# What changed in pydantic-ai-slim

> 115 changes in pydantic-ai-slim 1 to 2 from its official release notes, upgrade guides and advisories: 7 breaking, 16 security, 21 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/pydantic-ai-slim/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## pydantic-ai-slim 2

### Breaking changes

- Escapes tool names in discovery announcements and no longer recognizes announcements by their text. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Events are emitted after store reads so DBOS recovery with an event_stream_handler replays in order; existing workflows may not recover after upgrading. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- A GPT-Live connection drop without a reconnect policy raises RealtimeError instead of a raw websockets exception. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Now aligns with the exchange boundary that wait_for_reply() waits for; use PartEndEvents to react when a particular response ends. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Raises instead of returning a response when a model request hook rejects with ModelRetry. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- A resumed 'suspended' response's usage is counted only in the run that produced it. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Native tool_search is no longer granted to this model. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)

### Security

- Provider-native MCP configuration no longer exposes server URLs, authorization tokens, or custom header values in OpenTelemetry request traces; URL-based MCP capabilities also no longer expose URL-embedded credentials in identifiers. (1.107.8, 2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0), [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.8)
- Vercel AI and AG-UI adapters no longer execute available tools with client-chosen arguments when server-side message history is non-empty and the system prompt is server-managed. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (2.53.0) — [security advisory](https://github.com/advisories/GHSA-6FQQ-452J-QHRP)
- Pydantic AI: Excessive resource use when local web fetching converts nested HTML (1.107.7, 2.52.0) — [security advisory](https://github.com/advisories/GHSA-V36G-JCW9-X7CW)
- Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (1.107.6, 2.44.0) — [security advisory](https://github.com/advisories/GHSA-FPF4-VWCP-V4HP)
- Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` (1.107.6, 2.44.0) — [security advisory](https://github.com/advisories/GHSA-4X9P-G9WM-8Q7F)
- Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers (1.107.6, 2.44.0) — [security advisory](https://github.com/advisories/GHSA-VMXC-H2X2-JMF3)
- Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (1.107.5, 2.30.0) — [security advisory](https://github.com/advisories/GHSA-Q2XC-RRXJ-58X9)
- Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (1.107.4, 2.28.0) — [security advisory](https://github.com/advisories/GHSA-H4XC-3QFQ-JF93)
- Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` (1.107.4, 2.27.1) — [security advisory](https://github.com/advisories/GHSA-3GH4-CGHQ-F8V4)
- Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl (1.107.2, 2.24.0) — [security advisory](https://github.com/advisories/GHSA-V2XH-2VP8-57H8)

### New APIs and options

- Steers a running delegated task. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- UI adapter dispatch_request() accepts timeout=. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Runs realtime sessions on ElevenLabs Agents. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Sets how many times the provider SDK retries a request. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Sets a timeout covering all attempts and stream consumption of one model request. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Adds a provider that lets app users sign in with ChatGPT and use their plan. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Deletes answered tool rounds from the OpenAI Realtime conversation. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Requests reasoning summaries from the GPT-Live backend. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- RealtimeConnection yields lifecycle events through this public module. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- UI adapter run_stream_native() accepts timeout=. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- UI adapter run_stream() accepts timeout=. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Provides the deadline for a run bounded with timeout=. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Set unknown_names='skip' to ignore include and exclude names that no library has. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Request-scoped system prompts are sent natively as Anthropic clear_at system messages. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Bounds a whole agent run. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Any module can define a ToolKind with typed tool parts, and unknown kinds remain loadable. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Adds a Harness reviewer that lets a model approve low-risk tool calls before a person sees them. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Adds dataset_name to EvaluationReport. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Adds a method to relay MCP Apps tool calls. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Adds read_resource_contents and forwards MCP Apps tool results to AG-UI and Vercel AI frontends. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Adds MetaProvider for Meta Muse models, with meta: using the Responses API. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)

### Performance

- Stores each message once instead of repeating history in every snapshot. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Stores each message once instead of repeating history in every snapshot. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Stores each message once instead of repeating history in every snapshot. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)

### Behavior and default changes

- The profile's supports_auto_cache decides whether automatic Anthropic caching is used; legacy AsyncAnthropicBedrock uses it for Claude Opus 4.7 and later. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Enqueued messages stream to Vercel AI and AG-UI frontends as history they send back but do not render. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- WarnNearLimits warnings are sent as request-scoped system prompts. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- With Temporal tracing enabled, pass an explicit id= to URL-based MCP after in-flight workflows complete; changing it renames the activities. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- A native tool is treated as unsupported when the model cannot apply its domain, usage, or external web access settings. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Can return images and PDFs, and describes other binary files. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Warns when a model ignores settings such as timeout, max_retries, or stop_sequences. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- BackgroundTools completions now receive namespaced origin and tool_call_id metadata. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Realtime history, usage, and reply waits now come from the session core. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Realtime history, usage, and reply waits now come from the session core. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Requests are priced at their reported service tier. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)

### Fixes and other changes

- Streams returns of tool calls skipped after a final result to AG-UI frontends. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Preserves separate UserPromptParts through a round trip. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Ignores deeply nested ReasoningMessage.encrypted_value JSON. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Fixes UseEnumMemberDocstrings enums, Choices, and BoolCriteria failing in strict schemas. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Uses automatic prompt caching through anthropic_cache. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Fixes tool_choice='none' failing after a tool call. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Clears tool results in batches instead of on every request past the threshold. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Resolves the default output mode once per run so toggling thinking per step keeps tools stable. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Falls back on stream errors raised before the first event. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Writes mapping keys that are not valid XML names to a key attribute. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- No longer return DeferredToolRequests to a parent that cannot resolve them. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Closes the AsyncInferenceClient it builds when the provider or agent exits. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Rewrites nested $refs when merging JSON schema definitions. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Walks propertyNames and contains when inlining JSON Schema definitions. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Forces a single tool natively instead of filtering tools. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Sends tool results in call order so UI round trips keep the prompt cache. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Adds a tool-call ID length profile setting and rewrites IDs rejected by Mistral models. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Keeps an unsaved token refresh instead of reverting to stored credentials it spent. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Stops continuing an OpenAI response once its preceding history or the response itself has changed. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Ends a response created without an id when a malformed response.done closes it. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Processes streamed responses as well. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- A realtime reply cut off by the user is recorded as interrupted after generation finishes, and seeded interrupted speech is marked. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Updates together with the usage it reports. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Replacing the client's system prompt no longer removes mid-run system prompts. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Escapes context-file blocks and sends the nested-directory pointer as a SystemPromptPart. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Labels a symlinked instruction file with its target's name, so CLAUDE.md -> AGENTS.md reads AGENTS.md. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Keeps every usage counter so durable runs retain one-hour cache writes and reasoning tokens; declares cache_write_1h_tokens and output_reasoning_tokens. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- A resumed 'suspended' response's usage is counted only in the run that produced it. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Non-native ThinkingParts are carried in a user turn for models that imitate assistant formatting. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Sends tool-call arguments as compact JSON so UI round trips keep the prompt cache. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Preserves tools reveals when a Vercel AI frontend rebuilds history from the event stream. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- A resumed 'suspended' response's usage is counted only in the run that produced it. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Streams returns of tool calls skipped after a final result to Vercel AI frontends. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Keeps parallel tool calls in one ModelResponse when loading messages. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Preserves separate UserPromptParts through a round trip. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- No longer waits forever when a realtime tool batch receives no reply after a call is cancelled. (2.58.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0)
- Waits between continuation polls are durable DBOS.sleep steps under DBOSDurability and DBOSAgent. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Warns when response handlers are skipped on a streamed request. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- GoogleModel now supports Gemini agentic media processing. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- A backend response that ends while the session closes is now counted as a request. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Closes the HTTP client for a model built from a model name and reuses one client per name inside async with agent. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Gemini tool-call thought signatures are now sent back from OpenAIChatModel. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- In default 'auto' mode, current-turn tool calls now receive an empty thinking field when needed. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Unavailable tool_choice names are no longer sent in allowed_tools. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Planning tool loops remain in the prompt cache, and a leading CachePoint is attached to the previous user message. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Cleanup is awaited after early exit and cancellation. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Realtime output now records and streams one part per output item even when its transcript arrives late. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Run context copies inside Temporal activities and Render child tasks retain available_tool_names and active_capability_ids. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Skills now honor disable-model-invocation and user-invocable, and skip stray skill library paths. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- The partial response of an interrupted stream is now charged. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Concurrency slots are released after streamed request cleanup. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Token-based compaction now retains more recent history. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- A tool's prepare function now has its own retry count under .prefixed(), .renamed(), and PrefixTools. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- The discriminator mapping now references multimodal URL choices. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Unset optional fields are omitted from UIMessage JSON so the AI SDK accepts it. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- User prompts quoting its [WarnNearLimits] marker are no longer deleted. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)
- Sessions can reconnect past max_duration when a reconnect policy is set. (2.57.0) — [release notes](https://github.com/pydantic/pydantic-ai/releases/tag/v2.57.0)

## pydantic-ai-slim 1

### Security

- Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials (1.106.0) — [security advisory](https://github.com/advisories/GHSA-H7P7-W5GC-XJ3W)
- pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678) (1.102.0) — [security advisory](https://github.com/advisories/GHSA-CG7W-RG45-PC59)
- Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580) (1.99.0) — [security advisory](https://github.com/advisories/GHSA-CQP8-FCVH-X7R3)
- Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling (1.56.0) — [security advisory](https://github.com/advisories/GHSA-2JRP-274C-JHV3)
- Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL (1.51.0) — [security advisory](https://github.com/advisories/GHSA-WJP5-868J-WQV7)