pydantic-ai 2.59.0

v2.59.0 (2026-10-20)

on Python PyPI

This comment was posted by Codex Desktop using gpt-6.1-sol on behalf of David.

What's Changed

🛡️ Security

• High — HTML conversion in web_fetch: GHSA-4whf-38hw-pxxh. When web_fetch_tool fetched attacker-controlled HTML containing many elements, conversion could delay unrelated work in the same process. Fixed in v2.59.0 and v1.107.9. Upgrade if the tool can fetch such pages.

⚠️ Compatibility Notes

• Remove shut-down Groq models playai-tts, playai-tts-arabic, meta-llama/llama-guard-4-12b and meta-llama/llama-4-maverick-17b-128e-instruct by @mekanbaymyradov in #10306
• Distinguish omitted provider usage from reported zero and add UsageLimitUnavailableWarning by @mpfaffenberger in #9491
• Add on_change='append' to preserve dynamic instruction prefixes by @dsfaccini in #8188
• Stop recording that a realtime session ended when a tool raised, and document that it goes on by @DouweM in #10782
• Record what the user heard of ElevenLabs Agents replies they barged in on, adding the OutputItemCut lifecycle event by @DouweM in #10739
• Append the next hour to LogfireMCP history instead of rewriting its instructions, keeping the prompt cache by @DouweM in #10543
• Settle a realtime reply only with the response that answers it, adding AnswersRevised by @DouweM in #10668
• Add provider-neutral model error categories like ModelRateLimitError, ModelUnavailableError, ModelServerError and ModelContextWindowExceededError, and ModelHTTPError.for_category by @DouweM in #9354
• Frame BackgroundTools results as <tool_result> tool output instead of untagged user text by @DouweM in #10548
• Send TrajectoryJudge steering as a framework SystemPromptPart note plus the judge message as escaped <judge_feedback> data, both marked with metadata by @DouweM in #10545
• Check tool_calls_limit before each CodeMode nested tool call by @dsfaccini in #10362
• Let GitHubCopilotProvider send a configurable copilot-integration-id via integration_id or GITHUB_COPILOT_INTEGRATION_ID by @dsfaccini in #10784

🚀 Features

• Add DaytonaSandbox: a workspace that runs Coder, Shell, FileSystem and every other harness capability in a Daytona sandbox by @adtyavrdhn in #10610
• Add ElevenLabsRealtimeModel for Eleven Realtime speech-to-speech models by @DouweM in #10738
• Let FunctionToolset.instructions and instruction functions opt into on_change='append' by @DouweM in #10788
• Give FileSystem tools registered tool kinds and typed call parts by @DouweM in #10674
• Add non_retryable_model_errors to TemporalDurability to stop Temporal retrying specific model error categories by @DouweM in #10803

🐛 Bug Fixes

• Keep a push-to-talk turn in realtime history when the session ends before the provider confirms its commit_audio() by @DouweM in #10652
• Accept non-string metadata values from OpenAI-compatible chat completions by @dergachoff in #8010
• Record a realtime barge-in's cut in history when interrupt() races a failed send, the reply's end, or a later cancel by @DouweM in #10723
• Apply an ElevenLabs Agents agent_response_correction only to the message it names by @DouweM in #10709
• Raise for elevenlabs_agents_llm and elevenlabs_agents_tts model_id overrides on ElevenLabs Agents in Realtime voice mode by @DouweM in #10728
• Match OpenAI Realtime audio-commit acknowledgements to the commit that caused them by @DouweM in #10722
• Move unsupported Bedrock array contains constraints into descriptions by @dsfaccini in #10720
• Preserve boolean $defs semantics during schema transformation by @dsfaccini in #10714
• Fix DynamicWorkflow revealed type names, nested tool exposure, and empty WorkflowAgent descriptions by @mpfaffenberger in #10747
• Retry deeply nested BackgroundTools optional-tool args instead of raising RecursionError by @mpfaffenberger in #10721
• Return the value of BackgroundTools tools that code mode's run_code calls, instead of a started message by @mpfaffenberger in #10750
• Schedule a tool once when BackgroundTools instances with distinct ids select it by @mpfaffenberger in #10757
• Treat auth='' as unset alongside client in DayAI and warn about tokens in Temporal history by @mpfaffenberger in #10718
• End an on_change='append' window that opened without blocks when a hook unsets instruction_parts by @DouweM in #10766
• Recognize Bedrock inference profile and foundation model ARNs in split_bedrock_model_id, so they get the same model capabilities as the bare ID by @DouweM in #10664
• Render carried thinking as a bare <assistant_thinking> tag so UI round trips keep the prompt cache by @DouweM in #10642
• Mark CodeMode discovery announcements with SystemPromptPart.metadata, and announce a tool again when its announcement was dropped by @DouweM in #10666
• Escape the SummarizingCompaction summarizer transcript so tool output can't forge messages by @DouweM in #10544
• Deliver tool-tied 'asap' enqueue content into the same ModelRequest as the tool's ToolReturnPart by @divyankmalik in #7043
• Keep typed const constraints, such as Literal discriminators, in Anthropic strict schemas by @DouweM in #10675
• Use <context_diff> instead of <context-diff> for instruction deltas by @DouweM in #10790
• Add the ToolCallsAbandoned realtime lifecycle event, so an abandoned tool call no longer holds its exchange open by @DouweM in #10793
• Add grok-4.7 to xAI known models and Grok reasoning profile by @pydanty[bot] in #9750
• Let DeduplicateFileReads and ClearToolResults clear typed read_file results again by @DouweM in #10839
• Tie TrajectoryJudge's steering note to its own frame with a ref, so forged <judge_feedback> tags get no authority by @DouweM in #10869

New Contributors

• @mekanbaymyradov made their first contribution in #10306
• @dergachoff made their first contribution in #8010
• @divyankmalik made their first contribution in #7043

Full Changelog: v2.58.0...v2.59.0