🛡️ Security

This release fixes one security issue in ConcurrencyLimitedModel. See the advisory for full details and affected versions.

• GHSA-6fqq-452j-qhrp (high): a streamed request through ConcurrencyLimitedModel or limit_model_concurrency could keep its concurrency slot when the slot was released on a different task than the one that acquired it: after an early exit (the consumer stopped iterating, raised, or was cancelled), and also after fully consuming stream_text() with its default debouncing. Repeated streams could then block every request sharing the limiter. Agent-level max_concurrency and non-streaming requests are not affected. Reported by @lche511. (#9478)

The fix also changes how limiters are shared: a model wrapper now raises UserError when it shares a limiter with the agent making the request or with an enclosing model wrapper, ConcurrencyLimiter.acquire() takes a slot on every call, even on the same task, and a custom AbstractConcurrencyLimiter must allow release() from another task.

Patched in 2.53.0. v1 is not affected.

What's Changed

⚠️ Compatibility Notes

• Add oneOf schema support to TestModel's generated data by @pydanty in #8783
• Make clai2 plugins declarative Plugin subclasses, modeled on AbstractCapability by @mpfaffenberger in #9493
• Move session naming into clai2 and deprecate pydantic_ai_harness.step_persistence.naming by @mpfaffenberger in #9499

🚀 Features

• Add a built-in posthog plugin to pydantic-clai2 with /keys or browser sign-in by @mpfaffenberger in #8901
• Add a built-in grain plugin to clai2 with a keyring-backed Grain sign-in by @mpfaffenberger in #8905
• Add a built-in linear plugin to clai2 with a settings menu and /keys credentials by @mpfaffenberger in #8949
• Count Google grounding web search queries in usage by @pydanty in #8891
• Add AbsurdDurability to the harness as a replacement for pydantic-ai-absurd by @adtyavrdhn in #8946
• Let CLAI2 plugins run models under their own prefix with host.model_provider by @mpfaffenberger in #9468
• Apply theme-aware accents to the clai2 status row by @mpfaffenberger in #9473
• Add opt-in Logfire UI telemetry and a Logfire setup menu (region, sign-in, project) to pydantic-clai2 by @mpfaffenberger in #9467
• Add an opt-in herdr plugin for clai2 by @mpfaffenberger in #9480
• Let AskUser defer questions to the host and time out a slow answerer by @mpfaffenberger in #9509
• Add a Codex-only /fast command to CLAI2 by @mpfaffenberger in #9518
• Let /login take a provider name, and let plugins add their own sign-ins by @mpfaffenberger in #9485
• Add SystemOneModel to run decision models such as CLM and Laya over the /v1/systemone API by @mpfaffenberger in #8942
• CLAI2: plugin logins add their models; plugin models can use a provider's /model_settings controls by @mpfaffenberger in #9558
• Rename the CLAI logfire plugin to observability by @mpfaffenberger in #9566
• Add ToolCallJudge to assess tool calls before execution by @DouweM in #9041
• Add managed subagents to CLAI2, with Claude and Codex agent definitions in Harness by @mpfaffenberger in #9573
• Add a settings menu to CLAI2's built-in observability (Logfire) plugin by @mpfaffenberger in #9306
• CLAI2: /update with stable (PyPI) and bleeding (main) channels by @mpfaffenberger in #9576
• Make the CLAI2 /plugins menu themed and readable, with plugin descriptions by @mpfaffenberger in #9570
• Send images and documents from GPT-Live tool results to the delegated backend by @DouweM in #9048
• Tag clai2 plugin settings with the features they need, and skip a plugin capability that rejects its settings at run setup by @mpfaffenberger in #9569
• Show compact used/max context in the CLAI2 status line by @mpfaffenberger in #9583
• Expose the message-history repair pipeline as repair_messages by @DouweM in #8370

🐛 Bug Fixes

• Kill the process group when a LocalWorkspaceBackend.run timeout fires during process startup by @dsfaccini in #9358
• Ask for CLAI2 keychain access once per session by encrypting credentials with one keyring-held key by @mpfaffenberger in #9465
• Name CLAI2 worktree branches clai-NAME and reopen existing worktrees with --worktree NAME by @mpfaffenberger in #9462
• Avoid invalid-escape warning floods during CodeMode analysis by @mpfaffenberger in #9475
• Group clai2 resume sessions by repository identity by @mpfaffenberger in #9482
• Create the CLAI2 plugins folder at startup by @mpfaffenberger in #9484
• Keep the registered Memory toolset across runs so durable execution accepts it by @mpfaffenberger in #9489
• Keep the registered Planning toolset across runs so durable execution accepts it by @mpfaffenberger in #9507
• Keep planted files from escaping BubblewrapSandbox on the next launch by @dsfaccini in #9457
• Render non-finite eval metrics as inf/-inf/nan by @pydanty in #8852
• Snap gemini-3.1-flash-image thinking efforts to minimal and high on the Gemini API by @dsfaccini in #9515
• Raise UnexpectedModelBehavior instead of running the wrong tool when function tool calls share a tool_call_id by @pydanty in #8782
• Explain that CLAI2 needs a restart when /reload hits a stale Harness import by @mpfaffenberger in #9571
• Build one streamed XaiModel thinking part per output, matching the non-streamed response by @DouweM in #9416
• Leave image generation calls out of the OpenAIResponsesModel replay when openai_store=False by @DouweM in #9388
• Build the same ModelResponse from streamed and complete OpenAIChatModel and OpenRouterModel responses by @DouweM in #9418
• Make OpenAIResponsesModel build the same ModelResponse from a stream as from a complete response by @DouweM in #9417
• Make xAI push-to-talk reply only when asked: commit_audio() alone no longer triggers a reply, and create_response() is always answered by @DouweM in #9070
• Tolerate OpenAI realtime status, status_details and session values the SDK does not know yet by @DouweM in #9392
• Stop SubAgents from forcing thinking on disk agents by @DouweM in #9384
• Restore DynamicWorkflow reveal announcements after compaction or history loss by @DouweM in #9371
• Preserve free-text focus in CLAI2 /compact by @mpfaffenberger in #9587
• Make Logfire Temporal spans replay-safe by @DouweM in #7006
• Keep the launch-directory workspace in clai2 when capability functions supply none, and expose unrestricted_filesystem in /plugins configure coder by @mpfaffenberger in #9593
• Allow unschemable types in the derived Temporal ActivityConfig schema by @pydanty in #9577
• Let GoogleRealtimeModel declare tools whose dict values are recursive models by @dsfaccini in #9607

📦 Dependencies

• Bump CLAI2 to termflow-md 0.11.0 by @mpfaffenberger in #9483

New Contributors

• @Poojita060926 made their first contribution in #8900

Full Changelog: v2.52.0...v2.53.0

🛡️ Security

This release fixes one security issue in web_fetch. See the advisory for full details and affected versions.

• GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @SounLabs. (#8984)

Patched in 2.52.0 (v2) and 1.107.7 (v1).

📦 Harness and CLAI 2

pydantic-ai-harness now lives in this repository and ships with every Pydantic AI release, so it jumps from 0.36.0 to 0.52.0. pydantic-clai2 0.52.0 is its first release: uvx pydantic-clai2.

What's Changed

⚠️ Compatibility Notes

• Run harness capabilities in any workspace: Coder, FileSystem, Shell and the rest work through ctx.workspace, locally or in a sandbox by @adtyavrdhn in #8866
• Replace ModalSandbox's own tools with a Modal workspace, so Coder, Shell and FileSystem run in the sandbox; ModalSandboxBackend replaces ModalSandboxSession by @adtyavrdhn in #8867
• Raise AnthropicModel's default max_tokens from 4096 to 16384 on Claude Sonnet 4.5 and later by @DouweM in #9025
• Keep the prompt as a DecisionModel's judged text after a retry by @dsfaccini in #8967
• Stop SubAgents loading agent files by default, and deprecate inherit_tools by @DouweM in #9023
• Default AnthropicModel's max_tokens to the model's maximum output, streaming such requests behind the scenes by @DouweM in #9298

🚀 Features

• Add workspaces: ctx.workspace gives tools one API for files and commands, on your machine or in a sandbox, with durable execution support by @adtyavrdhn in #6492
• Add SpritesSandbox: a workspace that runs Coder, Shell, FileSystem and every other harness capability in a Fly.io Sprite by @adtyavrdhn in #8869
• Add E2BSandbox: a workspace that runs Coder, Shell, FileSystem and every other harness capability in an E2B sandbox by @adtyavrdhn in #8868
• Give Coder file tools a retry budget of 5 and keep scratch files out of the project by @mpfaffenberger in #8970
• Add a typesafe extra to pydantic-clai2 and reject models with a missing provider SDK at /model time by @mpfaffenberger in #8962
• Add Claude Sonnet 5.5 (claude-sonnet-5-5) support by @dsfaccini in #8974
• Model realtime async tool calls as a profile async_tool_call_mode with a shared async_tool_calls setting by @DouweM in #8813
• Show tool-call arguments in pydantic-clai2 tool headers, clipped by display.tool_arg_chars by @mpfaffenberger in #9100
• Open a clai2 plugin's settings menu when it is turned on, and end every settings menu with Save & close by @mpfaffenberger in #9102
• Add _process_provider_details hook to OpenAIResponsesModel by @pydanty in #9094
• Add clai2 --agent MODULE:ATTR to chat with an existing Agent with plugins off by @mpfaffenberger in #9291
• Add a built-in github plugin to clai2 with a settings menu and its token in /keys by @mpfaffenberger in #8904
• Add a built-in pylon plugin to CLAI2 with a settings menu and a named /keys entry by @mpfaffenberger in #8953
• Seed retained user audio on Gemini gemini-3.1-flash-live-preview and gemini-3.8-live by @DouweM in #9047
• Support browser WebRTC on OpenAI GPT-Live with answer_webrtc_offer and a sideband session by @DouweM in #9059
• Add SSHWorkspace and BubblewrapSandbox harness capabilities by @mpfaffenberger in #8956
• Add a pydantic-clai2 console script so uvx pydantic-clai2 runs CLAI by @mpfaffenberger in #9304
• Add azure_voice_live_voice to choose an Azure voice for Azure AI Voice Live sessions by @DouweM in #9044
• Add google_workspace as a built-in clai2 plugin backed by harness GoogleWorkspace by @mpfaffenberger in #8907
• Apply thinking, openai_turn_detection, openai_input_noise_reduction and a new azure_voice_live_temperature on Azure AI Voice Live by @DouweM in #9051
• Seed tool calls and results as native function parts on Gemini gemini-3.8-live by @DouweM in #9058
• Emit identified response, turn, and input lifecycle events from the OpenAI-protocol realtime connection by @DouweM in #9064
• Add a built-in day_ai plugin to clai2 with a settings menu and /keys or browser sign-in by @mpfaffenberger in #8940
• Warn on unexpected RequestUsage.extract() failures by @adtyavrdhn in #8564
• Add a built-in ordinal plugin to clai2 with token or keyring-backed browser sign-in by @mpfaffenberger in #8941
• feat(profiles): default_cache_retention + prompt_cache_outlook() cold-window helper; rename resolve_prompt_cache_retention() to resolve_cache_retention() by @DouweM in #6337
• Add a built-in notion plugin to clai2 with a settings menu and its key in /keys by @mpfaffenberger in #8944
• Deliver images and text files returned from tools on Gemini 3.x Live by @DouweM in #9065
• Map the shared thinking and parallel_tool_calls settings to the GPT-Live backend model by @DouweM in #9040
• Accept mxfp4, nvfp4, and mxfp8 OpenRouter quantizations and the exacto sort value by @harimaruthachalam in #8888
• Add a built-in slack plugin to pydantic-clai2 with a settings menu, /keys user token, or browser sign-in by @mpfaffenberger in #8908
• Add a logfire_mcp built-in plugin to clai2 with /keys, LOGFIRE_API_KEY, and keyring-backed OAuth by @mpfaffenberger in #8903
• Add OpenAI gpt-6.1-sol model support and allow image output on gpt-6-astra by @dsfaccini in #9305

🐛 Bug Fixes

• Record realtime user turns in speaking order under push-to-talk, barge-in, and with input transcription off by @DouweM in #8764
• Stop tool docstring parsing from changing the root logger level by @adtyavrdhn in #8872
• Treat application/toml as text-like for inline model inputs by @JoeyTan21 in #8848
• Ask for one answer per batch of parallel realtime tool results, and stop wait_for_reply() hanging on merged or failed replies by @DouweM in #8765
• Move tool-forcing and thinking-default profile flags to ModelProfile so they apply on every provider route by @DouweM in #8808
• Stop Gemini Live tool rounds reporting RealtimeTurnCompleteEvent before the spoken answer by @DouweM in #8766
• Don't force output tools on Anthropic requests that think, so Claude keeps thinking with a structured output_type by @DouweM in #8812
• Truncate the provider's copy of a realtime reply the user cut off after it finished generating by @DouweM in #8757
• Leave room for the extended thinking budget in Anthropic's default max_tokens by @DouweM in #8986
• Settle Gemini tool calls and 2.5 typed turns a resumed realtime session lost, and stop OpenAI-protocol reconnects re-requesting a failed response.create by @DouweM in #8763
• Keep a realtime microphone task alive across a reconnect by dropping audio sent while the link is re-dialed by @DouweM in #8806
• Raise UserError instead of ModelRetry for Macroscope setup failures by @DouweM in #8999
• Give the first stage of a Playwright operation its full configured budget by @DouweM in #9029
• Make workspace concurrency deadlines robust under load by @DouweM in #9043
• Report OpenAI native web searches in RequestUsage.details and price them in cost by @dltsum in #8310
• Stop blank lines and "settings unchanged" notices after closing clai2 menus by @mpfaffenberger in #9101
• Terminate !command shell descendants on cancellation in clai2 by @dafyy321-pixel in #9092
• Quiet missing plugin modules and UserWarnings in clai2, and group CodeMode missing-return-schema warnings by @mpfaffenberger in #9099
• Handle Ctrl-C during clai2 shell process startup by @DouweM in #9104
• Apply model concurrency limits to compact_messages() by @yang0228 in #8241
• Keep Up/Down on prompt history when clai2 recalls a slash command by @mpfaffenberger in #9297
• Allow azure_voice_live=True for gpt-realtime-2 models on AzureRealtimeModel by @DouweM in #9050
• Bound the Gemini Live handshake with handshake_timeout by @DouweM in #9042
• Allow text output on Vertex gemini-live-2.5-flash and remove a stale Gemini Live docs claim by @DouweM in #9069
• Emit DeferredToolRequestsEvent in realtime sessions before the HandleDeferredToolCalls handler runs by @DouweM in #9057
• Map OpenAI response JSON decode errors to ModelAPIError by @pydanty in #8846
• Map in-stream error objects to ModelAPIError in OpenAIChatModel, GroqModel and HuggingFaceModel by @DouweM in #9313
• Raise ModelAPIError instead of ValidationError when an OpenRouterModel stream drops mid-response by @DouweM in #9312
• Read the capabilities docs topic from capabilities/overview.md in PydanticAIDocs by @DouweM in #9011
• Apply FileSystem default read_only_patterns to nested .env and .git/ paths by @DouweM in #9021
• Restore CodeMode discovery announcements after compaction or history loss by @DouweM in #9045
• Keep the original request in the TrajectoryJudge window when the transcript is clamped by @DouweM in #9012
• Raise ContentFilterError for a thinking-only response refused by the content filter, instead of retrying by @DouweM in #9355
• Sandbox file methods and block sockets without network in BubblewrapSandbox by @mpfaffenberger in #9349
• Give the current time to the hour in LogfireMCP instructions so they stop busting the prompt cache by @mpfaffenberger in #9319
• Raise ModelAPIError when the OpenAI Responses API reports a failed response or an error stream event by @DouweM in #9321
• Map every MistralError from the Mistral SDK to ModelHTTPError or ModelAPIError by @DouweM in #9307
• Map provider errors from GoogleModel.count_tokens and XaiModel file uploads by @DouweM in #9308
• Fix capability audit findings in ClampOversizedMessages, SubAgents, and StepPersistence by @DouweM in #9026
• Root union output member data validation errors under result.data so retry feedback keeps the failing input by @pydanty in #8669
• Read a shell job log deleted mid-read as empty instead of failing the call by @dsfaccini in #9322
• Record Gemini Live turn_complete_reason as the realtime response's finish_reason by @DouweM in #9390
• Remove the default ACP request_limit by @DouweM in #9380
• Report a realtime session's own usage on its span, not a carried total by @DouweM in #9389
• Count separately budgeted SubAgent usage toward parent budgets by @DouweM in #9374

📦 Dependencies

• Bump the python-packages group across 1 directory with 14 updates by @dependabot[bot] in #9076

New Contributors

• @JoeyTan21 made their first contribution in #8848
• @dltsum made their first contribution in #8310
• @Jinzhengxu made their first contribution in #8567
• @dafyy321-pixel made their first contribution in #9092
• @yang0228 made their first contribution in #8241
• @harimaruthachalam made their first contribution in #8888

Full Changelog: v2.51.0...v2.52.0

What's Changed

⚠️ Compatibility Notes

• Match dated gemini-3.8-live ids, reject google_affective_dialog on Gemini 3.1 Flash Live and 3.8 Live at connect, and raise RealtimeError for Gemini Live close codes by @DouweM in #8761
• Raise a UserError for a realtime tool_choice that forces a tool call on OpenAI, Azure OpenAI, and xAI by @DouweM in #8755

🚀 Features

• Add OpenAI GPT-Live support with OpenAILiveModel by @DouweM in #8390
• Expose context_window_used on realtime sessions, from GPT-Live's reported ratio or response usage by @DouweM in #8803

🐛 Bug Fixes

• Reduce RunContext copying overhead in capability hooks by @Kludex in #8775
• Keep provider_details on OpenAI Realtime tool-call responses and the response id on replies cut off by a drop or close() by @DouweM in #8762
• Buffer text deltas in CompletedStreamedResponse replay by @Kludex in #8799
• Resend a recent image with a typed Gemini Live turn, which doesn't see video frames by @DouweM in #8756
• Cache the agent graph instead of rebuilding it on every Agent.run() by @Kludex in #8658
• Stop spawning a task group when a toolset or capability fan-out has a single child by @Kludex in #8774

Full Changelog: v2.50.0...v2.51.0

What's Changed

⚠️ Compatibility Notes

• Ask a DecisionModel which route to take by name, with one label per route by @DouweM in #8733
• Make ModelSelectionContext.messages end with the request being routed, and add ModelSelectionContext.prompt by @DouweM in #8737
• Replace the decision model's tool-call lean with an opt-in decision_route_threshold by @DouweM in #8739

🚀 Features

• Expose OpenAI service_tier in provider details by @pydanty in #7945
• Add DecisionModel, a base for Decisions-protocol models, and make TypeSafeModel one by @DouweM in #8696
• Add RunContext.in_durable_context so hooks can tell they run in durable workflow code by @mpfaffenberger in #8723
• Add gemini-3.8-live and gemini-3.8-live-extended-thinking realtime support by @DouweM in #8393
• Ask a DecisionModel's route fields with the route question under a route premise, with nested-field context and a done state after tool calls by @DouweM in #8749
• Emit a decide span for every request a DecisionModel sends by @DouweM in #8698

🐛 Bug Fixes

• Keep the type variable of a generic OutputSpec[T] passed to Agent.run under mypy by @DouweM in #8730
• Send ThinkingParts in the history decision models judge by @DouweM in #8738
• Price Anthropic one-hour cache writes at the one-hour rate instead of the five-minute rate by @kazmer97 in #8666
• Price realtime image input at the image rate by @DouweM in #8741
• Add RequestUsage.audio_seconds so duration-billed voice models are priced by @DouweM in #8427
• Offer a decision model's unfillable output_type as a route beside other routes, and rename ToolCallProposed to UnfillableRoute under a DecisionHandOff base by @DouweM in #8744
• Keep realtime user turns whole when the microphone streams continuously on providers without input item IDs by @DouweM in #8746
• Roll back a realtime send the provider refuses, so wait_for_reply() no longer hangs on it by @DouweM in #8747
• Turn reasoning off for thinking=False on OpenAI Realtime by sending reasoning.effort: 'none' by @DouweM in #8753
• Take Jev's context_window from genai-prices and document compacting a Jev conversation by @DouweM in #8740
• Buffer five minutes of audio per stream_audio() view so speaker-paced playback gets whole replies by @DouweM in #8750
• Stop Google Search from crashing Gemini 2.5 native-audio realtime sessions by @DouweM in #8751
• Keep user speech out of Gemini 3.x realtime history when input transcription is off by @DouweM in #8754
• Surface a failed OpenAI realtime response's error as a RealtimeSessionErrorEvent by @DouweM in #8752

Full Changelog: v2.49.0...v2.50.0

What's Changed

🚀 Features

• Add GitHubCopilotOAuthFlow for device authorization by @Kludex in #8618
• Add BoolCriteria to say what a bool field's yes and no mean, and let a True/False Enum do the same by @DouweM in #8586
• Use what the user wrote about None as the "none of these" option in TypeSafeModel by @DouweM in #8684
• Offer whole numbers that are not a rubric as a Choice in TypeSafeModel by @DouweM in #8686
• Add RealtimeSession.wait_for_reply() by @DouweM in #8514

🐛 Bug Fixes

• Keep all streamed OpenAIChatModel logprobs in provider_details['logprobs'] by @adtyavrdhn in #8653
• Allow gpt-6-sol, gpt-6-luna, and gpt-6-astra on Bedrock Converse by @sevakva in #8656
• fix: preserve fanned producer contributions in graph joins by @FIITAY in #8385
• Surface @GraphBuilder.stream node errors in-context during graph.iter() by @pydanty in #8304
• Forward Cloud Storage gs:// references as fileData in GoogleImageGenerationModel on Vertex AI by @dorukgezici in #8225
• Preserve output tool names and descriptions for Annotated model types by @ikriv in #8608
• Type None in a list of output types as | None so output_type=[Foo, Bar, None] passes pyright by @DouweM in #8641
• Fix google_proactive_audio, which no Gemini Live session could ever connect with by @DouweM in #8394
• Drop temperature and top_p for OpenAI GPT-5.6 and GPT-6 on Bedrock Converse instead of failing with a 400 by @kimnamu in #8668
• Let a field's default apply when TypeSafeModel answers "None of these" for an optional field by @DouweM in #8685
• Surface realtime receive-side failures to every consumer shape, and end send_audio(iterable) cleanly on close by @DouweM in #8138
• Keep Annotated metadata on the members of an X | Y output_type by @DouweM in #8687
• Keep an uninstrumented delegate's usage off its caller's agent run span by @DouweM in #8689
• Let a nested model's default apply when TypeSafeModel answers "None of these" for every field under it by @DouweM in #8697
• Accept Annotated, Literal and union output_types as PEP 747 TypeForms, and bump pyright to 1.1.414 by @DouweM in #8690
• Make RunContext.tracer, trace_include_content and instrumentation_version follow an explicit Instrumentation capability by @DouweM in #8706
• Send deferred tools with native tool search on OpenAICodexModel instead of failing with a 400 by @aweis89 in #8693

New Contributors

• @FIITAY made their first contribution in #8385
• @ikriv made their first contribution in #8608
• @aweis89 made their first contribution in #8693

Full Changelog: v2.48.0...v2.49.0

What's Changed

🚀 Features

• Support genai-prices 0.1.7 and new OpenAI audio models by @adtyavrdhn in #8617
• Add OpenAI gpt-6-sol and gpt-6-luna model support by @DouweM in #8635
• Add Claude Opus 5.5 (claude-opus-5-5) support by @DouweM in #8637

🐛 Bug Fixes

• Preserve UIMessage.id across Vercel AI load_messages and dump_messages by @adtyavrdhn in #8623
• Preserve AG-UI Message.id across AGUIAdapter.load_messages and dump_messages by @adtyavrdhn in #8632

📦 Dependencies

• Bump genai-prices to 0.1.8 by @DouweM in #8648

Full Changelog: v2.47.0...v2.48.0

What's Changed

⚠️ Compatibility Notes

• Name a None output route None rather than NoneType by @DouweM in #8590
• Raise when UserPromptPart.content is not a str or a sequence, instead of silently sending a dict's keys by @DouweM in #8595

🚀 Features

• Ask three more field types TypeSafeModel can already answer by @DouweM in #8544

🐛 Bug Fixes

• Refuse a tuple output field and a self-contained model instead of crashing by @DouweM in #8537
• Refuse a rubric with more levels than Jev scores against by @DouweM in #8583
• Let None be a route TypeSafeModel can pick by @DouweM in #8540
• Let a Choices set describe itself as a TypeSafeModel route by @DouweM in #8541
• Recognise a None route and a None option that carry a description by @DouweM in #8598
• Name the picked route in the TypeSafeModel request that fills it by @DouweM in #8589

📦 Dependencies

• Pin ag-ui-protocol to <1 by @adtyavrdhn in #8579

New Contributors

• @huynguyengl99 made their first contribution in #8554
• @xyi74976-del made their first contribution in #8560

Full Changelog: v2.46.0...v2.47.0

What's Changed

🚀 Features

• Let TypeSafeModel fill a tool's arguments when Jev can express them by @DouweM in #8501
• Add RealtimeSession.wait_for_playback() and let the docs examples finish the reply before closing by @DouweM in #8141
• Add supports_text_output to ModelProfile, and run LLMJudge and GEval on a model without it by @DouweM in #8480
• Add typesafe_boolean_threshold for what a yes/no has to be before it is True by @DouweM in #8505
• Let TypeSafeModel fill a union of output types by choosing the type first by @DouweM in #8481
• Add event_stream_topic to TemporalDurability to stream agent events via Workflow Streams by @brianstrauch in #6639
• Describe an Enum's options by its member docstrings when it mixes in UseEnumMemberDocstrings by @DouweM in #8479
• Add a Choices helper for a set of described options built at run time by @DouweM in #8530

🐛 Bug Fixes

• Refuse more options than Jev can pick from in TypeSafeModel by @DouweM in #8484
• Record a failed ToolReturnPart when a realtime tool raises, and keep a tool call and its speech in one ModelResponse by @DouweM in #8135
• Dispatch tool calls with the live ToolDefinition in CombinedToolset and FunctionToolset by @adtyavrdhn in #8082
• Allow adaptive thinking with tool output and forced tool choice on Bedrock by @pydanty in #7967
• Fix gateway IDs being misclassified as OpenAI o-series models by @DouweM in #8512
• Keep late realtime input transcripts attached to the user turn they belong to by @DouweM in #8139
• Lay the first-run banner out for the terminal's actual width by @DouweM in #8517
• Raise ModelRetry when web_fetch_tool gets a URL httpx2 rejects as invalid by @DouweM in #8521
• Price realtime responses so usage.cost and UsageLimits.cost_limit work in a session by @DouweM in #8136
• Re-arm coverage for code already seen when the dataclass walk resumes it by @DouweM in #8438

New Contributors

• @brianstrauch made their first contribution in #6639

Full Changelog: v2.45.0...v2.46.0

What's Changed

🚀 Features

• Add TypeSafeModel for TypeSafe's Jev by @adtyavrdhn in #8450

🐛 Bug Fixes

• Pass xhigh effort through on Bedrock when the model profile supports it by @willfrey in #8392
• Allow gpt-5.6-sol, gpt-5.6-luna, and gpt-5.6-terra on Bedrock Converse by @pydanty in #7825
• Resolve a DynamicToolset once per durable run instead of inside every durable unit by @DouweM in #8455
• Hold one MCP server session per durable run instead of one per durable unit by @DouweM in #8463
• Preserve tool history in MCPSamplingModel by @DouweM in #8466
• Stop importing legacy httpx in pydantic_ai.mcp, which a FastMCP 4 install does not ship by @DouweM in #8461
• Report each agent run's own usage on its span by @DouweM in #8456

New Contributors

• @willfrey made their first contribution in #8392

Full Changelog: v2.44.0...v2.45.0

🛡️ Security

This release fixes four security issues, all of them reached through web_fetch_tool or OpenTelemetry instrumentation. See each advisory for full details and affected versions.

• GHSA-vmxc-h2x2-jmf3 (moderate): the cloud-metadata and private-IP blocklists could be bypassed with an IPv6 zone identifier on a URL opted into local network access, via FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True). Both are off by default. Reported by @euriconicacio. (#8401)
• GHSA-fpf4-vwcp-v4hp (moderate): web_fetch processed responses in superlinear time on the event loop, in both the HTML conversion and the charset decode, so a single attacker-chosen page could stall every agent in the process. Reported by @BrianWillows. (#8397, #8418, #8433)
• GHSA-22h6-qm39-v87j (low): web_fetch_tool's domain lists were compared as written rather than in the form the resolver uses, so a blocked domain could be reached under another spelling. (#8407, #8421)
• GHSA-4x9p-g9wm-8q7f (low): with InstrumentationSettings(include_content=False), spans still carried exceptions, error statuses, instructions and the output template. Reported by @BrianWillows. (#8403, #8408, #8419, #8428)

Patched in 2.44.0 (v2) and 1.107.6 (v1).

What's Changed

⚠️ Compatibility Notes

• Make RunContext.enqueue() safe from worker threads by @adtyavrdhn in #7758
• Require a JSON Content-Type on UI adapter requests by @DouweM in #8396
• Dispatch a capability @durable_operation called from a per-request hook, instead of silently running it inline by @DouweM in #8395

🚀 Features

• Add a Vercel AI SDK and Eve migration skill by @adtyavrdhn in #8357
• Give AgentRunResult a stable serialized shape, and settle a finished stream into one by @DouweM in #8269
• Add a Storage page so persistence is findable by @DouweM in #8336
• Emit EnqueuedMessagesEvent when a realtime session delivers enqueued content by @DouweM in #8134

🐛 Bug Fixes

• Forward blocked_domains to OpenAI web search by @adtyavrdhn in #8323
• Fix OpenAI hosted tool_search pairing in AG-UI by @adtyavrdhn in #8313
• Let Agent.from_spec() construct without a model, deferring the requirement to run time by @DouweM in #8339
• Let RealtimeSession.close() finish its teardown when the closing task is cancelled by @DouweM in #8142
• Run a capability's prepare_tools over every tool the availability gate admits by @DouweM in #8071
• Bound the realtime session event queue while nothing is iterating it by @DouweM in #8133
• Report a run's own usage on its span, not the conversation total by @DouweM in #8417

New Contributors

• @mrchatam made their first contribution in #8286
• @vedjaw made their first contribution in #7028

Full Changelog: v2.43.0...v2.44.0

What's Changed

🚀 Features

• Add a first-run banner describing the run, and open clai sessions with it by @DouweM in #7447

🐛 Bug Fixes

• Preserve text part boundaries after tool calls in OpenAIChatModel by @KaranJayakumar in #8235
• fix(temporal): key tool opt-out checks on operation kind, not an MCP import by @adtyavrdhn in #8257

New Contributors

• @KaranJayakumar made their first contribution in #8235

Full Changelog: v2.42.0...v2.43.0

What's Changed

⚠️ Compatibility Notes

• Reject invalid DeferredToolResults.approvals values by @adtyavrdhn in #8081

🚀 Features

• Add a GitHubCopilotProvider for GitHub Copilot's OpenAI-compatible API by @dsfaccini in #8059

🐛 Bug Fixes

• Honor anthropic_disallows_sampling_settings in BedrockConverseModel by @rscholz98 in #7961
• Resolve non-object $ref definitions inline in code-mode function signatures by @pydanty in #8056
• Validate ToolReturnContent without a Python call per JSON node by @dsfaccini in #7823
• Preserve Anthropic recovery across normalized history by @dsfaccini in #8040

New Contributors

• @StarsExpress made their first contribution in #8155

Full Changelog: v2.41.0...v2.42.0

What's Changed

🚀 Features

• Deprecate fallback_model in favor of fallback_subagent_model on ImageGeneration and XSearch by @dsfaccini in #8077
• Add openai-codex provider for ChatGPT/Codex subscription authentication by @mpfaffenberger in #7769
• Add a direct image generation API with ImageGenerator by @EgonFerri in #5357

🐛 Bug Fixes

• Report Anthropic native web searches in RequestUsage.details and price them in cost by @adtyavrdhn in #8169
• Wrap botocore transport errors in ModelAPIError in BedrockConverseModel by @kimnamu in #8131
• Snap Gemini thinking levels to the nearest supported level by @dsfaccini in #8165

New Contributors

• @kimnamu made their first contribution in #8131
• @EgonFerri made their first contribution in #5357

Full Changelog: v2.40.0...v2.41.0

What's Changed

🚀 Features

• Add pydantic_ai.prices.update_in_background() by @adtyavrdhn in #4841
• Handle barge-in in the session: handle_barge_in=True, interrupt(played_bytes=...), and played_audio_bytes by @DouweM in #7870
• Add provider_factory to infer_realtime_model by @DouweM in #8106
• Add @agent.on_event for registering event listeners on an Agent by @DouweM in #8101
• Add respond= to RealtimeSession.send() and document that a text turn solicits a reply by @DouweM in #8110
• Add RealtimeSession.enqueue() for out-of-band prompts from code driving the session by @DouweM in #8109

🐛 Bug Fixes

• Map finish_reason on OpenAI Responses stream terminal events by @pydanty in #7916
• Fix defer_loading reveal synthesis splitting a parallel batch's tool_result from its tool_use by @pydanty in #7879
• fix(realtime): roll back user-turn state when an audio chunk is not bytes-like by @simpleqt in #7905
• Let a capability cache derived state again, and refuse a collection the merge cannot rebuild by @DouweM in #8099
• Make a capability's auto-assigned registry key look like the run-local handle it is by @DouweM in #8119
• Stop sending reasoning to the dated gpt-realtime-2025-08-28 snapshot by @DouweM in #8103
• Subscribe stream_audio() and stream_transcripts() views when they are called, not on first iteration by @DouweM in #8107
• End the realtime audio and transcript views when a tool fails and nobody is iterating by @DouweM in #8108
• Let a realtime tool hang up with ctx.realtime_session.close() instead of wedging itself by @DouweM in #8105
• Fix the realtime "Speaking first" and relay examples, the interrupt(played_ms=) cancel race, and two provider tables by @DouweM in #8132

New Contributors

• @simpleqt made their first contribution in #7905

Full Changelog: v2.39.0...v2.40.0

What's Changed

🚀 Features

• Add OpenAI gpt-6-astra model support by @dsfaccini in #8055

🐛 Bug Fixes

• Fix the context_subtree() exporter cache and its span-processor leaks by @dsfaccini in #7667
• Restore the Instrumentation spec option include_model_request_parameters and sharpen the undeclared-attribute merge error by @DouweM in #8046
• Detect Azure content-filter errors for AzureProvider and for AsyncAzureOpenAI clients on OpenAIProvider by @quinnarnold in #7922
• Emit speech finalized by a tool call on stream_transcripts() by @DouweM in #8062
• Attribute tool-returned media to its originating tool call when it can't ride the tool result by @dsfaccini in #7830
• Restore capability composition invariants by @dsfaccini in #8047

Full Changelog: v2.38.0...v2.39.0

What's Changed

⚠️ Compatibility Notes

• Give one-off capabilities a default id and a combine rule for repeats by @dsfaccini in #7248

🚀 Features

• Add context_window to ModelProfile and context_window_used to RunContext by @adtyavrdhn in #4611
• Add profile flag to reject streams without finish_reason by @jonashaag in #7096
• Add gemini-3.8-flash model by @dsfaccini in #8021
• Let application code and capabilities emit typed CustomEvents and CapabilityEvents into the run event stream and subscribe with @on_event by @DouweM in #6258
• Add Claude Fable 5.1 (claude-fable-5-1) and Claude Mythos 5.1 (claude-mythos-5-1) support by @dsfaccini in #7989
• Add VLLMProvider for vLLM servers by @adtyavrdhn in #6153

🐛 Bug Fixes

• Support CancellationToken in UI adapter run methods by @dsfaccini in #7743
• Stop pytest tests/durable_exec/temporal from crashing when the suite's requirements are missing by @dsfaccini in #7898
• Fix DeepSeek and Together forced tool_choice handling and support NativeOutput on DeepSeek's Responses API by @dsfaccini in #7450
• Restore raw tool-call IDs when replaying Bedrock Mantle Responses history by @dsfaccini in #7962
• Keep a run cancelled during its first tool call resumable by @DouweM in #7993
• Fix CodeExecutionTool uploads never reaching a fresh Anthropic container on a multi-turn history by @dsfaccini in #7864
• Prevent synthetic reasoning IDs from reaching OpenAI Responses by @dsfaccini in #8020
• Emit REASONING_* events from ag-ui-protocol 0.1.11 instead of 0.1.13 by @dsfaccini in #7226
• Accept the environment-key call pattern in GoogleProvider's overload by @dsfaccini in #8030
• Fix XaiModel streamed text after a native tool call being merged into the ended pre-call part by @pydanty[bot] in #7925
• Persist Anthropic stale thinking-block recovery across turns by @dsfaccini in #8037
• Preserve dynamic native factory config in XSearch and ImageGeneration fallback subagents by @CoralGarden52 in #7541

📦 Dependencies

• Bump genai-prices to 0.1.6 by @adtyavrdhn in #8019

New Contributors

• @piomeer made their first contribution in #7952
• @jonashaag made their first contribution in #7096
• @CoralGarden52 made their first contribution in #7541

Full Changelog: v2.37.0...v2.38.0

What's Changed

🚀 Features

• Add glm-5.3-flash and rework the Z.AI test suite onto cassettes by @dsfaccini in #7887

🐛 Bug Fixes

• fix: preserve all conditions in pruned span queries by @mikemikimike in #7499
• Accept and map Z.AI's non-standard finish_reason values by @zhj12395 in #7685
• Emit an AG-UI TEXT_MESSAGE_START for the assistant message that owns a response's tool calls by @dsfaccini in #7699
• Route Vertex-vs-Gemini API branches in GoogleModel by client transport instead of provider name by @thejamesgore in #7280
• Skip inactive capability hooks in agent tracebacks by @dsfaccini in #7328
• Context-manage models rebuilt inside durable operations by @dsfaccini in #7954
• Reject per-run capabilities= on DBOS, matching Temporal by @DouweM in #6955
• Journal Prefect tool discovery in tasks by @DouweM in #6966
• Stop rebuilding unmanaged models in durable capability operations by @DouweM in #7972

New Contributors

• @zhj12395 made their first contribution in #7685
• @thejamesgore made their first contribution in #7280
• @pcbeingused333 made their first contribution in #7936
• @quinnarnold made their first contribution in #7921

Full Changelog: v2.36.0...v2.37.0

What's Changed

⚠️ Compatibility Notes

• Add --mcp-config support and tool-call streaming to clai by @Kludex in #1374

🚀 Features

• Add @durable_operation for capabilities and a public backend API for third-party durable execution engines by @DouweM in #6696
• Give instruction parts a stable InstructionPart.id by @DouweM in #6887
• Accept async iterables in RealtimeSession.send_audio() and move the voice example to listentome by @DouweM in #7860
• Require an explicit operation name on @durable_operation by @DouweM in #7868

🐛 Bug Fixes

• Fix TestModel generation for narrow exclusive numeric bounds by @Terminator666666 in #7800
• Project a bare ToolDefinition into Prefect cache keys by @DouweM in #7872

New Contributors

• @Terminator666666 made their first contribution in #7800
• @mme made their first contribution in #7432

Full Changelog: v2.35.3...v2.36.0

What's Changed

🐛 Bug Fixes

• Route Heroku GLM models through zai_model_profile by @LHMQ878 in #6837
• Scope safe_download cookies to original hostnames by @Diwak4r in #7077
• Fix DeferredToolRequests.remaining resolving cross-category result IDs by @pydanty in #7626
• Identify rejected runtime toolsets in durable execution errors by @pydanty in #6784
• Un-cap the dbos extra; add opentelemetry-instrumentation-logging as a test dependency instead by @dsfaccini in #7820

Full Changelog: v2.35.1...v2.35.3

What's Changed

🐛 Bug Fixes

• Carry Bedrock guardrail trace in ModelResponse.provider_details by @pydanty in #7562
• Honor provider_factory when cancelling Temporal responses by @DouweM in #7000
• Cap dbos below 2.31.0 to avoid a missing opentelemetry-instrumentation-logging import by @dsfaccini in #7804

Full Changelog: v2.35.0...v2.35.1

What's Changed

⚠️ Compatibility Notes

• Deprecate RunContext.capability_loaded and available_capability_ids in favor of capability_active and active_capability_ids by @DouweM in #7454
• Make inclusive integer maximum reachable in TestModel by @pydanty in #7697

🚀 Features

• Reduce the default Temporal metric export frequency by @dmontagu in #7768

🐛 Bug Fixes

• Preserve explicit empty Tool description instead of falling back to the function docstring by @mpfaffenberger in #7759

Full Changelog: v2.34.0...v2.35.0

What's Changed

🚀 Features

• Add a LangChain migration skill by @adtyavrdhn in #7679
• Add GLM-5.3 support to ZaiModel by @aisk in #7600

🐛 Bug Fixes

• Fix TestModel generation for equal inclusive bounds by @pydanty in #7642
• Render enum $refs as Literal in FunctionSignature by @pydanty in #7579
• Fix TestModel generation of falsy JSON Schema const values by @pydanty in #7630
• Fix stale UIEventStream part state on cancellation by @adtyavrdhn in #7675
• Only strip logit_bias from Cerebras model settings by @ryanl-cerebras in #7653
• Fix VercelAIAdapter rejecting reasoning part id in run input by @pydanty in #7706
• Fix dropped zero-argument tool calls in CohereModel by @pydanty in #7720
• Fix VercelProvider dropping the Groq profile for groq/-prefixed models by @pydanty in #7551
• fix(evals): honor zero-valued SpanQuery maximums by @lntutor in #6934
• Handle asctime-form Retry-After dates in wait_retry_after() by @parveshsaini in #7711
• Honor agent tool retry budget for load_capability by @lntutor in #6937
• Recognize Bedrock’s r1 alias in deepseek_model_profile() by @adtyavrdhn in #7723

New Contributors

• @brianosaurus made their first contribution in #7522
• @junqi410-create made their first contribution in #7669
• @aisk made their first contribution in #7600
• @ryanl-cerebras made their first contribution in #7653
• @parveshsaini made their first contribution in #7711

Full Changelog: v2.33.0...v2.34.0

⚠️ If Anthropic stopped working for you in the last day

anthropic 1.0.0 — rebuilt on httpx2, with legacy httpx support removed — reached PyPI on August 20. Every earlier pydantic-ai release, including v2.32.2 cut a few hours before this one, allowed that version without supporting it: a fresh or unpinned install of pydantic-ai[anthropic] could resolve anthropic 1.0.0 and then fail at runtime when using an Anthropic model. Apologies for the breakage window.

• Fix: upgrade to pydantic-ai v2.33.0, which requires and supports anthropic>=1.0.0.
• If you need to stay on an older pydantic-ai: pin anthropic<1.

If you pass your own http_client to AnthropicProvider, it must now be an httpx2.AsyncClient — the 1.x SDK rejects legacy httpx clients at construction.

What's Changed

⚠️ Compatibility Notes

• Use httpx2 for Anthropic clients by @dsfaccini in #7657

Full Changelog: v2.32.2...v2.33.0

What's Changed

🐛 Bug Fixes

• Await async callable instances in pydantic_evals tasks and the evaluate decorator by @pydanty[bot] in #7535
• Fix RunContext.cancel() in realtime sessions by @adtyavrdhn in #7528
• Recognize m.youtube.com URLs in VideoUrl by @uczltw6 in #7592
• Normalize DeepSeek Responses function-call replay by @dsfaccini in #7448
• Fail the workflow on UnexpectedModelBehavior and FallbackExceptionGroup under the deprecated TemporalAgent by @aviseth in #7465

New Contributors

• @uczltw6 made their first contribution in #7592
• @aviseth made their first contribution in #7465

Full Changelog: v2.32.1...v2.32.2

What's Changed

🐛 Bug Fixes

• Reject Agent.run_sync() from synchronous callbacks inside agent runs by @dsfaccini in #7277
• Don't send Anthropic thinking blocks with an empty signature by @mpfaffenberger in #7601
• Accept any callable as a FunctionModel function or stream_function by @dsfaccini in #7589

Full Changelog: v2.32.0...v2.32.1

What's Changed

🚀 Features

• Suggest known model names for invalid identifiers by @dsfaccini in #7325
• Support xAI attachment search lifecycle by @colesmcintosh in #7156
• Surface OpenRouter web-search sources in provider_details["annotations"] by @dsfaccini in #7458
• Add instrumentation version 6, emitting tool results under role: 'tool' by @dsfaccini in #7582

🐛 Bug Fixes

• Run sync hooks in a thread pool and enforce timeout= for blocking sync tools and hooks by @adtyavrdhn in #7557
• Record RunContext.cancel() from setup-phase for_run hooks instead of raising UserError by @adtyavrdhn in #7567
• Treat a response containing only empty text parts as having no text output by @adtyavrdhn in #7568
• Only list available tools in the unknown-tool retry message by @adtyavrdhn in #7572
• Sort tool results ahead of tool availability announcements so Bedrock accepts turns revealing multiple tools by @adtyavrdhn in #7571
• Drop native tool calls the replayed payload has no result block for by @dsfaccini in #7504

📦 Dependencies

• Use httpx2 for compatible HTTP clients by @dsfaccini in #7351

Full Changelog: v2.31.1...v2.32.0

What's Changed

🐛 Bug Fixes

• Deny native structured output for Claude Sonnet 5 and Fable 5 on Bedrock by @pydanty[bot] in #7374
• Fall back to thinking_level='LOW' for Gemini models that reject MINIMAL by @pydanty[bot] in #7469

Full Changelog: v2.31.0...v2.31.1

What's Changed

🚀 Features

• Allow a UIEventStream to be built without a run_input, and give AGUIEventStream its own thread_id/run_id by @dsfaccini in #7292

🐛 Bug Fixes

• Attribute failed FallbackModel spans to the failing model, not the fallback: wrapper by @strawgate in #7018
• Pass openai through Temporal workflow sandboxes by @adtyavrdhn in #7464

New Contributors

• @echoVic made their first contribution in #4636

Full Changelog: v2.30.0...v2.31.0

What's Changed

🛡️ Security

• GHSA-q2xc-rrxj-58x9: the local dev web chat UI (Agent.to_web(), clai web) didn't validate the Host header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in pydantic-ai/pydantic-ai-slim 2.30.0 by validating Host against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new allowed_hosts setting.

🚀 Features

• Use openrouter:web_search for web search by @dsfaccini in #7378
• Add gemini-3.7-flash model by @dsfaccini in #7445
• Expose gRPC metadata on XaiProvider by @pydanty[bot] in #7423
• Add allowed_hosts to Agent.to_web() and clai web by @DouweM in #7437

🐛 Bug Fixes

• Resolve deferred openai resource imports and genai-prices data loading at Model construction time by @adtyavrdhn in #7408
• Fall back to ASCII in EvaluationReport.print() on non-UTF-8 consoles by @dsfaccini in #7290
• Lowercase model name before profile lookup in SambaNova, Heroku, and Fireworks providers by @pydanty[bot] in #6818
• Update LatestCerebrasModelNames to current model catalog by @pydanty[bot] in #6838
• Require a deferred tool to be revealed, and its capability loaded, before it can be called by @DouweM in #7271
• Anchor the tool-callability evidence window to the response's serving provider by @DouweM in #7442

Full Changelog: v2.29.0...v2.30.0

What's Changed

🚀 Features

• Support FastMCP 4 and MCP SDK v2 in MCPToolset alongside FastMCP 3 by @adtyavrdhn in #6738
• Add Azure AI Voice Live via the azure_voice_live setting by @DouweM in #6642

🐛 Bug Fixes

• Fix silent truncation of gzip response bodies by @ChaoGlenXu in #7388
• Include parameter descriptions in rendered tool signatures by @adtyavrdhn in #6487
• Fix inherited realtime WebRTC and Azure for_realtime bugs from #6676 by @DouweM in #7412
• Fix concurrent provider stream shutdown by @dsfaccini in #7375

New Contributors

• @ChaoGlenXu made their first contribution in #7388

Full Changelog: v2.28.0...v2.29.0

🛡️ Security

Fixes a high-severity vulnerability in the development web chat UI (Agent.to_web(), clai web): the chat endpoint didn't check the request's content type, so a plain cross-origin request from a website open in the developer's browser could reach the endpoint without a CORS preflight and trigger the served agent to run and execute its tools with the local process's privileges and credentials. The endpoint now requires Content-Type: application/json and rejects other requests before the body is parsed and before the agent runs. See GHSA-h4xc-3qfq-jf93. Patched in 2.28.0 (v2) and 1.107.4 (v1).

What's Changed

🚀 Features

• Add realtime speech-to-speech support with Agent.realtime() by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6324
• Add Crusoe provider by @acheamponge in https://github.com/pydantic/pydantic-ai/pull/6457
• Add browser WebRTC + server sideband support for realtime speech-to-speech by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6676

🐛 Bug Fixes

• fix(bedrock): attach a leading CachePoint to the preceding user message instead of raising by @Diwak4r in https://github.com/pydantic/pydantic-ai/pull/7071
• Test cancellation of concurrent PeekableAsyncStream pulls by @mikemikimike in https://github.com/pydantic/pydantic-ai/pull/7023
• Settle in-flight state and report state_restored honestly on realtime reconnect by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7379
• Only accept JSON request bodies on the web UI chat endpoint by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7382
• Await callback results uniformly via a shared await_maybe helper by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7265
• Fix safe_download Host header dropping non-default port by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7348
• Serialize AG-UI dict tool-call deltas with Pydantic Core by @bferanmi806-sketch in https://github.com/pydantic/pydantic-ai/pull/7221

📦 Dependencies

• Add the cerebras optional dependency group by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7387

New Contributors

• @Diwak4r made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7071
• @mikemikimike made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7023
• @acheamponge made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6457
• @bferanmi806-sketch made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7221

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.27.1...v2.28.0

🛡️ Security

This release fixed an information-disclosure issue: retry-prompt content (validation feedback sent back to the model, which can quote invalid values from its output) was not redacted by InstrumentationSettings(include_content=False) when the retry was not tied to a tool call. Now disclosed as GHSA-3gh4-cghq-f8v4 (low). Fixed here in 2.27.1 (#7357); v1 users should upgrade to 1.107.4 or later.

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🐛 Bug Fixes

• Restore tool spans for failed argument validation by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6601
• Fix XaiStreamedResponse finish_reason mapping for streaming responses by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6814
• Point offline web UI hosting at the self-contained chat UI build by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7349
• Allow adaptive thinking with Tool Output and forced tool choice on Anthropic by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7200
• Gate RetryPromptPart OpenTelemetry content on include_content by @sean-kim05 in https://github.com/pydantic/pydantic-ai/pull/7357

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.27.0...v2.27.1

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add xai_agent_count to XaiModelSettings by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7155
• Round-trip CompactionPart through the Vercel AI and AG-UI adapters by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7287
• Add SnowflakeModel and SnowflakeProvider for Snowflake Cortex by @ayirpown in https://github.com/pydantic/pydantic-ai/pull/6150

🐛 Bug Fixes

• Honor include_binary_content=False in every OTel serialization sink by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7131
• Keep ToolReturn.tools in the redacted OTel shape by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7273
• Fix SpanQuery has_attributes matching for JSON-serialized dict and list values by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/5905
• Skip re-sending the standing prompt where the OpenAI Responses compaction item retains it by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7264
• Round-trip Anthropic compaction encrypted_content verbatim by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7286
• Strip the compaction provenance stamp in sanitize_messages by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7285
• Point at the cause when a tool return or model response exceeds Temporal's payload size limit by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7157

New Contributors

• @ayirpown made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6150

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.26.0...v2.27.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Support hiding function tools until revealed — via tool search, load_capability, or ToolReturn.tools — using each provider's native deferral/addition channel by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7104
• Add first-party run cancellation: AgentRun.cancel(), RunContext.cancel(), RunCancelled by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6497
• Add Model.resolve_prompt_cache_retention() to resolve effective prompt-cache retention from model settings by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7254
• Promote run_stream_events() iterator to public AgentRunEvents handle with cancel() and run-state access by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6498
• Cover and document DeepSeek V4 Flash via OpenAIResponsesModel + DeepSeekProvider by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7202

🐛 Bug Fixes

• Forward model_id through WrapperModel and resolve it against the active model in TemporalModel by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7181
• Map streamed OpenRouter reasoning details by their index by @VictorPeralta in https://github.com/pydantic/pydantic-ai/pull/7214
• Gate OpenRouter off native mid-conversation system messages with supports_inline_system_prompts=False by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7253
• Restore the released legacy profile-key shim and fix two reveal-state edges (is_tool_available, TestModel native additions) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7260
• Keep deferred tools searchable after discovery and reset reveal state at CompactionPart boundaries by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7225
• Forward events from UIEventStream callbacks that return an async iterator without being an async generator function by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7256
• Send only the compacted window: drop history before the latest same-provider CompactionPart by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7228

New Contributors

• @VictorPeralta made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7214

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.25.0...v2.26.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Forward xAI FileSearchTool collections search options by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7154

🐛 Bug Fixes

• fix(azure): send max_tokens for Mistral models, not max_completion_tokens by @feiiiiii5 in https://github.com/pydantic/pydantic-ai/pull/6929
• Omit server attributes for a malformed base_url port and forward base_url through WrapperModel by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7136
• Fix thinking="minimal" for GPT-5.6 models by @daikeren in https://github.com/pydantic/pydantic-ai/pull/7082
• Degrade malformed tool-call args in ToolCallPart.args_as_json_str() by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7092

New Contributors

• @feiiiiii5 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6929
• @daikeren made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7082

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.24.0...v2.25.0

🛡️ Security

This release included a fix for an availability vulnerability — unbounded memory use when downloading remote content via the local web_fetch tool or FileUrl media downloads — now disclosed as GHSA-v2xh-2vp8-57h8. Fixed in 2.24.0 (#7141); v1 users should upgrade to 1.107.2 or later.

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🐛 Bug Fixes

• Fix Google provider dropping an explicit timeout=0 by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7114
• Filter unavailable names from Google allowed_function_names by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6875
• Preserve caller-owned OpenAI model settings by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6870
• Send top_p=0.0 to Bedrock by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6864
• Honour ignore_streamed_leading_whitespace in Bedrock streams by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6828
• Recognise kimi-k2-thinking and Heroku's kimi-k2-5 as Kimi reasoning models by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6823
• Raise a UserError when an OpenRouter model omits its provider prefix by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6860
• Recognise Groq groq/compound model names by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6825
• Make Vercel AI ToolApprovalResponded.approved a StrictBool by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6995
• Guard against negative Retry-After integer values in wait_retry_after by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7066
• Skip inbound AG-UI content newer than the installed ag-ui-protocol instead of returning 422 by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7119
• Preserve stream part indexes during apply_event replay by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7138

New Contributors

• @wesleyzhangwq made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7127

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.23.0...v2.24.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add Bedrock support for ModelSettings.extra_headers by @kkauy in https://github.com/pydantic/pydantic-ai/pull/4825
• Restore stable gemini-3-pro-image and gemini-3.1-flash-image Gateway aliases by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/7069
• Add cost to RunUsage and cost_limit to UsageLimits by @Kludex in https://github.com/pydantic/pydantic-ai/pull/2684
• Add ToolAvailabilityDeltaPart with native tool_addition and additional_tools rendering by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6793

🐛 Bug Fixes

• Validate bedrock_max_concurrency instead of deadlocking on 0 by @LHMQ878 in https://github.com/pydantic/pydantic-ai/pull/6878
• Fix GoogleCloudProvider credential scoping and ADC auth env-var leak by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6500
• Read provider created timestamp from any chunk in OpenAI streaming responses by @LKRCharon in https://github.com/pydantic/pydantic-ai/pull/5496
• Preserve capability container subclasses during binding by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6677
• Drop the bound on the Temporal payload TypeAdapter cache by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7085
• Preserve the host's Pydantic AI instrumentation in the Temporal LogfirePlugin by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7086
• Fire capability event-stream and node hooks under agent.iter() by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6871
• Close async streams on teardown instead of waiting for the garbage collector by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7095

New Contributors

• @ayaangazali made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7020
• @kkauy made their first contribution in https://github.com/pydantic/pydantic-ai/pull/4825
• @LHMQ878 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6878
• @LKRCharon made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5496

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.22.0...v2.23.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Allow MCPToolset clients to skip optional MCP tasks via prefer_tasks by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6851
• Default Gemini VALIDATED tool mode on supported models by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6353
• Stop advertising tool search for capability-owned deferred tools on Anthropic by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6770
• Send mid-conversation system prompts as native system messages on Anthropic by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6765
• Add RunContext.is_tool_available by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7011

🐛 Bug Fixes

• Handle closed event loops in synchronous APIs by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6850
• Compare full origin, not just hostname, when dropping credentials on safe_download redirects by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6811
• Fix Temporal workflow livelock when anyio scope cancellation hits an in-flight activity await by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6892
• Copy extra_headers before setdefault in OpenAI chat and Groq models by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6868
• Support requesting approval or deferring a call from a tool's args_validator by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6897
• Use the workflow-prepared tool_def in Temporal function-tool activities instead of re-running prepare by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6890
• Raise a UserError instead of hanging when run_sync() is called on an event loop it cannot drive by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6905
• Fix Prefect tool-call cache keys: replay tool results on flow retry and stop colliding on RunContext fields a tool can read by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6944
• Run after_tool_validate when an args_validator defers the call by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6961
• Preserve the host's Logfire configuration in the Temporal LogfirePlugin by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6962
• Fail the workflow instead of retrying forever when a Temporal activity argument can't be serialized by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6893
• Install the EnqueueGuard on the DBOS/Prefect model-request and cancel_suspended_response units by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6943
• Restore typed values in a dynamic tool's Temporal ActivityConfig after the activity round trip by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6947
• Reject unregistered Model instances in durable runs instead of re-inferring them from model_id by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6898
• Heartbeat in tool, MCP, dynamic-toolset, and event-stream Temporal activities by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6965
• Rehydrate sets, carry conversation_id, and hard-error on omitted fields in TemporalRunContext by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6891
• Allow ApprovalRequired/CallDeferred from post-validation tool hooks, UserError from pre-validation ones by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6951
• Raise a UserError when a history processor or fallback_on handler has unresolvable type annotations by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6958
• Raise ModelAPIError for OpenRouter responses with null choices and no error envelope by @ZacharyHampton in https://github.com/pydantic/pydantic-ai/pull/6901
• Inline every $ref to a union $def, not just the first one by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6960
• Reject unknown ActivityConfig keys in TemporalDurability by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6964
• Honor per-tool TaskConfig on Prefect MCP tools and add PydanticUserError to its non-retryable set by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6952
• Pass the unprepared request to the wrapped model in InstrumentedModel by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6982
• fix(mcp): inherit agent retries in MCPToolset.tool_for_tool_def by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6449
• Fail the workflow on HookTimeoutError and FallbackExceptionGroup instead of retrying forever by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6978
• Keep thinking alive by not forcing tool_choice on OpenRouter anthropic/ models by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6957
• Add configurable max_retries to ToolSearchToolset by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6740
• Fix Temporal ActivityConfig validation on Python 3.10 and 3.11 by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6989
• Pass pydantic_graph through Temporal workflow sandboxes by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6990
• Memoize Temporal payload TypeAdapters by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7001
• Preserve SystemPromptPart semantics across caching and Temporal by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6984

📦 Dependencies

• Require genai-prices>=0.1.0 for detailed usage by @alexmojaki in https://github.com/pydantic/pydantic-ai/pull/6933
• Declare anyio as a direct dependency of pydantic-ai-slim and pydantic-graph by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7008

New Contributors

• @ZacharyHampton made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6901
• @vgrozdanic made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6942
• @rscholz98 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6858

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.21.0...v2.22.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• feat(usage): add per_request_input_tokens_limit to UsageLimits by @Oxygen56 in https://github.com/pydantic/pydantic-ai/pull/5907

🐛 Bug Fixes

• Refresh KnownModelName from Gateway probes and stable Google image IDs by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6806

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.20.0...v2.21.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add Claude Opus 5 (claude-opus-5) support by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6723
• Add OpenAI Responses API reasoning.context support (default all_turns) for the gpt-5.4/gpt-5.5/gpt-5.6 families by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6673

🐛 Bug Fixes

• Preserve arbitrary RequestUsage fields across serialization by @alexmojaki in https://github.com/pydantic/pydantic-ai/pull/6685
• Capture Anthropic thinking tokens in usage details by @jakub-orsula-parrot in https://github.com/pydantic/pydantic-ai/pull/6753
• Fix ALLOW_MODEL_REQUESTS guards for embeddings by @zcxGGmu in https://github.com/pydantic/pydantic-ai/pull/6774
• Skip include_server_side_tool_invocations for Vertex on Gemini 3+ by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6773
• Fix _openrouter_settings_to_openai_settings mutating caller's settings dict by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6743
• Replay tool-search history across provider boundaries instead of dropping it by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6780
• Preserve zero-valued OpenTelemetry usage details by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6796
• Expose OpenAI Responses phase on the streamed PartStartEvent by @Jonas1312 in https://github.com/pydantic/pydantic-ai/pull/6785
• Make a bare McpError from an MCP server recoverable instead of fatal by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6787

New Contributors

• @jakub-orsula-parrot made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6753
• @Jonas1312 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6785
• @dexhunter made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6485

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.19.0...v2.20.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add headers and retry_after to ModelHTTPError, populate from all provider SDKs by @dmontagu in https://github.com/pydantic/pydantic-ai/pull/6733

🐛 Bug Fixes

• Re-assert absorbed external cancellation at run step boundaries by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6496

📦 Dependencies

• Update FastMCP dependency range to <4 by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6737

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.18.0...v2.19.0

<!-- Release notes generated using configuration in .github/release.yml at v2.18.0 -->

What's Changed

🚀 Features

• Add AdvisorTool support for Anthropic and OpenRouter by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6605
• Add 'us'/'eu' multi-region locations to GoogleCloudProvider location type by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6715
• Add external_web_access option to WebSearchTool for OpenAI Responses by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6710
• Add BedrockMantleProvider and normalize response-scoped tool-call IDs by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6538

🐛 Bug Fixes

• Map deferred google-genai stream errors in GoogleModel by @dmontagu in https://github.com/pydantic/pydantic-ai/pull/6693

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.17.0...v2.18.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Make RequestUsage and RunUsage support arbitrary fields for upcoming genai-prices by @alexmojaki in https://github.com/pydantic/pydantic-ai/pull/6683
• Cache per-message OTel serialization to avoid O(n²) instrumentation cost by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6635

🐛 Bug Fixes

• Fix ContentFilterError for real Model Armor response blocks (finishReason: MODEL_ARMOR) and record moderation wire-truth cassettes by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6679

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.16.0...v2.17.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add mistral_prompt_cache_key setting and pass parallel_tool_calls to the Mistral SDK by @lionpeloux in https://github.com/pydantic/pydantic-ai/pull/6654
• Add ToolFailed for model-visible failures without retries by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/5585
• Add optional run_id= to agent runs, durable wrappers, and UI adapters by @grahamcracker1234 in https://github.com/pydantic/pydantic-ai/pull/6615
• Hoist openai_moderation to OpenAIChatModelSettings and expose Chat Completions moderation results in provider_details by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6658
• feat(google): add Model Armor support for Google Cloud via GoogleModelSettings by @Alex-Resch in https://github.com/pydantic/pydantic-ai/pull/5691
• Add gemini-3.6-flash and gemini-3.5-flash-lite models by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6668

🐛 Bug Fixes

• Raise a consistent ctx.enqueue() error inside durable units across Temporal, DBOS, and Prefect by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6666
• Preserve $ref sibling keywords when inlining $defs by @lntutor in https://github.com/pydantic/pydantic-ai/pull/6592
• Guard ctx.enqueue() from an event_stream_handler inside DBOS steps / Prefect tasks by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6671
• Preserve failed tool outcomes across AG-UI message round trips by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6659
• Fix tool retry counts across skipped steps by @zcxGGmu in https://github.com/pydantic/pydantic-ai/pull/6582

📦 Dependencies

• Bump pillow, pyasn1, and setuptools to resolve Dependabot alerts by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6657

New Contributors

• @AKSHITAK1040 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6633
• @grahamcracker1234 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6615
• @sergioperezcheco made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6585
• @lntutor made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6592
• @zcxGGmu made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6582

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.15.0...v2.16.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• feat(openai): support explicit prompt caching for gpt-5.6 by @Wh1isper in https://github.com/pydantic/pydantic-ai/pull/6423
• Inline text-like files in MistralModel prompts by @pulphix in https://github.com/pydantic/pydantic-ai/pull/6556
• Support overriding the tool-retry budget at run/iter/override time by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6072
• Support DynamicCapability toolsets in durable execution and wrap DynamicToolset in DBOS steps and Prefect tasks by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6623
• Add openai_moderation setting and expose OpenAI Responses API moderation results in provider_details by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6628
• Deprecate the Exa search common tools in favor of the ExaSearch capability in Pydantic AI Harness by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6644

🐛 Bug Fixes

• Fix hosted tool_search replay with null call IDs by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6604
• Mark untyped arrays as not strict-compatible for OpenAI by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6547
• Fix durability capability compatibility regressions by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6631
• Fix OpenAI background retrieve 400 for reasoning.encrypted_content on persisted responses by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6614
• Round-trip tool control-flow exceptions on DBOS/Prefect, fix Prefect replay edges, and add register_legacy_workflows to DBOSDurability for clean DBOSAgent migration by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6640

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.14.1...v2.15.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🐛 Bug Fixes

• Always fetch MCP instructions via a durable step under DBOSDurability by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6624
• Temporarily withdraw durable wrapper-agent deprecations by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6625

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.14.0...v2.14.1

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• feat(mistral): add reasoning_effort support via thinking settings by @YHallouard in https://github.com/pydantic/pydantic-ai/pull/5294
• Add TemporalDurability, DBOSDurability and PrefectDurability capabilities to replace the deprecated wrapper agents by @DouweM in https://github.com/pydantic/pydantic-ai/pull/4977

🐛 Bug Fixes

• Remove shut-down Gemini models gemini-2.5-flash-lite-preview-09-2025 and gemini-3.1-flash-lite-preview by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6606

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.13.0...v2.14.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add include_model_request_parameters instrumentation setting to omit the model_request_parameters span attribute by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6488
• Add RaiseContentFilterError capability to raise content filter error for non-empty content filter responses by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6167
• feat(usage): add cache_hit_ratio property to RequestUsage and RunUsage by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6529
• Add get_model, resolve_model_id, and for_agent capability hooks by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6333

🐛 Bug Fixes

• Fix MistralModel streaming settings by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6563
• Close open message parts (text, thinking, tool calls) on UI stream error by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6550
• Fix spurious OTel Failed to detach context error when a streamed run is interrupted mid-segment by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6572
• fix(temporal): pass through pydantic_monty in workflow sandbox by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6564

📦 Dependencies

• deps: bump mcp to 1.28.1 for Dependabot alerts by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6562

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.12.0...v2.13.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Add Moonshot AI kimi-k3 model by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6551
• Emit EnqueuedMessagesEvent when enqueued messages are delivered into the run by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6256
• feat: add DeferredToolCallEvent and DeferredToolResultEvent to AgentStreamEvent by @YHallouard in https://github.com/pydantic/pydantic-ai/pull/5588

🐛 Bug Fixes

• Fix ToolReturnPart serialization to use field aliases so wire output matches return_schema by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6543
• Fix tool binding for POSITIONAL_OR_KEYWORD params with *args by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6541
• fix(mistral): defer streamed output emission when text ends mid-integer-token by @Mukller in https://github.com/pydantic/pydantic-ai/pull/6519
• Derive capability-contributed toolset id from the capability for durable execution by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6408
• Fix GoogleModel per-Part media_resolution forwarding in vendor_metadata by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6525

New Contributors

• @Mukller made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6519
• @YHallouard made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5588

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.11.0...v2.12.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• feat: export HistoryProcessor and add actionable hints to usage-limit and tool-retry errors by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6346

🐛 Bug Fixes

• Fix MistralStreamedResponse streamed number/integer validation to accept int-valued numbers and reject bools by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6479
• fix(onboarding): suggest Agent('test') when provider credentials are missing by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6342
• fix(anthropic): transform native output schema when reached via profile={"default_structured_output_mode": "native"} by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6521
• Fix Bedrock profile={'default_structured_output_mode': 'native'} sending untransformed schema by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6539

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.10.0...v2.11.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Make message_history provider-valid out of the box (repair tool-call/result pairing) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6319
• Add support for OpenAI background mode and handle Anthropic stop_reason=pause_turn by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6303

🐛 Bug Fixes

• Fix has_values() returning True for all-zero usage details by @sean-kim05 in https://github.com/pydantic/pydantic-ai/pull/6466
• Fix RenamedToolset silently dropping a tool on a name collision by @sean-kim05 in https://github.com/pydantic/pydantic-ai/pull/6462
• Preserve invalid UTF-8 bytes in instrumentation serialization by @alexmojaki in https://github.com/pydantic/pydantic-ai/pull/6483
• Fix event-loop affinity in run_stream_sync by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6454
• Attach xAI ToolCallPart to the preceding reasoning message by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5924
• Filter unconfigured Anthropic native tool calls by @hxaxd in https://github.com/pydantic/pydantic-ai/pull/6463
• Fix DeferredToolResults resume when an output tool call was settled in the same batch as deferred calls by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6491

📦 Dependencies

• Bump transformers floor to >=5.5.0 for CVE-2026-5241 by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6482

New Contributors

• @sean-kim05 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6466
• @ShawnChen-Sirius made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6467
• @deepakdevp made their first contribution in https://github.com/pydantic/pydantic-ai/pull/4718
• @hxaxd made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6463

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.9.1...v2.10.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🐛 Bug Fixes

• Fix typed composition members recursion in JsonSchemaTransformer by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6440
• fix: handle int timeout values in MistralModel._get_timeout_ms by @Ricardo-M-L in https://github.com/pydantic/pydantic-ai/pull/5019
• Remove retired models from KnownModelName and restore Gateway-supported models by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/5843

📦 Dependencies

• fix(deps): bump soupsieve to 2.8.4 to fix ReDoS (CVE-2026-49477) by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6442

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.9.0...v2.9.1

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🛡️ Security

A moderate advisory, GHSA-jpr8-2v3g-wgf9 (CWE-863), affecting the AG-UI UIAdapter.sanitize_messages dangling-tool-call strip, was fixed in 2.5.0 and backported to 1.107.1 on the v1 line. If you are on 2.5.0 or later you already have the fix; this note calls it out now that the advisory is public.

• Affected: pydantic-ai / pydantic-ai-slim >= 2.0.0, < 2.5.0 (v2) and >= 1.88.0, < 1.107.1 (v1)
• Patched: 2.5.0 (v2) and 1.107.1 (v1)
• Not affected if every sensitive tool uses requires_approval=True / ApprovalRequiredToolset, or if your tool handlers validate their arguments and enforce authorization themselves.

🚀 Features

• Add /usage slash command to clai CLI for cumulative token usage by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6245
• feat(openai): add GPT-5.6 models and reasoning mode by @Wh1isper in https://github.com/pydantic/pydantic-ai/pull/6414
• feat(RunContext): expose the run's usage_limits to tools and capabilities by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6341

🐛 Bug Fixes

• Auto-enable Anthropic Files API beta when messages contain UploadedFile by @gaurav0107 in https://github.com/pydantic/pydantic-ai/pull/5815
• Fix repr() crash on message parts whose field != returns a non-bool (#6415) by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6421
• fix: mark non-crypto hashes with usedforsecurity=False (FIPS precaution) by @stef41 in https://github.com/pydantic/pydantic-ai/pull/5053
• Guard against id-less MCPToolset on the DBOSAgent wrapper path by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6406
• fix: make nested capture_run_messages capture correctly (#1568) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6345
• Fix cancellation deadlock when a wrapped model request or agent run survives cancellation by @0ywfe in https://github.com/pydantic/pydantic-ai/pull/6426
• Honor end_strategy='early' for NativeOutput, PromptedOutput, and image output by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6427

New Contributors

• @stef41 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5053
• @0ywfe made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6426

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.8.0...v2.9.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Allow to_cli() to pass model for unset-model agents by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6384
• Bump bundled chat UI to 2.0.0 and target sdk_version=7 in Agent.to_web() by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6296

🐛 Bug Fixes

• fix: validate Tool max_retries and timeout parameters by @isheng-eqi in https://github.com/pydantic/pydantic-ai/pull/6375
• fix: validate ToolOutput max_retries by @isheng-eqi in https://github.com/pydantic/pydantic-ai/pull/6377
• fix: validate Agent tool_timeout by @isheng-eqi in https://github.com/pydantic/pydantic-ai/pull/6383
• fix: validate max_queued in ConcurrencyLimit and ConcurrencyLimiter by @isheng-eqi in https://github.com/pydantic/pydantic-ai/pull/6373
• Fix JsonSchemaTransformer to recurse into allOf composition by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6394
• Fix empty and thinking-only responses reusing earlier text as the run output by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6403

New Contributors

• @isheng-eqi made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6375

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.7.0...v2.8.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Support azure-responses:[model-id] shorthand by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6355
• Add xAI grok-4.5 model by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6362

🐛 Bug Fixes

• fix: handle boolean JSON Schema nodes in function signature walker by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6314
• fix(gateway): preserve HTTPX event hooks by @VectorPeak in https://github.com/pydantic/pydantic-ai/pull/6327
• Allow override(model=...) on an agent with no model set by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6357
• Disable document input for AlibabaProvider (Chat Completions API) by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5727

New Contributors

• @lxingy3 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6349

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.6.0...v2.7.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Record time-to-first-token for streaming model requests by @dmontagu in https://github.com/pydantic/pydantic-ai/pull/5967
• feat: Add files support to CodeExecutionTool for Anthropic and OpenAI by @HenryYYang in https://github.com/pydantic/pydantic-ai/pull/4338
• Add Bedrock model profiles for Writer, Z.AI, and Moonshot AI, and refresh LatestBedrockModelNames by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6318

🐛 Bug Fixes

• Forward WebSearchTool domain filters to Groq search_settings by @Iam-Mil in https://github.com/pydantic/pydantic-ai/pull/6160
• Give a clear error for non-positive concurrency max_running by @VectorPeak in https://github.com/pydantic/pydantic-ai/pull/6282
• fix(evals): constrain judge_output reason to be concise and retry-safe by @anmolg1997 in https://github.com/pydantic/pydantic-ai/pull/5089
• Re-enable Prefect test suite and fix PrefectAgent cache-key drift by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6313
• fix(google): recover Gemini 3+ File Search grounding dropped with native tool parts by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6216
• fix: serialize callable thinking delta provider details by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6294
• Resolve capability for_run once per run and preserve resolved native tools under override(native_tools=...) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6332
• Reject conflicting native tool IDs within a capability layer by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6242

📦 Dependencies

• deps: bump torch floor to 2.12.1 to close CVE-2025-3000 by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6309
• deps: bump transformers floor to 5.3.0 to close CVE-2026-4372 by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6310
• Bump genai-prices to 0.0.70 by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6330

New Contributors

• @anmolg1997 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5089
• @HenryYYang made their first contribution in https://github.com/pydantic/pydantic-ai/pull/4338

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.5.1...v2.6.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🐛 Bug Fixes

• fix(bedrock): handle toolResult attachment co-location per-model via bedrock_tool_result_colocatable_content by @Hasnaathussain in https://github.com/pydantic/pydantic-ai/pull/6098
• fix(groq): map unified thinking setting to Groq reasoning_effort by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6231
• fix(evals): reject non-positive OnlineEvaluator.max_concurrency by @VectorPeak in https://github.com/pydantic/pydantic-ai/pull/6267
• fix: write relative schema refs for AgentSpec files by @VectorPeak in https://github.com/pydantic/pydantic-ai/pull/6251
• send retry prompt for empty model responses instead of silent resubmit by @dcosson in https://github.com/pydantic/pydantic-ai/pull/5643
• Preserve FileUrl.force_download in UI round-trips by @HarperZ9 in https://github.com/pydantic/pydantic-ai/pull/6205
• Exclude deprecated Bedrock gateway model anthropic.claude-3-5-sonnet-20240620-v1:0 by @ddanielcruzz in https://github.com/pydantic/pydantic-ai/pull/6297
• fix: preserve union NativeOutput description instead of last member's docstring by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6265
• fix(bedrock): deliver unsupported tool-return media to models that isolate toolResult turns by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6259
• Accept thinking-only responses when output_type allows None by @kmike in https://github.com/pydantic/pydantic-ai/pull/5146
• Omit empty ModelResponse from Mistral and Cohere request payloads by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6302

New Contributors

• @Hasnaathussain made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6098
• @saime428 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6268
• @NotFoundOvO made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6285
• @dcosson made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5643
• @HarperZ9 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6205
• @kmike made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5146

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.5.0...v2.5.1

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🛡️ Security

This release included the fix for GHSA-jpr8-2v3g-wgf9 (moderate, CWE-863), carried by the sanitize_messages change in #6169. On the AG-UI serving path (Agent.to_ag_ui() / AGUIAdapter), the dangling-tool-call strip anchored to a pre-sanitization index, so a dropped trailing client message could re-expose a preceding unresolved tool call for execution. The v1 line is patched in 1.107.1.

• Patched: 2.5.0 (v2) and 1.107.1 (v1)
• Affected: >= 2.0.0, < 2.5.0 (v2) and >= 1.88.0, < 1.107.1 (v1)

🚀 Features

• Add sanitize_messages for inbound message-history hardening by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6169
• Round-trip multimodal tool returns through the AG-UI and Vercel AI adapters (history and streaming) by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5255

🐛 Bug Fixes

• Document why _clean_message_history merges consecutive ModelRequests regardless of conversation_id/metadata by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6221
• Align LLMJudge _build_prompt section order with its few-shot examples by @immuhammadfurqan in https://github.com/pydantic/pydantic-ai/pull/6111
• Reject duplicate deferred tool call IDs by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6241
• Fix MoonshotAI Kimi thinking support and add models to KnownModelNames by @SuperMarioYL in https://github.com/pydantic/pydantic-ai/pull/6208
• fix(dbos,prefect): preserve runtime toolsets in durable runs by @Trollgeir in https://github.com/pydantic/pydantic-ai/pull/6076
• Exclude first-class token counts from gen_ai.usage.details.* OTel attributes to fix double-counting by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6244
• fix(dbos,prefect): preserve runtime event stream handlers by @Trollgeir in https://github.com/pydantic/pydantic-ai/pull/6093
• Reject non-object agent spec inputs by @Ghraven in https://github.com/pydantic/pydantic-ai/pull/5820
• Run the sync streaming wrappers on an anyio portal thread; fix async stream_text early-break teardown by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6199
• fix(bedrock): only synthesize a leading user message for models that require it by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6255
• fix(bedrock): correct bedrock_supported_media_kinds_in_tool_returns for Meta, Mistral, and Qwen by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6254

📦 Dependencies

• Avoid Python 3.14 numpy source builds in examples by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6246

New Contributors

• @pragnyanramtha made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5490
• @Sehlani042 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6200
• @ChunkyTortoise made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5739

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.4.0...v2.5.0

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

🚀 Features

• Split preserve_file_data into allow_uploaded_files (inbound security) and an AG-UI representation opt-in by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6232
• Add GEval evaluator and standard quality metric rubrics for LLMJudge by @dmontagu in https://github.com/pydantic/pydantic-ai/pull/5129
• Add agentic span-based evaluators (ToolCorrectness, TrajectoryMatch, ArgumentCorrectness, MaxToolCalls, MaxModelRequests) by @dmontagu in https://github.com/pydantic/pydantic-ai/pull/5130

🐛 Bug Fixes

• fix(xai): update XSearchTool handle limit by @gyx09212214-prog in https://github.com/pydantic/pydantic-ai/pull/5979
• Handle None metadata in Gradio weather agent example by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6214
• fix(mistral): preserve extended usage fields from API response by @felipebridge in https://github.com/pydantic/pydantic-ai/pull/5693
• Avoid mutable default argument in process_tool_calls by @kratos0718 in https://github.com/pydantic/pydantic-ai/pull/6189
• feat: forward WebSearchTool.user_location to xAI web search by @manan-tech in https://github.com/pydantic/pydantic-ai/pull/6181
• Clean up the pending task and streams on KeyboardInterrupt in synchronous run_until_complete wrappers by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6198
• fix(tool-search): drop redundant description from ToolSearchMatch by @serozhenka in https://github.com/pydantic/pydantic-ai/pull/5654
• fix(temporal): pass through genai_prices and httpx2 for workflow cost() by @syf2211 in https://github.com/pydantic/pydantic-ai/pull/6219
• fix(evals): reject non-positive max_concurrency by @VectorPeak in https://github.com/pydantic/pydantic-ai/pull/6228
• Lazy-start run_stream_events() background task on first event iteration by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6234

📦 Dependencies

• Bump genai-prices to >=0.0.69 by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6212

New Contributors

• @raullenchai made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5008
• @gyx09212214-prog made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5979
• @felipebridge made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5693
• @kratos0718 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6189
• @serozhenka made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5654

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.3.0...v2.4.0