[dependabot]

Bumps pydantic-ai-slim from 2.65.0 to 2.66.0.

Release notes

Sourced from pydantic-ai-slim's releases.

v2.66.0 (2026-11-04)

What's Changed

🛡️ Security

• GHSA-m5vj-8mcw-82qx (high): web_fetch_tool and the WebFetch capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected if an attacker can choose or influence the URLs the tool fetches. Provider-native web fetching is not affected. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-mfx5-pc32-32m8 (high): The private_key pattern in Pydantic AI Harness's secret redaction backtracked exponentially on crafted text, so a few hundred characters that begin like a private key could occupy the event loop for minutes or longer. You are affected if you use redact_secrets or secret_data() with the private_key pattern, which is included by default, on text an attacker can influence. Fixed in pydantic-ai-harness 0.66.0.
• GHSA-5fj9-5pjw-vpwc (medium): The cloud-metadata blocklist that URL downloads check did not include Tencent Cloud's instance metadata address 169.254.0.23, so someone who can supply a URL the application downloads could have it fetch the instance's temporary role credentials. You are affected if you run on Tencent Cloud and allow local URLs, through force_download='allow-local' on a FileUrl or web_fetch_tool(allow_local_urls=True). Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-jp94-mmr3-2pvv (medium): With OpenTelemetry instrumentation enabled for embedding models, embedding spans recorded the extra_headers and extra_body embedding settings, so credentials passed through them could be read by anyone with access to the exported traces. You are affected if you instrument embedding models and pass secrets through those settings. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim). Restrict access to historical traces and rotate credentials they exposed.
• GHSA-7494-925c-rrxv (medium): For models whose profile requires tool schemas without $defs and $ref, a small tool schema whose definitions reference one another repeatedly expanded exponentially when inlined on the event loop, which can take minutes of CPU time and gigabytes of memory. You are affected if you serve such a model through the AG-UI adapter, where clients submit their own frontend tool schemas. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-484x-x9m4-62cj (medium): Decision models (DecisionModel subclasses such as OpenAIDecisionsModel, and TypeSafeModel) resolved every $ref in a tool's argument schema again at each place it appears, so a small crafted schema could take exponential time and memory on the event loop. You are affected if you use a decision model from v2.46.0 onward with tools whose schemas an attacker can supply, most directly through an AG-UI endpoint. Fixed in v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-r879-rxgj-3g75 (medium): The Vercel AI and AG-UI adapters took time that grows with the square of the number of parts to load a submitted message, on the event loop, so a single request could delay other work in the same process. You are affected if you pass client-submitted conversations to VercelAIAdapter or AGUIAdapter. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-4cj4-hgwf-4hc4 (medium): When message history was serialized and loaded again, a tool result containing a JSON object in the serialized shape of one of Pydantic AI's file types was rebuilt as that file. A third party who controls data a tool returns could use this to make the application download a URL on its local network, or make the model provider read an s3:// object or uploaded file with the application's credentials. You are affected if tool results can contain data third parties control, that history is stored and reloaded, held on the server by a UI adapter, or carried by Temporal, DBOS or Prefect durable execution, and your model or its provider fetches or resolves such files; the advisory lists which do. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim).
• GHSA-5ppx-9jq6-6pmw (low): allowed_domains on the local web-fetch tool, and PlaywrightBrowser egress policies whose allowlist bounds every request kind, looked a refused hostname up in DNS before rejecting it, so data encoded in the hostname could reach that domain's nameserver. Domain lists are now checked before resolution. You are affected only if you rely on such an allowlist while the model processes content untrusted parties can influence. Fixed in v2.66.0 and v1.107.10 (pydantic-ai, pydantic-ai-slim), and pydantic-ai-harness 0.66.0.
• GHSA-mgmv-r532-pg36 (medium): An MCP capability configured with a server URL and no explicit id derived its identifier from the URL's hostname and last path segment, and the AG-UI and Vercel AI adapters sent that identifier to the frontend with MCP Apps tool results, so a credential in that segment could reach users of the chat frontend. This affects v2.57.0 up to but not including v2.60.0, and was fixed in v2.60.0; it is disclosed with this batch. Rotate MCP server credentials that were carried in the URL path.

⚠️ Compatibility Notes

• Call Anthropic's 20260209 web tools directly on the Anthropic API when citations are requested by @​dsfaccini in pydantic/pydantic-ai#12278
• Apply FunctionToolset(requires_approval=True) to Tool instances passed to the toolset by @​dsfaccini in pydantic/pydantic-ai#12378
• Re-resolve realtime session instructions before each model turn and deliver their changes as appends by @​DouweM in pydantic/pydantic-ai#11930
• Recognize SummarizingCompaction(keep_user_messages=True) copies only by the marker on their text by @​DouweM in pydantic/pydantic-ai#12316

🚀 Features

• Add OpenSandbox for self-hosted agent workspaces by @​adtyavrdhn in pydantic/pydantic-ai#11841
• Add Azure Durable Task durability to pydantic_ai_harness by @​DouweM in pydantic/pydantic-ai#11332
• Add Pixeltable tools and memory storage to Harness by @​pierrebrunelle in pydantic/pydantic-ai#9369
• Add RenderSandbox to run agent workspaces in Render sandboxes by @​ojusave in pydantic/pydantic-ai#10238
• Add include_instructions to the MCP capability so server instructions can be left out of the agent's instructions by @​DouweM in pydantic/pydantic-ai#12269
• Re-resolve realtime session instructions before each model turn and deliver their changes as appends by @​DouweM in pydantic/pydantic-ai#11930
• Report xAI Grok Voice speech timing as segment timestamps with output_speech_timestamps by @​DouweM in pydantic/pydantic-ai#11782
• Add a retries field to SummarizingCompaction by @​gouyu-hou in pydantic/pydantic-ai#12315
• Add Workspace.authority and AuthorityWorkspace for workspaces whose files the operator does not control by @​adtyavrdhn in pydantic/pydantic-ai#11836

🐛 Bug Fixes

• Stop ModalSandbox failing with AttributeError on Modal 1.6, which removed FilesystemExecutionError by @​adtyavrdhn in pydantic/pydantic-ai#12247
• Call Anthropic's 20260209 web tools directly on the Anthropic API when citations are requested by @​dsfaccini in pydantic/pydantic-ai#12278
• Add streaming support to CohereModel by @​Julien-ser in pydantic/pydantic-ai#6100
• Release run dependencies after exceptions by @​dsfaccini in pydantic/pydantic-ai#11255
• Preserve extra keys in tool_search and load_capability message history by @​pydanty in pydantic/pydantic-ai#7933
• Inline $defs in tool schemas for GLM-5.3 on Together, Nebius, Fireworks, Vercel, Ollama, Hugging Face, Cerebras, Mistral and OpenAI-compatible gateways by @​pydanty in pydantic/pydantic-ai#12138
• Keep RepoContext from following symlinks out of the working directory or to files that aren't instruction files by @​DouweM in pydantic/pydantic-ai#12044
• Reject approvals for tool calls a server-held history isn't waiting on under manage_message_history='server' by @​DouweM in pydantic/pydantic-ai#12313
• Apply FunctionToolset(requires_approval=True) to Tool instances passed to the toolset by @​dsfaccini in pydantic/pydantic-ai#12378
• Recognize SummarizingCompaction(keep_user_messages=True) copies only by the marker on their text by @​DouweM in pydantic/pydantic-ai#12316
• Keep on-demand capabilities loaded from code across SummarizingCompaction, SlidingWindowCompaction and RelevanceCompaction, recording every removed load again as a CapabilityLoadDeltaPart by @​DouweM in pydantic/pydantic-ai#12270
• Keep earlier tool-call turns byte-stable when a later response thinks in openai_chat_send_back_thinking_parts='field' mode by @​DouweM in pydantic/pydantic-ai#12309
• Keep a code-loaded capability's instructions across instruction windows by @​pydanty in pydantic/pydantic-ai#12304
• Write RepairToolArguments repairs back to the ToolCallPart in history by @​DouweM in pydantic/pydantic-ai#12319
• Take user constraints only from the user's messages in AnthropicModel.compact_messages()'s focus prompt by @​DouweM in pydantic/pydantic-ai#11915
• Floor the tiered escalation estimate at the surviving text so a cheap anchor cannot hide the rest of the chain by @​gouyu-hou in pydantic/pydantic-ai#12341
• Close SqliteStepStore and SqliteMediaStore connections whose WAL switch fails on a locked database by @​DouweM in pydantic/pydantic-ai#12147

... (truncated)

Commits

• 7d1d3f0 Keep tool-returned mappings as mappings across message history round trips (#...
• bc0b14f Ask again to enable a clai2 project plugin or project_hooks after the fil...
• 4d369ad Record the requests tests send in tests/refactor_capture.py, so a refactor ...
• ce4c9ae Bound the work of $ref inlining, decision-model fields, `MessagesBuilder.ad...
• 0413314 Attribute douwebot inline comments to the head they were made on in `PR Revie...
• c281f88 Fix a WarnOnCacheBusts test flake: record only the warnings its deprecation...
• 6414dcf Bring 22 pydantic_ai message-history functions under the cognitive complexi...
• 4946e2e Fix instrumented embedding spans missing the embeddings attribute when `inc...
• dcaf866 Add Workspace.authority and AuthorityWorkspace for workspaces whose files...
• 0301428 Close SqliteStepStore and SqliteMediaStore connections whose WAL switch f...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)