pypi / pydantic-ai-slim
pydantic-ai-slim
What changed in pydantic-ai-slim 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
7 breaking16 security21 new APIs and options3 performance11 behavior and defaults57 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpydantic-ai-slim 2110 changes
Breaking changes 7
Escapes tool names in discovery announcements and no longer recognizes announcements by their text.
Events are emitted after store reads so DBOS recovery with an event_stream_handler replays in order; existing workflows may not recover after upgrading.
A GPT-Live connection drop without a reconnect policy raises RealtimeError instead of a raw websockets exception.
Now aligns with the exchange boundary that wait_for_reply() waits for; use PartEndEvents to react when a particular response ends.
Raises instead of returning a response when a model request hook rejects with ModelRetry.
A resumed 'suspended' response's usage is counted only in the run that produced it.
Native tool_search is no longer granted to this model.
Security 11
Provider-native MCP configuration no longer exposes server URLs, authorization tokens, or custom header values in OpenTelemetry request traces; URL-based MCP capabilities also no longer expose URL-embedded credentials in identifiers.
Vercel AI and AG-UI adapters no longer execute available tools with client-chosen arguments when server-side message history is non-empty and the system prompt is server-managed.
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Pydantic AI: Event loop blocked by quadratic title extraction in
web_fetchPydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when
include_content=FalsePydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Pydantic AI Web chat UI (
Agent.to_web(),clai web): the local chat endpoint does not validate theHostheaderPydantic AI Web chat UI (
Agent.to_web(),clai web): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when
include_content=FalsePydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
New APIs and options 21
Steers a running delegated task.
UI adapter dispatch_request() accepts timeout=.
Runs realtime sessions on ElevenLabs Agents.
Sets how many times the provider SDK retries a request.
Sets a timeout covering all attempts and stream consumption of one model request.
Adds a provider that lets app users sign in with ChatGPT and use their plan.
Deletes answered tool rounds from the OpenAI Realtime conversation.
Requests reasoning summaries from the GPT-Live backend.
RealtimeConnection yields lifecycle events through this public module.
UI adapter run_stream_native() accepts timeout=.
UI adapter run_stream() accepts timeout=.
Provides the deadline for a run bounded with timeout=.
Set unknown_names='skip' to ignore include and exclude names that no library has.
Request-scoped system prompts are sent natively as Anthropic clear_at system messages.
Bounds a whole agent run.
Any module can define a ToolKind with typed tool parts, and unknown kinds remain loadable.
Adds a Harness reviewer that lets a model approve low-risk tool calls before a person sees them.
Adds dataset_name to EvaluationReport.
Adds a method to relay MCP Apps tool calls.
Adds read_resource_contents and forwards MCP Apps tool results to AG-UI and Vercel AI frontends.
Adds MetaProvider for Meta Muse models, with meta: using the Responses API.
Performance 3
Stores each message once instead of repeating history in every snapshot.
Stores each message once instead of repeating history in every snapshot.
Stores each message once instead of repeating history in every snapshot.
Behavior and default changes 11
The profile's supports_auto_cache decides whether automatic Anthropic caching is used; legacy AsyncAnthropicBedrock uses it for Claude Opus 4.7 and later.
Enqueued messages stream to Vercel AI and AG-UI frontends as history they send back but do not render.
WarnNearLimits warnings are sent as request-scoped system prompts.
With Temporal tracing enabled, pass an explicit id= to URL-based MCP after in-flight workflows complete; changing it renames the activities.
A native tool is treated as unsupported when the model cannot apply its domain, usage, or external web access settings.
Can return images and PDFs, and describes other binary files.
Warns when a model ignores settings such as timeout, max_retries, or stop_sequences.
BackgroundTools completions now receive namespaced origin and tool_call_id metadata.
Realtime history, usage, and reply waits now come from the session core.
Realtime history, usage, and reply waits now come from the session core.
Requests are priced at their reported service tier.
Fixes and other changes 57
Streams returns of tool calls skipped after a final result to AG-UI frontends.
Preserves separate UserPromptParts through a round trip.
Ignores deeply nested ReasoningMessage.encrypted_value JSON.
Fixes UseEnumMemberDocstrings enums, Choices, and BoolCriteria failing in strict schemas.
Uses automatic prompt caching through anthropic_cache.
Fixes tool_choice='none' failing after a tool call.
Clears tool results in batches instead of on every request past the threshold.
Resolves the default output mode once per run so toggling thinking per step keeps tools stable.
Falls back on stream errors raised before the first event.
Writes mapping keys that are not valid XML names to a key attribute.
No longer return DeferredToolRequests to a parent that cannot resolve them.
Closes the AsyncInferenceClient it builds when the provider or agent exits.
Rewrites nested $refs when merging JSON schema definitions.
Walks propertyNames and contains when inlining JSON Schema definitions.
Forces a single tool natively instead of filtering tools.
Sends tool results in call order so UI round trips keep the prompt cache.
Adds a tool-call ID length profile setting and rewrites IDs rejected by Mistral models.
Keeps an unsaved token refresh instead of reverting to stored credentials it spent.
Stops continuing an OpenAI response once its preceding history or the response itself has changed.
Ends a response created without an id when a malformed response.done closes it.
Processes streamed responses as well.
A realtime reply cut off by the user is recorded as interrupted after generation finishes, and seeded interrupted speech is marked.
Updates together with the usage it reports.
Replacing the client's system prompt no longer removes mid-run system prompts.
Escapes context-file blocks and sends the nested-directory pointer as a SystemPromptPart.
Labels a symlinked instruction file with its target's name, so CLAUDE.md -> AGENTS.md reads AGENTS.md.
Keeps every usage counter so durable runs retain one-hour cache writes and reasoning tokens; declares cache_write_1h_tokens and output_reasoning_tokens.
A resumed 'suspended' response's usage is counted only in the run that produced it.
Non-native ThinkingParts are carried in a user turn for models that imitate assistant formatting.
Sends tool-call arguments as compact JSON so UI round trips keep the prompt cache.
Preserves tools reveals when a Vercel AI frontend rebuilds history from the event stream.
A resumed 'suspended' response's usage is counted only in the run that produced it.
Streams returns of tool calls skipped after a final result to Vercel AI frontends.
Keeps parallel tool calls in one ModelResponse when loading messages.
Preserves separate UserPromptParts through a round trip.
No longer waits forever when a realtime tool batch receives no reply after a call is cancelled.
Waits between continuation polls are durable DBOS.sleep steps under DBOSDurability and DBOSAgent.
Warns when response handlers are skipped on a streamed request.
GoogleModel now supports Gemini agentic media processing.
A backend response that ends while the session closes is now counted as a request.
Closes the HTTP client for a model built from a model name and reuses one client per name inside async with agent.
Gemini tool-call thought signatures are now sent back from OpenAIChatModel.
In default 'auto' mode, current-turn tool calls now receive an empty thinking field when needed.
Unavailable tool_choice names are no longer sent in allowed_tools.
Planning tool loops remain in the prompt cache, and a leading CachePoint is attached to the previous user message.
Cleanup is awaited after early exit and cancellation.
Realtime output now records and streams one part per output item even when its transcript arrives late.
Run context copies inside Temporal activities and Render child tasks retain available_tool_names and active_capability_ids.
Skills now honor disable-model-invocation and user-invocable, and skip stray skill library paths.
The partial response of an interrupted stream is now charged.
Concurrency slots are released after streamed request cleanup.
Token-based compaction now retains more recent history.
A tool's prepare function now has its own retry count under .prefixed(), .renamed(), and PrefixTools.
The discriminator mapping now references multimodal URL choices.
Unset optional fields are omitted from UIMessage JSON so the AI SDK accepts it.
User prompts quoting its [WarnNearLimits] marker are no longer deleted.
Sessions can reconnect past max_duration when a reconnect policy is set.
pydantic-ai-slim 15 changes
Security 5
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL