v2.9.0 (2026-07-10)

What's Changed

🛡️ Security

A moderate advisory, GHSA-jpr8-2v3g-wgf9 (CWE-863), affecting the AG-UI UIAdapter.sanitize_messages dangling-tool-call strip, was fixed in 2.5.0 and backported to 1.107.1 on the v1 line. If you are on 2.5.0 or later you already have the fix; this note calls it out now that the advisory is public.

• Affected: pydantic-ai / pydantic-ai-slim >= 2.0.0, < 2.5.0 (v2) and >= 1.88.0, < 1.107.1 (v1)
• Patched: 2.5.0 (v2) and 1.107.1 (v1)
• Not affected if every sensitive tool uses requires_approval=True / ApprovalRequiredToolset, or if your tool handlers validate their arguments and enforce authorization themselves.

🚀 Features

• Add /usage slash command to clai CLI for cumulative token usage by @adtyavrdhn in #6245
• feat(openai): add GPT-5.6 models and reasoning mode by @Wh1isper in #6414
• feat(RunContext): expose the run's usage_limits to tools and capabilities by @DouweM in #6341

🐛 Bug Fixes

• Auto-enable Anthropic Files API beta when messages contain UploadedFile by @gaurav0107 in #5815
• Fix repr() crash on message parts whose field != returns a non-bool (#6415) by @hramezani in #6421
• fix: mark non-crypto hashes with usedforsecurity=False (FIPS precaution) by @stef41 in #5053
• Guard against id-less MCPToolset on the DBOSAgent wrapper path by @dsfaccini in #6406
• fix: make nested capture_run_messages capture correctly (#1568) by @DouweM in #6345
• Fix cancellation deadlock when a wrapped model request or agent run survives cancellation by @0ywfe in #6426
• Honor end_strategy='early' for NativeOutput, PromptedOutput, and image output by @DouweM in #6427

New Contributors

• @stef41 made their first contribution in #5053
• @0ywfe made their first contribution in #6426

Full Changelog: v2.8.0...v2.9.0