Skip to content

pydantic-ai

v2.6.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’
This release patches 2 known CVEs

Topics

agent-framework genai llm pydantic python

Affected surfaces

deps

Summary

AI summary

Updates πŸ› Bug Fixes, πŸš€ Features, and πŸ“¦ Dependencies across a mixed release.

Full changelog

What's Changed

πŸš€ Features

  • Record time-to-first-token for streaming model requests by @dmontagu in https://github.com/pydantic/pydantic-ai/pull/5967
  • feat: Add files support to CodeExecutionTool for Anthropic and OpenAI by @HenryYYang in https://github.com/pydantic/pydantic-ai/pull/4338
  • Add Bedrock model profiles for Writer, Z.AI, and Moonshot AI, and refresh LatestBedrockModelNames by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6318

πŸ› Bug Fixes

  • Forward WebSearchTool domain filters to Groq search_settings by @Iam-Mil in https://github.com/pydantic/pydantic-ai/pull/6160
  • Give a clear error for non-positive concurrency max_running by @VectorPeak in https://github.com/pydantic/pydantic-ai/pull/6282
  • fix(evals): constrain judge_output reason to be concise and retry-safe by @anmolg1997 in https://github.com/pydantic/pydantic-ai/pull/5089
  • Re-enable Prefect test suite and fix PrefectAgent cache-key drift by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6313
  • fix(google): recover Gemini 3+ File Search grounding dropped with native tool parts by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6216
  • fix: serialize callable thinking delta provider details by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6294
  • Resolve capability for_run once per run and preserve resolved native tools under override(native_tools=...) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6332
  • Reject conflicting native tool IDs within a capability layer by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6242

πŸ“¦ Dependencies

  • deps: bump torch floor to 2.12.1 to close CVE-2025-3000 by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6309
  • deps: bump transformers floor to 5.3.0 to close CVE-2026-4372 by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6310
  • Bump genai-prices to 0.0.70 by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6330

New Contributors

  • @anmolg1997 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5089
  • @HenryYYang made their first contribution in https://github.com/pydantic/pydantic-ai/pull/4338

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.5.1...v2.6.0

Security Fixes

  • deps: bump torch floor to 2.12.1 to close CVE-2025-3000
  • deps: bump transformers floor to 5.3.0 to close CVE-2026-4372

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pydantic-ai

Get notified when new releases ship.

Sign up free

About pydantic-ai

AI Agent Framework, the Pydantic way

All releases β†’

Related context

Earlier breaking changes

  • v1.95.0 rename β€˜built-in tools’ to β€˜native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]

Beta — feedback welcome: [email protected]