v2.28.0 (2026-08-11)

🛡️ Security

Fixes a high-severity vulnerability in the development web chat UI (Agent.to_web(), clai web): the chat endpoint didn't check the request's content type, so a plain cross-origin request from a website open in the developer's browser could reach the endpoint without a CORS preflight and trigger the served agent to run and execute its tools with the local process's privileges and credentials. The endpoint now requires Content-Type: application/json and rejects other requests before the body is parsed and before the agent runs. See GHSA-h4xc-3qfq-jf93. Patched in 2.28.0 (v2) and 1.107.3 (v1).

What's Changed

🚀 Features

• Add realtime speech-to-speech support with Agent.realtime() by @DouweM in #6324
• Add Crusoe provider by @acheamponge in #6457
• Add browser WebRTC + server sideband support for realtime speech-to-speech by @DouweM in #6676

🐛 Bug Fixes

• fix(bedrock): attach a leading CachePoint to the preceding user message instead of raising by @Diwak4r in #7071
• Test cancellation of concurrent PeekableAsyncStream pulls by @mikemikimike in #7023
• Settle in-flight state and report state_restored honestly on realtime reconnect by @DouweM in #7379
• Only accept JSON request bodies on the web UI chat endpoint by @DouweM in #7382
• Await callback results uniformly via a shared await_maybe helper by @DouweM in #7265
• Fix safe_download Host header dropping non-default port by @pydanty[bot] in #7348
• Serialize AG-UI dict tool-call deltas with Pydantic Core by @bferanmi806-sketch in #7221

📦 Dependencies

• Add the cerebras optional dependency group by @dsfaccini in #7387

New Contributors

• @Diwak4r made their first contribution in #7071
• @mikemikimike made their first contribution in #7023
• @acheamponge made their first contribution in #6457
• @bferanmi806-sketch made their first contribution in #7221

Full Changelog: v2.27.1...v2.28.0