Intel / repo

pydantic-ai v2.59.0 — v2.59.0 (2026-10-20)

Source: github.com
Author: dsfaccini
Date: Published Oct 21, 2026

Context

The change in Pydantic AI 2.59.0 to act on first is a high-severity fix in `web_fetch_tool`, the framework's tool for fetching web pages (advisory GHSA-4whf-38hw-pxxh). When the tool fetched attacker-controlled HTML containing many elements, converting that HTML could delay unrelated work running in the same process. The fix ships in 2.59.0 and, for the version 1 line, in 1.107.9. The release notes from Pydantic advise upgrading if the tool can fetch such pages. This follows 2.58.0, released a day earlier with two medium-severity fixes of its own.

Several smaller changes in the same release deal with text that could impersonate the framework's own messages. The transcript that `SummarizingCompaction` hands to its summarizer is now escaped, so tool output can't forge messages. `TrajectoryJudge`, which steers a running with feedback, now sends that feedback as escaped data inside judge_feedback tags and ties its steering note to its own frame with a reference, so a forged judge_feedback tag carries no authority. Results from `BackgroundTools` are now framed as tagged tool output rather than untagged user text. These appear among the bug fixes and compatibility notes, not as security advisories.

The compatibility notes also include removals: four Groq models that have been shut down, including `playai-tts` and `meta-llama/llama-4-maverick-17b-128e-instruct`, are no longer listed, so code that names them should be updated before upgrading.

Key takeaways · AI-distilled

A high-severity advisory (GHSA-4whf-38hw-pxxh) covers web_fetch_tool: converting attacker-controlled HTML with many elements could stall unrelated work in the same process. It is fixed in v2.59.0 and backported to v1.107.9.
The release adds provider-neutral model error categories such as ModelRateLimitError, ModelUnavailableError and ModelContextWindowExceededError, and TemporalDurability's new non_retryable_model_errors uses them to stop Temporal retrying specific categories.
Several fixes target forged prompt content: SummarizingCompaction now escapes its transcript so tool output cannot forge messages, and TrajectoryJudge ties its steering note to its own frame so fake <judge_feedback> tags carry no authority.
The release also separates provider usage that was omitted from a reported zero, adding UsageLimitUnavailableWarning, and adds DaytonaSandbox, which runs Coder, Shell, FileSystem and the other capabilities inside a Daytona .

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.

Read the source github.com