Skip to content

chore(deps): update pydantic-ai-slim requirement from <2,>=1.107.5 to >=1.107.7,<2 - #2428

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pydantic-ai-slim-gte-1.107.7-and-lt-2
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pydantic-ai-slim-gte-1.107.7-and-lt-2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on pydantic-ai-slim to permit the latest version.

Release notes

Sourced from pydantic-ai-slim's releases.

v1.107.7 (2026-09-29)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backport of the security fix released in 2.52.0. See the advisory for full details and affected versions.

  • GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @​SounLabs. (#8985)

Patched in 1.107.7; also patched on the v2 line in 2.52.0.

What's Changed

🐛 Bug Fixes

Full Changelog: pydantic/pydantic-ai@v1.107.6...v1.107.7

Changelog

Sourced from pydantic-ai-slim's changelog.


description: "Pydantic AI upgrade guide and changelog: the breaking changes in each release, how to install V2, and the recommended path to migrate your code from V1."

Upgrade Guide

In September 2025, Pydantic AI reached V1 and committed to API stability: no changes that break your code until V2. V2 is now available, collecting the breaking and behavior changes that stability guarantee didn't allow. This guide is the canonical place to learn what's in V2, how to install it, and how to upgrade; for the guarantees behind these version numbers, see the Version Policy.

Breaking Changes

Here's a filtered list of the breaking changes for each version to help you upgrade Pydantic AI.

v2.0.0 (2026-06-23)

The stable V2.0 release. There are no new breaking or behavior changes since the betas; the full breaking-change list and recommended upgrade path are in the v2.0.0b1 entry below. Install it with:

uv add pydantic-ai

v2.0.0b7 (2026-06-10)

The seventh V2 beta, forked from v1.107.0. There are no new V2 breaking or behavior changes since v2.0.0b6 below — everything in that entry applies unchanged — but this beta picks up the latest V1 release on top, which adds Claude Fable 5 / Mythos 5 model support and OpenRouter prompt caching (CachePoint), plus known_model_names() and Anthropic fixes; see the v1.107.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b7"

For the full breaking-change list and the recommended upgrade path, see the v2.0.0b1 entry below; the only difference is that the latest V1 to upgrade through first is now v1.107.0.

v2.0.0b6 (2026-06-04)

The sixth V2 beta, forked from v1.106.0. There are no new V2 breaking or behavior changes since v2.0.0b5 below — everything in that entry applies unchanged — but this beta picks up the latest V1 release on top, which adds api_host/timeout configuration and base seed mapping for the xAI provider, plus streaming and data-URI handling fixes; see the v1.106.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b6"

For the full breaking-change list and the recommended upgrade path, see the v2.0.0b1 entry below; the only difference is that the latest V1 to upgrade through first is now v1.106.0.

v2.0.0b5 (2026-06-02)

The fifth V2 beta, forked from v1.105.0. There are no new V2 breaking or behavior changes since v2.0.0b4 below — everything in that entry (including the prepare-callbacks change) still applies — but this beta picks up the latest V1 release on top, which adds on-demand (deferred-loading) capabilities and Grok 4.3 reasoning_effort support, plus GoogleModelSettings.google_cached_content and Temporal gateway/ fixes; see the v1.105.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

... (truncated)

Commits
  • 2fd3879 Backport bounded web_fetch HTML conversion to v1 (#8985)
  • ff899b4 Cap genai-prices below 0.1 to keep token usage extraction and limits workin...
  • 6022411 Remove stale harness-compat.yml from v1 (#9074)
  • 7ee27e3 Close two include_content redaction bypasses and make the content sweep pro...
  • 2faa618 Decode web_fetch response bodies in a worker thread and treat non-text char...
  • 6b22270 Check include_content=False over every content channel at once (v1 backport...
  • a9dab92 Compare web_fetch_tool domain lists in the form the resolver uses (v1 backp...
  • a93ea52 Extract the web_fetch page title with a linear scan and convert HTML in lin...
  • 963dec5 Share exception recording between the agent run, tool and model request spans...
  • 84d67aa Pin FastA2A below 1 in the a2a extra (v1) (#8412)
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
pydantic-ai-slim [>= 2.dev0, < 3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [pydantic-ai-slim](https://github.com/pydantic/pydantic-ai) to permit the latest version.
- [Release notes](https://github.com/pydantic/pydantic-ai/releases)
- [Changelog](https://github.com/pydantic/pydantic-ai/blob/main/docs/changelog.md)
- [Commits](pydantic/pydantic-ai@v1.107.5...v1.107.7)

---
updated-dependencies:
- dependency-name: pydantic-ai-slim
  dependency-version: 1.107.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 9, 2026
@claude

claude Bot commented Oct 9, 2026

Copy link
Copy Markdown

Review: one-line dependabot bump of the pydantic-ai-slim floor from 1.107.5 to 1.107.7, still capped at <2.

  • It's a patch release in the v1 line. It carries the backport of GHSA-v36g-jcw9-x7cw (a moderate-severity issue in the local web_fetch tool). We don't appear to use that tool, but raising the floor is still sensible.
  • The upper bound is unchanged, so the issue Wrap PydanticAIAgent construction to fail loud on system_prompt regression #1451 constraint is respected.
  • CLAUDE.md pitfall Bump pytz from 2021.3 to 2022.5 #17 (the import-time dataclass-shape assertion in history_processors.py) is the main risk for any pydantic-ai bump. A patch release is unlikely to trigger it, so CI passing is the check.
  • I didn't find a changelog fragment under changelog.d/. Dependency bumps are probably exempt, but a .changed.md or .security.md fragment would be reasonable if you want one.

I haven't run anything. LGTM once CI is green.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants