This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
ReleasePort's take
Moderate signalRelease v2.9.0 fixes the GHSA-jpr8-2v3g-wgf9 vulnerability in UIAdapter.sanitize_messages for pydantic‑ai versions below 2.5.0 (v2) and 1.107.1 (v1).
Why it matters: The fix addresses a security vulnerability affecting pydantic‑ai releases prior to v2 2.5.0 and v1 1.107.1; upgrade immediately.
Summary
AI summaryUpdates 🐛 Bug Fixes, 🚀 Features, and v1 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Fixes GHSA-jpr8-2v3g-wgf9 vulnerability in UIAdapter.sanitize_messages. Fixes GHSA-jpr8-2v3g-wgf9 vulnerability in UIAdapter.sanitize_messages. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds `/usage` slash command to `clai` CLI for cumulative token usage. Adds `/usage` slash command to `clai` CLI for cumulative token usage. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds GPT‑5.6 models and reasoning mode to OpenAI integration. Adds GPT‑5.6 models and reasoning mode to OpenAI integration. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Exposes `usage_limits` from `RunContext` to tools and capabilities. Exposes `usage_limits` from `RunContext` to tools and capabilities. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Auto‑enables Anthropic Files API beta when messages contain `UploadedFile`. Auto‑enables Anthropic Files API beta when messages contain `UploadedFile`. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes `repr()` crash on message parts with non‑bool `!=` field. Fixes `repr()` crash on message parts with non‑bool `!=` field. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Marks non‑crypto hashes with `usedforsecurity=False` for FIPS precaution. Marks non‑crypto hashes with `usedforsecurity=False` for FIPS precaution. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Guards against id‑less `MCPToolset` on the `DBOSAgent` wrapper path. Guards against id‑less `MCPToolset` on the `DBOSAgent` wrapper path. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Ensures nested `capture_run_messages` captures correctly. Ensures nested `capture_run_messages` captures correctly. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Resolves cancellation deadlock for wrapped model requests or agent runs. Resolves cancellation deadlock for wrapped model requests or agent runs. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Honors `end_strategy='early'` for `NativeOutput`, `PromptedOutput`, and image output. Honors `end_strategy='early'` for `NativeOutput`, `PromptedOutput`, and image output. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
What's Changed
🛡️ Security
A moderate advisory, GHSA-jpr8-2v3g-wgf9 (CWE-863), affecting the AG-UI UIAdapter.sanitize_messages dangling-tool-call strip, was fixed in 2.5.0 and backported to 1.107.1 on the v1 line. If you are on 2.5.0 or later you already have the fix; this note calls it out now that the advisory is public.
- Affected:
pydantic-ai/pydantic-ai-slim>= 2.0.0, < 2.5.0(v2) and>= 1.88.0, < 1.107.1(v1) - Patched:
2.5.0(v2) and1.107.1(v1) - Not affected if every sensitive tool uses
requires_approval=True/ApprovalRequiredToolset, or if your tool handlers validate their arguments and enforce authorization themselves.
🚀 Features
- Add
/usageslash command toclaiCLI for cumulative token usage by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6245 - feat(openai): add GPT-5.6 models and reasoning mode by @Wh1isper in https://github.com/pydantic/pydantic-ai/pull/6414
- feat(
RunContext): expose the run'susage_limitsto tools and capabilities by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6341
🐛 Bug Fixes
- Auto-enable Anthropic Files API beta when messages contain
UploadedFileby @gaurav0107 in https://github.com/pydantic/pydantic-ai/pull/5815 - Fix
repr()crash on message parts whose field!=returns a non-bool (#6415) by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6421 - fix: mark non-crypto hashes with usedforsecurity=False (FIPS precaution) by @stef41 in https://github.com/pydantic/pydantic-ai/pull/5053
- Guard against id-less
MCPToolseton theDBOSAgentwrapper path by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6406 - fix: make nested
capture_run_messagescapture correctly (#1568) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6345 - Fix cancellation deadlock when a wrapped model request or agent run survives cancellation by @0ywfe in https://github.com/pydantic/pydantic-ai/pull/6426
- Honor
end_strategy='early'forNativeOutput,PromptedOutput, and image output by @DouweM in https://github.com/pydantic/pydantic-ai/pull/6427
New Contributors
- @stef41 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5053
- @0ywfe made their first contribution in https://github.com/pydantic/pydantic-ai/pull/6426
Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.8.0...v2.9.0
Security Fixes
- GHSA-jpr8-2v3g-wgf9 (CWE-863) – fixed dangling-tool-call strip in AG‑UI UIAdapter.sanitize_messages; patched in pydantic-ai v1.107.1 (v1 line) and v2.5.0 (v2)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v1.95.0 rename ‘built-in tools’ to ‘native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]
Beta — feedback welcome: [email protected]