# What changed in ag2

> 43 changes in ag2 1 from its official release notes, upgrade guides and advisories: 9 breaking, 2 security, 13 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/pypi/ag2/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## ag2 1

### Breaking changes

- The shell refuses ignored files named through a wildcard. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- The `|` operator creates an independent toolkit collection: tools retain their existing middleware, and source middleware is not inherited by tools from the other side or later additions. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Approval grants are now keyed by tool implementation, binding approval to the specific implementation. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- The bedrock extra installs aiobotocore>=3.9.1,<4 instead of boto3; applications that also install boto3 must choose a compatible botocore version. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- The session parameter now requires an aiobotocore AioSession; a boto3.Session fails on the first call. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- The context() tool now rejects non-positive limit and recent_n values. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- readonly mode now allows only commands that cannot write files or run other programs; several commands were removed from its built-in set. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- With allowed or readonly enabled, commands are split into argv, checked, and run without a shell; shell syntax is refused and expansions cannot bypass the allow-list. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- Each turn exposes one tool per name; later code-declared tools win, while runtime MCP and client tools rank below code-declared tools. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)

### Security

- Shell command-filter bypasses are fixed. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- Shell command-filter bypasses are fixed. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)

### New APIs and options

- Agent cards can be cacheable. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Cache diagnostics support is available in the Anthropic client and config. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Input media type validation is available as an opt-in. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Ollama supports configuring an API key. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Ollama supports a custom HTTP client. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Ollama supports configuring tool names. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- OpenAI voice configs accept explicit API keys. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- OpenAI Decisions API support is available through OpenAIDecisionsConfig. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Push notification URL validation is exposed and can be configured. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- The `Question` marker is available for shared decision schemas used with OpenAI and TypeSafe. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- AG-UI serves version 1.0. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- Plugins can be scoped to an invocation. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- A tool in a served agent can ask a human a question through context.input(); the question arrives as the AG-UI run's interrupt outcome and the answer comes in the next run's resume. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)

### Behavior and default changes

- A2A servers can run on several replicas. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)

### Fixes and other changes

- The language tag is stripped from single-line markdown fences. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- `on_change` can watch a file path. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Dropped log segments are numbered after the highest existing segment. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Evaluation suites saved with a UTF-8 BOM are accepted. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Toolkit discovery refreshes when resolved configuration changes. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Duplicate streaming tool-call IDs are avoided. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Backslashes are escaped when recovering unquoted frontmatter values. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Prefixes are matched literally. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Evaluation Suite items handle null and single-string tags or metadata. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- `loads` accepts null transitions and args. (1.2.0) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.2.0)
- Local skill ownership is checked before arguments are validated. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- Model output schemas are derived from serialization. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- Nested scripts execute from their declared paths. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- Timeout failures are preserved after the Tenki SDK upgrade. (1.1.2) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.2)
- MCPToolkit and MCPServerTool now send exactly one Authorization header on every provider, regardless of casing of an explicit header next to authorization_token. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- Explicit keys and region_name now apply when passed together with session, rather than being silently ignored. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- delegate() now closes its channel when sending the first message fails. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)
- Idle expiry and LRU overflow no longer drop an MCP conversation while a turn is running on it. (1.1.1) — [release notes](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)