unstale

pypi / ag2

ag2

What changed in ag2 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

9 breaking2 security13 new APIs and options1 behavior and defaults18 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.0 on npm

ag2 143 changes

Breaking changes 9

  • The shell refuses ignored files named through a wildcard.

    1.2.0release notes

  • The | operator creates an independent toolkit collection: tools retain their existing middleware, and source middleware is not inherited by tools from the other side or later additions.

    1.2.0release notes

  • Approval grants are now keyed by tool implementation, binding approval to the specific implementation.

    1.1.1release notes

  • The bedrock extra installs aiobotocore>=3.9.1,<4 instead of boto3; applications that also install boto3 must choose a compatible botocore version.

    1.1.1release notes

  • The session parameter now requires an aiobotocore AioSession; a boto3.Session fails on the first call.

    1.1.1release notes

  • The context() tool now rejects non-positive limit and recent_n values.

    1.1.1release notes

  • readonly mode now allows only commands that cannot write files or run other programs; several commands were removed from its built-in set.

    1.1.1release notes

  • With allowed or readonly enabled, commands are split into argv, checked, and run without a shell; shell syntax is refused and expansions cannot bypass the allow-list.

    1.1.1release notes

  • Each turn exposes one tool per name; later code-declared tools win, while runtime MCP and client tools rank below code-declared tools.

    1.1.1release notes

Security 2

New APIs and options 13

  • Agent cards can be cacheable.

    1.2.0release notes

  • Cache diagnostics support is available in the Anthropic client and config.

    1.2.0release notes

  • Input media type validation is available as an opt-in.

    1.2.0release notes

  • Ollama supports configuring an API key.

    1.2.0release notes

  • Ollama supports a custom HTTP client.

    1.2.0release notes

  • Ollama supports configuring tool names.

    1.2.0release notes

  • OpenAI voice configs accept explicit API keys.

    1.2.0release notes

  • OpenAI Decisions API support is available through OpenAIDecisionsConfig.

    1.2.0release notes

  • Push notification URL validation is exposed and can be configured.

    1.2.0release notes

  • The Question marker is available for shared decision schemas used with OpenAI and TypeSafe.

    1.2.0release notes

  • AG-UI serves version 1.0.

    1.1.2release notes

  • Plugins can be scoped to an invocation.

    1.1.2release notes

  • A tool in a served agent can ask a human a question through context.input(); the question arrives as the AG-UI run's interrupt outcome and the answer comes in the next run's resume.

    1.1.1release notes

Behavior and default changes 1

Fixes and other changes 18

  • The language tag is stripped from single-line markdown fences.

    1.2.0release notes

  • on_change can watch a file path.

    1.2.0release notes

  • Dropped log segments are numbered after the highest existing segment.

    1.2.0release notes

  • Evaluation suites saved with a UTF-8 BOM are accepted.

    1.2.0release notes

  • Toolkit discovery refreshes when resolved configuration changes.

    1.2.0release notes

  • Duplicate streaming tool-call IDs are avoided.

    1.2.0release notes

  • Backslashes are escaped when recovering unquoted frontmatter values.

    1.2.0release notes

  • Prefixes are matched literally.

    1.2.0release notes

  • Evaluation Suite items handle null and single-string tags or metadata.

    1.2.0release notes

  • loads accepts null transitions and args.

    1.2.0release notes

  • Local skill ownership is checked before arguments are validated.

    1.1.2release notes

  • Model output schemas are derived from serialization.

    1.1.2release notes

  • Nested scripts execute from their declared paths.

    1.1.2release notes

  • Timeout failures are preserved after the Tenki SDK upgrade.

    1.1.2release notes

  • MCPToolkit and MCPServerTool now send exactly one Authorization header on every provider, regardless of casing of an explicit header next to authorization_token.

    1.1.1release notes

  • Explicit keys and region_name now apply when passed together with session, rather than being silently ignored.

    1.1.1release notes

  • delegate() now closes its channel when sending the first message fails.

    1.1.1release notes

  • Idle expiry and LRU overflow no longer drop an MCP conversation while a turn is running on it.

    1.1.1release notes