptography below 49. PII installations
+  require Git and GitHub access until a compatible upstream release is qualified.
+  Existing pip PII installations must explicitly reinstall that source before
+  upgrading because the upstream distribution version is unchanged; follow the
+  migration commands in the dependency notes and finish with `pip check`.
+- Update WeasyPrint to 70 and CairoSVG to 2.9.1 or later for the EN/ES books.
+  See [dependency update notes](docs/dependency-updates.md) for the complete
+  version ledger, source provenance, and platform requirements.
+
+### Fixed
+
+- Preserve Redis Streams blocking reads beyond Redis 8's five-second socket
+  timeout, including indefinite reads, delivery after idling, and cancellation.
+- Adapt strict typing to updated Click, jsonpath-ng, Redis, and mypy contracts.
+  Keep installer and Testcontainers unit checks isolated from host profiles
+  and the Docker daemon.
+
+### Documentation
+
+- Synchronize package, installer, site, and book download examples with this
+  release. The tag and displayed version are `v26.10.05`; package metadata is
+  `26.10.5`.
+
 ## v26.10.04 (2026-10-14)
 
 ### Documentation

diff --git a/README.md b/README.md
@@ -13,7 +13,7 @@
   <a href="https://github.com/fireflyframework"><img src="https://img.shields.io/badge/Firefly_Framework-official-ff6600?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI+PHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0xMiAyQzYuNDggMiAyIDYuNDggMiAxMnM0LjQ4IDEwIDEwIDEwIDEwLTQuNDggMTAtMTBTMTcuNTIgMiAxMiAyeiIvPjwvc3ZnPg==" alt="Firefly Framework"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/python-3.12%2B-blue?logo=python&logoColor=white" alt="Python 3.12+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="License: Apache 2.0"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-26.10.04-brightgreen" alt="Version: 26.10.04"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-26.10.05-brightgreen" alt="Version: 26.10.05"></a>
   <a href="https://mypy-lang.org/"><img src="https://img.shields.io/badge/type--checked-mypy%20strict-blue?logo=python&logoColor=white" alt="Type Checked: mypy strict"></a>
   <a href="https://docs.astral.sh/ruff/"><img src="https://img.shields.io/badge/code%20style-ruff-purple?logo=ruff&logoColor=white" alt="Code Style: Ruff"></a>
   <a href="#philosophy"><img src="https://img.shields.io/badge/async-first-brightgreen" alt="Async First"></a>
@@ -61,7 +61,7 @@
 
 It covers the whole stack: dependency injection, configuration & profiles, the web layer, the Spring-Data `Repository` (derived queries, pagination, specifications, projections), DDD aggregates & `Money`, CQRS, domain events & event sourcing, messaging, HTTP clients, sagas, caching & resilience, security, observability, testing, scheduling, and going to production. Spring developers get a **Spring parity** callout at every turn.
 
-**📥 Download the books shipped with v26.10.04:** **[English PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example.pdf)** · **[English EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example.epub)** · **[Spanish PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example-es.pdf)** · **[Spanish EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example-es.epub)**. For a specific version, use its [tagged release](https://github.com/fireflyframework/fireflyframework-pyfly/releases), or build from source with `bash book/build/run.sh --out-dir book/release-output`. Run the companion sample with `cd samples/lumen && uv run --extra dev pytest` and `uv run pyfly run --server uvicorn`.
+**📥 Download the books shipped with v26.10.05:** **[English PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example.pdf)** · **[English EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example.epub)** · **[Spanish PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example-es.pdf)** · **[Spanish EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example-es.epub)**. For a specific version, use its [tagged release](https://github.com/fireflyframework/fireflyframework-pyfly/releases), or build from source with `bash book/build/run.sh --out-dir book/release-output`. Run the companion sample with `cd samples/lumen && uv run --extra dev pytest` and `uv run pyfly run --server uvicorn`.
 
 ---
 
@@ -850,17 +850,21 @@ See **[`samples/lumen/`](samples/lumen/README.md)** for an end-to-end DDD micros
 
 > **Note:** PyFly is distributed exclusively via [GitHub Releases](https://github.com/fireflyframework/fireflyframework-pyfly/releases). It is **not** published to PyPI.
 
+**Upgrading to v26.10.05:** see the [dependency update notes](docs/dependency-updates.md),
+including the temporary upstream source requirement and required pip upgrade
+step for the optional PII extra.
+
 ### Install from GitHub Release (Recommended)
 
 ```bash
 # Install the latest release (uv)
-uv add "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.4-py3-none-any.whl"
+uv add "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.5-py3-none-any.whl"
 
 # Install with specific extras
-uv add "pyfly[web,data-relational,cache] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.4-py3-none-any.whl"
+uv add "pyfly[web,data-relational,cache] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.5-py3-none-any.whl"
 
 # Or with pip
-pip install "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.4-py3-none-any.whl"
+pip install "pyfly @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/latest/download/pyfly-26.10.5-py3-none-any.whl"
 ```
 
 ### One-Line Install (CLI + Framework)
@@ -873,7 +877,7 @@ curl -fsSL https://get.pyfly.io/ | bash
 curl -fsSL https://raw.githubusercontent.com/fireflyframework/fireflyframework-pyfly/main/install.sh | bash
 ```
 
-The installer clones the repo, creates a virtual environment, installs PyFly with all extras, and adds `pyfly` to your PATH. You can customize with environment variables:
+The installer clones the repo, creates a virtual environment, installs PyFly with the `full` application extra by default, and adds `pyfly` to your PATH. Add `pii` explicitly if you need Presidio redaction. You can customize with environment variables:
 
 ```bash
 # Install to a custom directory
@@ -1190,6 +1194,7 @@ The git tag and human-readable display use the leading-zero form (`v26.05.01`);
 
 The full release history lives in **[CHANGELOG.md](CHANGELOG.md)** ([Keep a Changelog](https://keepachangelog.com/) format). Recent highlights:
 
+- **`v26.10.05`** (2026-10-14) — refreshed dependencies and pinned Python setup workflows, with synchronized release metadata and English/Spanish book downloads.
 - **`v26.10.04`** (2026-10-14) — revised public OAuth references and rebuilt English/Spanish PDF/EPUB books, with synchronized package and installer metadata.
 - **`v26.10.03`** (2026-10-14) — authorization-code/PKCE redemption through the native HTTP endpoint, with form-encoded OAuth Basic credentials across acquisition and introspection.
 - **`v26.10.02`** (2026-10-13) — bounded OAuth token refresh, explicit code-exchange authentication and resource indicators; applications retain callback verification and token custody.

diff --git a/book/README.md b/book/README.md
@@ -7,10 +7,10 @@ wallet offer route, shared targeting fixture, runtime gates and operator workflo
 
 | Edition | PDF | EPUB |
 |---|---|---|
-| English | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example.epub) |
-| Spanish | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example-es.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.04/pyfly-by-example-es.epub) |
+| English | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example.epub) |
+| Spanish | [PDF](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example-es.pdf) | [EPUB](https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-by-example-es.epub) |
 
-These books are rebuilt from the `v26.10.04` software tag. The independently
+These books are rebuilt from the `v26.10.05` software tag. The independently
 published [2026-10-14 edition](https://github.com/fireflyframework/fireflyframework-pyfly/releases/tag/books-26.10.14)
 retains its original assets. For other editions, open the
 [tagged releases](https://github.com/fireflyframework/fireflyframework-pyfly/releases)

diff --git a/book/manuscript-es/15-observability.md b/book/manuscript-es/15-observability.md
@@ -192,10 +192,18 @@ Esa pasada de redacción se ejecuta para *cada* logger del proceso, incluidos lo
 El motor de expresiones regulares viene con cada instalación. El motor NER respaldado por Presidio —que además atrapa nombres y direcciones en texto libre— está disponible mediante el extra `[pii]` y se activa automáticamente cuando se instala:
 
 ```bash
-uv add "pyfly[observability,pii]"
-python -m spacy download en_core_web_sm   # lighter model; lg for higher recall
+uv add "pyfly[observability,pii] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-26.10.5-py3-none-any.whl"
+uv run python -m spacy download en_core_web_sm
 ```
 
+En v26.10.05, el extra PII requiere Git y acceso a GitHub: fija una corrección
+oficial del código fuente de Presidio para poder instalar cryptography 50.
+Ese código conserva el mismo número de versión que el paquete anterior de PyPI.
+Las instalaciones existentes con pip deben reinstalar explícitamente el
+anonimizador fijado antes de actualizar; sigue el [procedimiento de migración](https://fireflyframework.github.io/fireflyframework-pyfly/docs/dependency-updates/#presidio-and-cryptography)
+y termina con `python -m pip check`. El motor de expresiones regulares no necesita
+este extra.
+
 Configura la redacción en `pyfly.yaml`:
 
 ```yaml
@@ -210,8 +218,9 @@ pyfly:
         - token
         - secret
       presidio:
+        model: en_core_web_sm
         score-threshold: 0.6
-        languages: [en, es]
+        languages: [en]
 ```
 
 `deny-fields` enumera los *nombres* de los campos de log estructurado cuyos valores se sustituyen incondicionalmente por `<REDACTED>`. Úsalo para campos como `password`, donde sabes que el valor es sensible sin inspeccionar el contenido.

diff --git a/book/manuscript/15-observability.md b/book/manuscript/15-observability.md
@@ -188,10 +188,17 @@ That redaction pass runs for *every* logger in the process, including ones insid
 The regex engine ships with every install. The Presidio-backed NER engine — which also catches free-text names and addresses — is available via the `[pii]` extra and activates automatically when installed:
 
 ```bash
-uv add "pyfly[observability,pii]"
-python -m spacy download en_core_web_sm   # lighter model; lg for higher recall
+uv add "pyfly[observability,pii] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.05/pyfly-26.10.5-py3-none-any.whl"
+uv run python -m spacy download en_core_web_sm
 ```
 
+For v26.10.05, the optional PII extra requires Git and GitHub access: it pins
+an official Presidio source fix so cryptography 50 can be installed. The source
+still reports the same Presidio version as its older PyPI package. Existing pip
+installations must explicitly reinstall the pinned anonymizer before upgrading;
+follow the [dependency migration procedure](https://fireflyframework.github.io/fireflyframework-pyfly/docs/dependency-updates/#presidio-and-cryptography)
+and finish with `python -m pip check`. The regex engine does not need this extra.
+
 Configure redaction in `pyfly.yaml`:
 
 ```yaml
@@ -206,8 +213,9 @@ pyfly:
         - token
         - secret
       presidio:
+        model: en_core_web_sm
         score-threshold: 0.6
-        languages: [en, es]
+        languages: [en]
 ```
 
 `deny-fields` lists structured log field *names* whose values are unconditionally replaced with `<REDACTED>`. Use it for fields like `password` where you know the value is sensitive without inspecting the content.

diff --git a/book/requirements.txt b/book/requirements.txt
@@ -1,7 +1,7 @@
-Markdown>=3.7,<4
-Pygments>=2.18,<3
+Markdown>=3.11,<4
+Pygments>=2.21.0,<3
 PyYAML>=6,<7
-WeasyPrint>=68,<70
-pymdown-extensions>=10,<13
-CairoSVG>=2.9,<3
+WeasyPrint>=70.0,<71
+pymdown-extensions>=12.1,<13
+CairoSVG>=2.9.1,<3
 pdfplumber>=0.11.9,<0.12
diff --git a/docs/cli.md b/docs/cli.md
@@ -776,7 +776,7 @@ Missing optional tools are shown with a `-` dash indicator (dimmed), while missi
 Verifies that PyFly itself is importable and displays the installed version:
 
 ```
-✓ pyfly v26.10.04
+✓ pyfly v26.10.05
 ```
 
 ### Summary