[dependabot]

Bumps the python group with 18 updates in the / directory:

Package	From	To
openai	3.24.0	3.46.0
agentrust-trace	0.10.0	0.11.0
pydantic	2.13.5	2.14.3
pytest	9.1.1	9.2.0
ruff	0.16.9	0.17.4
pydantic-ai-slim	2.53.0	2.66.0
agent-passport-system	4.2.0	4.3.0
google-adk	2.11.0	2.13.0
python-dotenv	1.2.3	1.2.4
uvicorn	0.52.4	0.54.0
pypi-attestations	0.0.30	0.0.31
openai-agents	0.22.3	0.24.0
chap-coordinator	0.2.13	0.3.4
numpy	2.5.3	2.5.4
pandas	3.0.6	3.1.1
agent-manifest	0.12.0	0.15.0
langchain-core	1.6.3	1.7.6
langgraph	1.2.12	1.2.20

Updates openai from 3.24.0 to 3.46.0

Release notes

Sourced from openai's releases.

v3.46.0

3.46.0 (2026-11-05)

Features

• api: add Australia, India, and Japan residency options (#4246) (2634b87)
• api: add GPT-6 Rosalind to the model catalog (#4243) (0f8e5f3)
• api: add image complexity and GIF and SVG output controls (#4247) (0152e3a)
• api: expand agent turn errors and image and audio options (#4245) (1b2fb74)

Chores

• deps: bump github/codeql-action/init from 4.39.0 to 4.39.1 (#4230) (c9fe335)

v3.45.0

3.45.0 (2026-11-03)

Features

• api: add 12-hour Responses caching and cache-write usage (#4240) (5f717b5)
• api: add project service tier settings (#4239) (1a2a3d0)

Documentation

• clarify generated-file ownership (#4241) (0309a8c)

v3.44.0

3.44.0 (2026-11-03)

Features

• api: add workload identity providers and federation rules (#4237) (12709d7)

v3.43.0

3.43.0 (2026-11-03)

Features

• api: expand Live Responses delegation tools (#4233) (f6e8480)
• responses: accumulate rich WebSocket progress (#4224) (48cdad3)
• responses: add WebSocket lane overflow isolation (#4225) (16bdad1)

Chores

... (truncated)

Changelog

Sourced from openai's changelog.

3.46.0 (2026-11-05)

Features

• api: add Australia, India, and Japan residency options (#4246) (2634b87)
• api: add GPT-6 Rosalind to the model catalog (#4243) (0f8e5f3)
• api: add image complexity and GIF and SVG output controls (#4247) (0152e3a)
• api: expand agent turn errors and image and audio options (#4245) (1b2fb74)

Chores

• deps: bump github/codeql-action/init from 4.39.0 to 4.39.1 (#4230) (c9fe335)

3.45.0 (2026-11-03)

Features

• api: add 12-hour Responses caching and cache-write usage (#4240) (5f717b5)
• api: add project service tier settings (#4239) (1a2a3d0)

Documentation

• clarify generated-file ownership (#4241) (0309a8c)

3.44.0 (2026-11-03)

Features

• api: add workload identity providers and federation rules (#4237) (12709d7)

3.43.0 (2026-11-03)

Features

• api: expand Live Responses delegation tools (#4233) (f6e8480)
• responses: accumulate rich WebSocket progress (#4224) (48cdad3)
• responses: add WebSocket lane overflow isolation (#4225) (16bdad1)

Chores

• deps: bump actions/setup-node from 4.4.0 to 7.1.0 (#4229) (abbfb27)
• deps: bump actions/setup-python from 7.0.0 to 7.1.0 (#4232) (49f9a59)
• deps: bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 (#4228) (f43f29b)

... (truncated)

Commits

• ea5d160 release: 3.46.0 (#4244)
• 0152e3a feat(api): add image complexity and GIF and SVG output controls (#4247)
• 2634b87 feat(api): add Australia, India, and Japan residency options (#4246)
• b4aee4c chore(deps): bump the python-maintenance group across 1 directory with 11 upd...
• c9fe335 chore(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 (#4230)
• d59f414 chore(deps): update aiohttp, multidict, PyJWT, and required yarl security flo...
• 1b2fb74 feat(api): expand agent turn errors and image and audio options (#4245)
• 0f8e5f3 feat(api): add GPT-6 Rosalind to the model catalog (#4243)
• 9b3458a release: 3.45.0 (#4242)
• 0309a8c docs: clarify generated-file ownership (#4241)
• Additional commits viewable in compare view

Updates agentrust-trace from 0.10.0 to 0.11.0

Release notes

Sourced from agentrust-trace's releases.

agentrust-trace 0.11.0

Breaking

• TraceAGTAdapter and TraceSandboxAdapter require enforcement_mode. They used to default to enforce, which signed a claim that a policy was evaluated when nothing evaluated it. Callers pass the mode their runtime ran under, or declared when no engine evaluated the policy (#416, #419; diagnosis and first fix by @​solloek369-arch in #417).
• Signatures accept only canonical unpadded base64url, so one signature has one spelling. A padded or non-canonical signature that used to decode is refused (#418).

Added

• verify_record() reports whether the objects a record cites resolve (#374).
• Verifiers declare accepted_profiles, and VerificationResult records the profile it verified under (#347, for #116).
• The reproducibility claim and its re-execution appraisal in the schema and models, with 21 signed vectors (#364, #370).
• condition-appraisal is a registered references relation (#389).
• MCP Server Provenance v2 binds behavioral hints (#409).
• intent_bridge binds a successor observation by digest (#340).
• provenance.verify_record() takes now to replay a freshness decision (#411).

Fixed

• Schema patterns follow ECMA-262, so a trailing \n, \r, U+2028 or U+2029 no longer passes subject or URI checks (#388). The Pydantic models share the same patterns (#412).
• A malformed signature is reported as malformed, not missing (#390).
• Revocation bundles with no RFC 8785 form are unverified_for_revocation rather than an exception (#386).
• Non-ASCII challenge nonces raise the documented ValueError (#383).
• The AGT adapter no longer stamps appraisal.status: affirming on every record (#336), and both adapters check iat before signing (#343).
• The v0.3 draft schema refused neither a private cnf.jwk nor an RSA key with no key material (#372, #311).
• Input validation across content_marking, provenance, intent_bridge, revocation, the sandbox adapter and sign.verify_record() freshness bounds (#239, #282, #284, #287, #288, #290, #300, #305, #318, #322, #333, #334, #335, #339, #387, #410).
• The PyPI description named TrustRecord.sign(), record.anchor() and record.verify(), none of which exist. It now shows sign_record and verify_record (#309).

Full list in CHANGELOG.md.

Changelog

Sourced from agentrust-trace's changelog.

[0.11.0] - 2026-09-25

• Breaking: TraceSandboxAdapter and TraceAGTAdapter require enforcement_mode; it no longer defaults to "enforce". An evidence constructor that fills in "enforce" signs a claim that a policy was evaluated when nothing observed an evaluation (#416), and the first fix, a "declared" default (#417), is ruled out by spec section 4.3: declared MUST NOT be a default. Callers that omitted the argument now get a TypeError and must pass the mode their runtime actually ran under, or "declared" when no policy engine evaluated the policy. Runtime enforcement defaults are unchanged. Diagnosis and first fix by @​solloek369-arch.

• Signatures accept one spelling. sign._b64url_decode accepts only canonical unpadded base64url, so a Trust Record, JWK x, provenance, intent-bridge or revocation-bundle signature carrying padding or non-canonical trailing bits is refused instead of decoding to the same bytes. content_marking refuses served record bytes with duplicate members. Deeply nested cnf.jwk, tool calls and provenance records raise each module's documented error type instead of RecursionError, and tool_catalog_hash raises ProvenanceError for a catalog with no anchor form. ClusterFuzzLite now covers the record, bundle, provenance, bridge, content-marking and canonicalization paths (#418).

• Correct regulatory context in the published v0.1/v0.2 introductions and LIMITATIONS.md (#328, following #314). Separate Article 12 logging capability from TRACE tamper-evidence, identify Article 11 / Annex IV as documentation context, correct the applicability dates and remove unsupported TRACE-level compliance claims. Editorial only; reported by @​ioanavalea with review context from @​lywinged.

• Propose v0.3 MCP profile requirements for producer-defined attempts, signed full declaration snapshots and explicit retry outcomes (#324). Clarify existing session wording without changing v0.2 validation. Proposed by @​madeinplutofabio with declaration-binding refinements from @​Mayur021; maintainer-carried proposal, not adopted or implemented.

• Propose MCP Server Provenance v2 with normalized behavioral-hint binding (#406). Preserve v1 hashes and producer defaults; add explicit v2 production and consumer format requirements. Reported by @​altrudev.

• Compare challenge nonces as UTF-8 bytes so non-ASCII mismatches raise the documented ValueError instead of TypeError (#381). Matching strings remain accepted without Unicode normalization. Invalid non-string expected_nonce settings raise a clear ValueError. Reported by @​chernistry; follow-up review by @​lywinged.

• Report revocation bundles without an RFC 8785 form as unverified_for_revocation with cause bundle_malformed, while continuing record verification (#382). The direct bundle-digest API still refuses such input. Reported by @​chernistry.

• Regenerate the v0.3 draft after canonical reproducibility additions and make the schema inventory test use portable repository paths on Windows.

• Keep untrusted input on each verifier's documented error type. Nesting a few hundred levels deep in cnf.jwk, a tool call, a provenance record or served content-marking bytes raised RecursionError; a 4,400 digit URL port raised Python's integer-string ValueError; a float or unsafe integer in an offered tool's input_schema raised UnanchorableValue from check_tool_catalog. All were refusals already, none was an acceptance. Found by the new ClusterFuzzLite targets in .clusterfuzzlite/; regression tests in tests/test_untrusted_input_stays_on_the_documented_error.py.

• Decode signatures and JWK x as canonical unpadded base64url only. The decoder took the standard alphabet, = padding and stray characters, and ignored the unused bits of the last character, so one signature had several spellings that all verified, and a revocation bundle's bundle_digest (which covers sig.value) gave one bundle several identities. The record-level rule

... (truncated)

Commits

• 7d8df34 chore(release): agentrust-trace 0.11.0 (#420)
• 3d7c90f fix(adapters): require enforcement_mode in the AGT and sandbox adapters (supe...
• 5d9cf72 fix(security): strict signature decoding, documented refusals, ClusterFuzzLit...
• 9fd79b6 fix(provenance): allow an explicit verification instant (#411)
• 761783a docs(spec): name the instrument that set the Chapter III application dates (#...
• e3111c7 docs: separate regulatory logging duties from TRACE properties (#414)
• 9d303c5 docs: propose stateless MCP transcript profile requirements (#413)
• b217e60 fix(validation): share schema regex semantics across Python surfaces (#412)
• 0cbb72c fix(content-marking): require a textual profile identifier (#410)
• 7d3f8ac feat(provenance): bind behavioral hints in explicit v2 format (#409)
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

• Build wheels for GraalPy 3.13 by @​msimacek in #14136.

  The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

• Improve schema generation for fixed type handlers by @​alexmojaki in #14130
• Skip general schema dispatch for builtin scalars by @​alexmojaki in #14141
• Skip annotation handler setup when annotations are empty by @​alexmojaki in #14149
• Fix quadratic serialization time with per-index include/exclude on sequences by @​Viicos in #14160
• Avoid type lookups when checking for None during serialization by @​Viicos in #14167
• Improve performance of model serialization by @​Viicos in #14171
• Improve performance of dict serialization by @​Viicos in #14172
• Improve performance of type inference during serialization by @​Viicos in #14173
• Avoid cloning the field name when using the default value during validation by @​Viicos in #14175
• Do not evaluate model_config annotations by @​Viicos in #14195
• Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @​Viicos in #14196
• Use a lightweight @contextmanager implementation internally by @​Viicos in #14199

Fixes

• Fix various issues about GC tracking in pydantic-core by @​Viicos in #13819
• Include null in serialization JSON Schema for unless-none field serializers by @​Kropiunig in #13848
• Fix RecursionError when copying or unpickling models with defer_build by @​Viicos in #14115
• Remove dead default_factory check in unsupported Field() attribute by @​owtaylor in #14129
• Disallow non string extra keys during validation by @​Viicos in #14135
• Fix deeply nested data being reported as a cyclic reference by @​Viicos in #14164

New Contributors

• @​owtaylor made their first contribution in #14129

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

• Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @​Viicos in #14003
• Bump speedate to v0.18.0 by @​Viicos in #14007
• Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @​Viicos in #14083

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• ea492e0 Bump pydantic-core to v2.50.4
• 4f4a33f Prepare release v2.14.3
• dca067b Benchmark TypedDict schema generation across builds
• a2d1f6c Skip annotation handler setup when annotations are empty
• 3ae0a40 Construct builtin scalar union schemas directly
• 358d36f Skip general schema dispatch for builtin scalars
• 3cc701a Improve schema generation for fixed type handlers
• 762db7e Remove redundant None check in union schema generation
• c214986 Bump pytest-codspeed to v5.0.4
• 038ee97 Bump typing-inspection to v0.4.5
• Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates ruff from 0.16.9 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Updates pydantic-ai-slim from 2.53.0 to 2.66.0

Release notes

Sourced from pydantic-ai-slim's releases.

v2.66.0 (2026-11-04)

What's Changed

🛡️ Security

• GHSA-m5vj-8mcw-82qx (high): web_fetch_tool and the WebFetch capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected if an attacker can choose or influence the URLs the tool fetches. Provider-native web fetching is not affected. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-mfx5-pc32-32m8 (high): The private_key pattern in Pydantic AI Harness's secret redaction backtracked exponentially on crafted text, so a few hundred characters that begin like a private key could occupy the event loop for minutes or longer. You are affected if you use redact_secrets or secret_data() with the private_key pattern, which is included by default, on text an attacker can influence. Fixed in pydantic-ai-harness 0.66.0.
• GHSA-5fj9-5pjw-vpwc (medium): The cloud-metadata blocklist that URL downloads check did not include Tencent Cloud's instance metadata address 169.254.0.23, so someone who can supply a URL the application downloads could have it fetch the instance's temporary role credentials. You are affected if you run on Tencent Cloud and allow local URLs, through force_download='allow-local' on a FileUrl or web_fetch_tool(allow_local_urls=True). Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-jp94-mmr3-2pvv (medium): With OpenTelemetry instrumentation enabled for embedding models, embedding spans recorded the extra_headers and extra_body embedding settings, so credentials passed through them could be read by anyone with access to the exported traces. You are affected if you instrument embedding models and pass secrets through those settings. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim). Restrict access to historical traces and rotate credentials they exposed.
• GHSA-7494-925c-rrxv (medium): For models whose profile requires to...

  Description has been truncated