v0.19.0

0.19.0 - 2026-10-09

Security

• invitations: BREAKING: Stop invitation links from claiming accounts other organizations hold (GHSA-9hhv-84wv-7cx2) by @daavoo (629b459). The invite response's accept_link is now null when mail_sent is true; the link reaches only the invitee's mailbox.

Bug Fixes

• responses: Drop echoed bridge reasoning ids and fall back to chat when /responses is missing in #2129 by @tbille (d4d60fa)
• Address review findings on the hot-path PR by @daavoo (95e8002)
• budgets: Give back the ceilings' holds when a failed commit did not land in #2016 by @daavoo (a931afe)
• responses: Resolve item_reference when serving Responses through chat completions in #2142 by @tbille (6cc40bb)
• pricing: Settle per-request charge lines at the rounded cost and fix CI in #2141 by @daavoo (5b3e67c)
• mail: Check an address's shape in linear time in #2159 by @daavoo (734263f)
• messages: Fail a stream that ends without message_stop in #2147 by @daavoo (16f7214)

Features

• any-search: Add the Exa search and contents adapters in #2126 by @aittalam (0b3a968)
• tools: Add search and fetch instances to the web tool settings in #2128 by @aittalam (118c3a7)
• pricing: Charge completion models priced per request a flat amount per call by @daavoo (7327642)

Other

• Potential fix for code scanning alert no. 1: Untrusted Checkout TOCTOU in #2122 by @peteski22 (4796ee1)

Performance

• docker: Compile bytecode when the image is built in #2121 by @daavoo (af9414b)
• database: Ping a pooled connection only after it sat idle by @daavoo (2e77ec5)
• api: Set the security headers from a pure ASGI middleware by @daavoo (c3877ab)
• usage: Write absorbed rows beside the next attempt, and harden the batch writer by @daavoo (5a3db2e)
• providers: Reuse a provider's client across requests by @daavoo (926e232)
• rate-limit: Count a request's rules concurrently, its own before the deployment's by @daavoo (215a93f)
• pricing: Price each model once per request by @daavoo (68cb163)
• budgets: Do less, and lock the shared ceiling for less time, per reservation by @daavoo (c6bdeb1)

Full Changelog: v0.18.0...v0.19.0