Skip to content

pydantic-ai

v2.10.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 12d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent-framework genai llm pydantic python

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 12d

The release mandates bumping the `transformers` dependency to version >=5.5.0 to address CVE‑2026‑5241.

Why it matters: CVE‑2026‑5241 severity 90 requires updating transformers to >=5.5.0; failure leaves projects vulnerable.

Summary

AI summary

Updates 🐛 Bug Fixes, 🚀 Features, and 📦 Dependencies across a mixed release.

Changes in this release

Security Critical

Bump `transformers` floor to >=5.5.0 for CVE-2026-5241.

Bump `transformers` floor to >=5.5.0 for CVE-2026-5241.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add support for OpenAI background mode and handle Anthropic `stop_reason=pause_turn`.

Add support for OpenAI background mode and handle Anthropic `stop_reason=pause_turn`.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Make `message_history` provider-valid out of the box (repair tool-call/result pairing).

Make `message_history` provider-valid out of the box (repair tool-call/result pairing).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fix `has_values()` returning True for all‑zero usage details.

Fix `has_values()` returning True for all‑zero usage details.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fix `RenamedToolset` silently dropping a tool on name collision.

Fix `RenamedToolset` silently dropping a tool on name collision.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Preserve invalid UTF‑8 `bytes` in instrumentation serialization.

Preserve invalid UTF‑8 `bytes` in instrumentation serialization.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fix event‑loop affinity in `run_stream_sync`.

Fix event‑loop affinity in `run_stream_sync`.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Attach xAI `ToolCallPart` to the preceding reasoning message.

Attach xAI `ToolCallPart` to the preceding reasoning message.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Filter unconfigured Anthropic native tool calls.

Filter unconfigured Anthropic native tool calls.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fix `DeferredToolResults` resume when an output tool call was settled in the same batch as deferred calls.

Fix `DeferredToolResults` resume when an output tool call was settled in the same batch as deferred calls.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

What's Changed

🚀 Features

  • Make message_history provider-valid out of the box (repair tool-call/result pairing) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6319
  • Add support for OpenAI background mode and handle Anthropic stop_reason=pause_turn by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6303

🐛 Bug Fixes

  • Fix has_values() returning True for all-zero usage details by @sean-kim05 in https://github.com/pydantic/pydantic-ai/pull/6466
  • Fix RenamedToolset silently dropping a tool on a name collision by @sean-kim05 in https://github.com/pydantic/pydantic-ai/pull/6462
  • Preserve invalid UTF-8 bytes in instrumentation serialization by @alexmojaki in https://github.com/pydantic/pydantic-ai/pull/6483
  • Fix event-loop affinity in run_stream_sync by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6454
  • Attach xAI ToolCallPart to the preceding reasoning message by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5924
  • Filter unconfigured Anthropic native tool calls by @hxaxd in https://github.com/pydantic/pydantic-ai/pull/6463
  • Fix DeferredToolResults resume when an output tool call was settled in the same batch as deferred calls by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6491

📦 Dependencies

  • Bump transformers floor to >=5.5.0 for CVE-2026-5241 by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6482

New Contributors

  • @sean-kim05 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6466
  • @ShawnChen-Sirius made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6467
  • @deepakdevp made their first contribution in https://github.com/pydantic/pydantic-ai/pull/4718
  • @hxaxd made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6463

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.9.1...v2.10.0

Security Fixes

  • dep: transformers >=5.5.0 to address CVE-2026-5241
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pydantic-ai

Get notified when new releases ship.

Sign up free

About pydantic-ai

AI Agent Framework, the Pydantic way

All releases →

Related context

Related CVEs

Earlier breaking changes

  • v1.95.0 rename ‘built-in tools’ to ‘native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]

Beta — feedback welcome: [email protected]