fix(deps): pin openai below 3 so a fresh install can call the LLM

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-09-24
+
+**A fresh install works again.** The `openai` SDK released its 3.x line on
+2026-09-24; an unconstrained install picked it up together with an httpx
+pre-release, and every LLM and embedding call failed before reaching the
+network. This release pins the SDK to the 2.x line the project is tested
+against. Nothing else changed since 1.4.0.
+
+### Fixed
+
+- **`openai` is pinned below 3.** Fresh installs from PyPI resolved
+  `openai 3.19.2`, whose client raises `AttributeError: module 'httpx' has no
+  attribute 'Timeout'` on every request, so memorize and hybrid / vector
+  search returned 500. Existing environments built from `uv.lock` were never
+  affected.
+
+### Upgrade
+
+- `pip install --upgrade everos` brings `openai` back to 2.x. If a fresh
+  install of 1.4.0 (or any earlier version) today shows the `httpx` error
+  above, upgrade to 1.4.1 or run `pip install "openai<3"`.
+
 ## [1.4.0] - 2026-09-24
 
 **EverOS runs natively on Windows, and dense search stops scanning the whole

docs/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "everos",
     "description": "md-first memory extraction framework",
-    "version": "1.4.0"
+    "version": "1.4.1"
   },
   "paths": {
     "/health": {

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "everos"
-version = "1.4.0"
+version = "1.4.1"
 description = "EverOS — local-first markdown memory framework for AI agents and user chats; lightweight, dev-friendly, small-team"
 license = {text = "Apache-2.0"}
 readme = "README.md"
@@ -45,7 +45,9 @@ dependencies = [
     "greenlet>=3.0",              # Required by SQLAlchemy async
 
     # LLM & embedding (one provider per file pattern)
-    "openai>=1.0.0",
+    # <3: openai 3.x (2026-09-24) moved to the httpx 1.0 pre-release line and its
+    # client raises AttributeError on every request; 2.x is what the lock tests.
+    "openai>=1.0.0,<3",
 
     # Markdown / file system
     "PyYAML>=6.0",                # YAML frontmatter parsing