Llama Stack 1.0.3

This maintenance release for the 1.0 line addresses JOSS review findings and includes previously backported security, storage, and provider fixes.

• Enforce configured route restrictions when creating batches, preserving the submitting caller's identity and provider credentials. #6522
• Update UI production dependencies to resolve the reported audit findings. #6519
• Enable UI TypeScript checks and repair the 1.0 playground's Responses, saved-chat, and file-search behavior. #6520
• Repair internal and GitHub documentation links and enforce strict documentation builds. #6518, #6514
• Correct documentation to use ogx stack list-deps, with a pre-commit check that catches the removed CLI forms. #6533
• Add the missing Qdrant unit-test dependency and detect/install integration provider dependencies before starting tests. Failed installations now stop the test run. #6515, #6524
• Correct the installer's Docker Hub namespace and constrain MCP below 2.0 for this release line. #6464, #6463
• Prepare releases only after the matching client is available, committing the exact dependency pins with a regenerated and verified lockfile. Maintenance releases preserve newer latest tags. #6527

Earlier backports on this release branch also harden PostgreSQL/pgvector defaults, authorize SQL-store upserts, bound upload reads, close superseded OpenAI clients, propagate provider 4xx errors, fix file-search defaults, and update pyasn1.

The Python and TypeScript clients are published as ogx-client version 1.0.3; npm's maintenance tag is release-1.0. The server and API packages use version 1.0.3, and the distribution images are ogxai/distribution-starter:1.0.3 and ogxai/distribution-postgres-demo:1.0.3. This maintenance release preserves the newer latest tags.

Validation: 120 focused release, authorization, integration-runner, and CLI tests passed on the prepared commit. uv lock --check passed, and lock regeneration left no diff. The exact release artifacts passed package tests on Python 3.12 and 3.13. A separate clean installation verified matching 1.0.3 packages, MCP 1.30.0, and the working CLI dependency command.

Full changelog