Pydantic AI

From the release notes

🛡️ Security This release fixes four security issues, all of them reached through web_fetch_tool or OpenTelemetry instrumentation. See each advisory for full details and affected versions. GHSA-vmxc-h2x2-jmf3 (moderate): the cloud-metadata and private-IP blocklists could be bypassed with an IPv6 zone identifier on a URL opted into local network access, via FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True). Both are off by default. Reported by @euriconicacio. (#8401) GHSA-fpf4-vwcp-v4hp (moderate): web_fetch processed responses in superlinear time on the event loop, in both the HTML conversion and the charset decode, so a single attacker-chosen page could stall every agent in the process. Reported by @BrianWillows. (#8397, #8418, #8433) GHSA-22h6-qm39-v87j (low): web_fetch_tool's domain lists were compared as written rather than in the form the resolver uses, so a blocked domain could be reached under another spelling. (#8407, #8421) GHSA-4x9p-g9wm-8q7f (low): with InstrumentationSettings(include_content=False), spans still carried exceptions, error statuses, instructions and the output template. Reported by @BrianWillows. (#8403, #8408, #8419, #8428) Patched in 2.44.0 (v2) and 1.107.6 (v1). What's Changed ⚠️ Compatibility Notes Make RunContext.enqueue() safe from worker threads by @adtyavrdhn in #7758 Require a JSON Content-Type on UI adapter requests by @DouweM in #8396 Dispatch a capability @durable_operation called from a per-request hook, instead of silently running it inline by @DouweM in #8395 🚀 Features Add a Vercel AI SDK and Eve migration skill by @adtyavrdhn in #8357 Give AgentRunResult a stable serialized shape, and settle a finished stream into one by @DouweM in #8269 Add a Storage page so persistence is findable by @DouweM in #8336 Emit EnqueuedMessagesEvent when a realtime session delivers enqueued content by @DouweM in #8134 🐛 Bug Fixes Forward blocked_domains to OpenAI web search by @adtyavrdhn in #8323 Fix OpenAI hosted tool_search pairing in AG-UI by @adtyavrdhn in #8313 Let Agent.from_spec() construct without a model, deferring the requirement to run time by @DouweM in #8339 Let RealtimeSession.close() finish its teardown when the closing task is cancelled by @DouweM in #8142 Run a capability's prepare_tools over every tool the availability gate admits by @DouweM in #8071 Bound the realtime session event queue while nothing is iterating it by @DouweM in #8133 Report a run's own usage on its span, not the conversation total by @DouweM in #8417 New Contributors @mrchatam made their first contribution in #8286 @vedjaw made their first contribution in #7028 Full Changelog: v2.43.0...v2.44.0

From the release notes

🛡️ Security A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in 2.44.0. See each advisory for full details and affected versions. GHSA-vmxc-h2x2-jmf3 (moderate): cloud-metadata and private-IP blocklist bypass via an IPv6 zone identifier, on a URL opted into local network access. Reported by @euriconicacio. (#8402) GHSA-fpf4-vwcp-v4hp (moderate): superlinear response processing in web_fetch, in both the HTML conversion and the charset decode, blocking the event loop. Reported by @BrianWillows. (#8399, #8434) GHSA-22h6-qm39-v87j (low): web_fetch_tool domain lists compared as written rather than in the form the resolver uses. (#8409) GHSA-4x9p-g9wm-8q7f (low): OpenTelemetry spans carrying exceptions, error statuses, instructions and the output template under include_content=False. Reported by @BrianWillows. (#8404, #8422, #8429) Also carried over: credentials are now dropped on a safe_download redirect whenever the full origin changes, not only the hostname (#8410). This was fixed on the v2 line some time ago and had never been backported. Patched in 1.107.6; all four are also patched on the v2 line in 2.44.0. What's Changed Every code change in this release is one of the security fixes above. Maintenance alongside them: Repair v1 CI and its mcp, anthropic, and duckduckgo extras (v1 backport) by @DouweM in #8406 Pin FastA2A below 1 in the a2a extra (v1) by @DouweM in #8412 Full Changelog: v1.107.5...v1.107.6

From the release notes

What's Changed 🚀 Features Add a first-run banner describing the run, and open clai sessions with it by @DouweM in #7447 🐛 Bug Fixes Preserve text part boundaries after tool calls in OpenAIChatModel by @KaranJayakumar in #8235 fix(temporal): key tool opt-out checks on operation kind, not an MCP import by @adtyavrdhn in #8257 New Contributors @KaranJayakumar made their first contribution in #8235 Full Changelog: v2.42.0...v2.43.0