pydantic-ai

v2.9.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 13d AI Agents & Assistants

✓ No known CVEs patched

This release patches 1 known CVE

Topics

agent-framework genai llm pydantic python

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 12d

Patch soupsieve to version 2.8.4 to remediate CVE‑2026‑49477, a high‑severity ReDoS vulnerability.

Why it matters: CVE‑2026‑49477 has severity 90; updating the dependency stops denial‑of‑service attacks affecting any code using soupsieve.

AI summary

Updates 🐛 Bug Fixes, 📦 Dependencies, and fix across a mixed release.

Type	Severity	Summary	CVE
Security	Critical	Patch CVE-2026-49477 ReDoS by bumping soupsieve to 2.8.4 Patch CVE-2026-49477 ReDoS by bumping soupsieve to 2.8.4 Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix
Bugfix	Medium	Fix typed composition members recursion in JsonSchemaTransformer Fix typed composition members recursion in JsonSchemaTransformer Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Handle int timeout values in MistralModel._get_timeout_ms Handle int timeout values in MistralModel._get_timeout_ms Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Remove retired models from KnownModelName and restore Gateway-supported models Remove retired models from KnownModelName and restore Gateway-supported models Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Fix typed composition members recursion in JsonSchemaTransformer by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6440
fix: handle int timeout values in MistralModel._get_timeout_ms by @Ricardo-M-L in https://github.com/pydantic/pydantic-ai/pull/5019
Remove retired models from KnownModelName and restore Gateway-supported models by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/5843

fix(deps): bump soupsieve to 2.8.4 to fix ReDoS (CVE-2026-49477) by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6442

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v2.9.0...v2.9.1

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pydantic-ai

Get notified when new releases ship.

About pydantic-ai

AI Agent Framework, the Pydantic way

v1.95.0 rename ‘built-in tools’ to ‘native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]