pydantic/pydantic-ai v2.66.0

v2.66.0 (2026-11-04)

on GitHub

What's Changed

🛡️ Security

• GHSA-m5vj-8mcw-82qx (high): web_fetch_tool and the WebFetch capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected if an attacker can choose or influence the URLs the tool fetches. Provider-native web fetching is not affected. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-mfx5-pc32-32m8 (high): The private_key pattern in Pydantic AI Harness's secret redaction backtracked exponentially on crafted text, so a few hundred characters that begin like a private key could occupy the event loop for minutes or longer. You are affected if you use redact_secrets or secret_data() with the private_key pattern, which is included by default, on text an attacker can influence. Fixed in pydantic-ai-harness 0.66.0.
• GHSA-5fj9-5pjw-vpwc (medium): The cloud-metadata blocklist that URL downloads check did not include Tencent Cloud's instance metadata address 169.254.0.23, so someone who can supply a URL the application downloads could have it fetch the instance's temporary role credentials. You are affected if you run on Tencent Cloud and allow local URLs, through force_download='allow-local' on a FileUrl or web_fetch_tool(allow_local_urls=True). Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-jp94-mmr3-2pvv (medium): With OpenTelemetry instrumentation enabled for embedding models, embedding spans recorded the extra_headers and extra_body embedding settings, so credentials passed through them could be read by anyone with access to the exported traces. You are affected if you instrument embedding models and pass secrets through those settings. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim). Restrict access to historical traces and rotate credentials they exposed.
• GHSA-7494-925c-rrxv (medium): For models whose profile requires tool schemas without $defs and $ref, a small tool schema whose definitions reference one another repeatedly expanded exponentially when inlined on the event loop, which can take minutes of CPU time and gigabytes of memory. You are affected if you serve such a model through the AG-UI adapter, where clients submit their own frontend tool schemas. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-484x-x9m4-62cj (medium): Decision models (DecisionModel subclasses such as OpenAIDecisionsModel, and TypeSafeModel) resolved every $ref in a tool's argument schema again at each place it appears, so a small crafted schema could take exponential time and memory on the event loop. You are affected if you use a decision model from v2.46.0 onward with tools whose schemas an attacker can supply, most directly through an AG-UI endpoint. Fixed in v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-r879-rxgj-3g75 (medium): The Vercel AI and AG-UI adapters took time that grows with the square of the number of parts to load a submitted message, on the event loop, so a single request could delay other work in the same process. You are affected if you pass client-submitted conversations to VercelAIAdapter or AGUIAdapter. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-4cj4-hgwf-4hc4 (medium): When message history was serialized and loaded again, a tool result containing a JSON object in the serialized shape of one of Pydantic AI's file types was rebuilt as that file. A third party who controls data a tool returns could use this to make the application download a URL on its local network, or make the model provider read an s3:// object or uploaded file with the application's credentials. You are affected if tool results can contain data third parties control, that history is stored and reloaded, held on the server by a UI adapter, or carried by Temporal, DBOS or Prefect durable execution, and your model or its provider fetches or resolves such files; the advisory lists which do. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-5ppx-9jq6-6pmw (low): allowed_domains on the local web-fetch tool, and PlaywrightBrowser egress policies whose allowlist bounds every request kind, looked a refused hostname up in DNS before rejecting it, so data encoded in the hostname could reach that domain's nameserver. Domain lists are now checked before resolution. You are affected only if you rely on such an allowlist while the model processes content untrusted parties can influence. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim), and pydantic-ai-harness 0.66.0.
• GHSA-mgmv-r532-pg36 (medium): An MCP capability configured with a server URL and no explicit id derived its identifier from the URL's hostname and last path segment, and the AG-UI and Vercel AI adapters sent that identifier to the frontend with MCP Apps tool results, so a credential in that segment could reach users of the chat frontend. This affects v2.57.0 up to but not including v2.60.0, and was fixed in v2.60.0; it is disclosed with this batch. Rotate MCP server credentials that were carried in the URL path.

⚠️ Compatibility Notes

• Call Anthropic's 20260209 web tools directly on the Anthropic API when citations are requested by @dsfaccini in #12278
• Apply FunctionToolset(requires_approval=True) to Tool instances passed to the toolset by @dsfaccini in #12378
• Re-resolve realtime session instructions before each model turn and deliver their changes as appends by @DouweM in #11930
• Recognize SummarizingCompaction(keep_user_messages=True) copies only by the marker on their text by @DouweM in #12316

🚀 Features

• Add OpenSandbox for self-hosted agent workspaces by @adtyavrdhn in #11841
• Add Azure Durable Task durability to pydantic_ai_harness by @DouweM in #11332
• Add Pixeltable tools and memory storage to Harness by @pierrebrunelle in #9369
• Add RenderSandbox to run agent workspaces in Render sandboxes by @ojusave in #10238
• Add include_instructions to the MCP capability so server instructions can be left out of the agent's instructions by @DouweM in #12269
• Re-resolve realtime session instructions before each model turn and deliver their changes as appends by @DouweM in #11930
• Report xAI Grok Voice speech timing as segment timestamps with output_speech_timestamps by @DouweM in #11782
• Add a retries field to SummarizingCompaction by @gouyu-hou in #12315
• Add Workspace.authority and AuthorityWorkspace for workspaces whose files the operator does not control by @adtyavrdhn in #11836

🐛 Bug Fixes

• Stop ModalSandbox failing with AttributeError on Modal 1.6, which removed FilesystemExecutionError by @adtyavrdhn in #12247
• Call Anthropic's 20260209 web tools directly on the Anthropic API when citations are requested by @dsfaccini in #12278
• Add streaming support to CohereModel by @Julien-ser in #6100
• Release run dependencies after exceptions by @dsfaccini in #11255
• Preserve extra keys in tool_search and load_capability message history by @pydanty in #7933
• Inline $defs in tool schemas for GLM-5.3 on Together, Nebius, Fireworks, Vercel, Ollama, Hugging Face, Cerebras, Mistral and OpenAI-compatible gateways by @pydanty in #12138
• Keep RepoContext from following symlinks out of the working directory or to files that aren't instruction files by @DouweM in #12044
• Reject approvals for tool calls a server-held history isn't waiting on under manage_message_history='server' by @DouweM in #12313
• Apply FunctionToolset(requires_approval=True) to Tool instances passed to the toolset by @dsfaccini in #12378
• Recognize SummarizingCompaction(keep_user_messages=True) copies only by the marker on their text by @DouweM in #12316
• Keep on-demand capabilities loaded from code across SummarizingCompaction, SlidingWindowCompaction and RelevanceCompaction, recording every removed load again as a CapabilityLoadDeltaPart by @DouweM in #12270
• Keep earlier tool-call turns byte-stable when a later response thinks in openai_chat_send_back_thinking_parts='field' mode by @DouweM in #12309
• Keep a code-loaded capability's instructions across instruction windows by @pydanty in #12304
• Write RepairToolArguments repairs back to the ToolCallPart in history by @DouweM in #12319
• Take user constraints only from the user's messages in AnthropicModel.compact_messages()'s focus prompt by @DouweM in #11915
• Floor the tiered escalation estimate at the surviving text so a cheap anchor cannot hide the rest of the chain by @gouyu-hou in #12341
• Close SqliteStepStore and SqliteMediaStore connections whose WAL switch fails on a locked database by @DouweM in #12147
• Fix instrumented embedding spans missing the embeddings attribute when include_content=True by @pydanty in #8295
• Stop keying OpenAIChatModel's batch hint, OpenAI realtime models and harness Advisor on provider names by @DouweM in #11796

New Contributors

• @pierrebrunelle made their first contribution in #9369
• @Patrick-SCH03 made their first contribution in #8332
• @gouyu-hou made their first contribution in #12315

Full Changelog: v2.65.0...v2.66.0