pydantic/pydantic-ai v2.44.0

v2.44.0 (2026-09-16)

on GitHub

🛡️ Security

This release fixes four security issues, all of them reached through web_fetch_tool or OpenTelemetry instrumentation. See each advisory for full details and affected versions.

• GHSA-vmxc-h2x2-jmf3 (moderate): the cloud-metadata and private-IP blocklists could be bypassed with an IPv6 zone identifier on a URL opted into local network access, via FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True). Both are off by default. Reported by @euriconicacio. (#8401)
• GHSA-fpf4-vwcp-v4hp (moderate): web_fetch processed responses in superlinear time on the event loop, in both the HTML conversion and the charset decode, so a single attacker-chosen page could stall every agent in the process. Reported by @BrianWillows. (#8397, #8418, #8433)
• GHSA-22h6-qm39-v87j (low): web_fetch_tool's domain lists were compared as written rather than in the form the resolver uses, so a blocked domain could be reached under another spelling. (#8407, #8421)
• GHSA-4x9p-g9wm-8q7f (low): with InstrumentationSettings(include_content=False), spans still carried exceptions, error statuses, instructions and the output template. Reported by @BrianWillows. (#8403, #8408, #8419, #8428)

Patched in 2.44.0 (v2) and 1.107.6 (v1).

What's Changed

⚠️ Compatibility Notes

• Make RunContext.enqueue() safe from worker threads by @adtyavrdhn in #7758
• Require a JSON Content-Type on UI adapter requests by @DouweM in #8396
• Dispatch a capability @durable_operation called from a per-request hook, instead of silently running it inline by @DouweM in #8395

🚀 Features

• Add a Vercel AI SDK and Eve migration skill by @adtyavrdhn in #8357
• Give AgentRunResult a stable serialized shape, and settle a finished stream into one by @DouweM in #8269
• Add a Storage page so persistence is findable by @DouweM in #8336
• Emit EnqueuedMessagesEvent when a realtime session delivers enqueued content by @DouweM in #8134

🐛 Bug Fixes

• Forward blocked_domains to OpenAI web search by @adtyavrdhn in #8323
• Fix OpenAI hosted tool_search pairing in AG-UI by @adtyavrdhn in #8313
• Let Agent.from_spec() construct without a model, deferring the requirement to run time by @DouweM in #8339
• Let RealtimeSession.close() finish its teardown when the closing task is cancelled by @DouweM in #8142
• Run a capability's prepare_tools over every tool the availability gate admits by @DouweM in #8071
• Bound the realtime session event queue while nothing is iterating it by @DouweM in #8133
• Report a run's own usage on its span, not the conversation total by @DouweM in #8417

New Contributors

• @mrchatam made their first contribution in #8286
• @vedjaw made their first contribution in #7028

Full Changelog: v2.43.0...v2.44.0