P
CLAI2 bleeding
Sdists rebuilt from main for /update on the CLAI bleeding channel. Not a release.
P
v1.107.10 (2026-11-04)
What's Changed 🛡️ Security GHSA-m5vj-8mcw-82qx (high): web_fetch_tool and the WebFetch capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected…
P
v2.66.0 (2026-11-04)
What's Changed 🛡️ Security GHSA-m5vj-8mcw-82qx (high): web_fetch_tool and the WebFetch capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected…
P
v2.65.0 (2026-11-02)
What's Changed ⚠️ Compatibility Notes Protect the gh-aw canonical session capture from agent tools by @dsfaccini in #10606 Add multimodal notes to AskUserAnswer by @dsfaccini in #11664 Count BrowserUse model calls toward the host run's usage and UsageLimits by @mpfaffenberger in #11860 Name the V2 replacement when code imports a name V2 removed, like OpenAIModel or MCPServerStdio by @DouweM in #12…
P
v2.64.0 (2026-10-30)
What's Changed ⚠️ Compatibility Notes Raise an error status a retrying transport gave up on as ModelHTTPError, so fallback moves on by @DouweM in #11934 Send stored response, item, conversation and container IDs back only to the endpoint that created them, via Model.accepts_server_state by @DouweM in #11774 Make json-repair an optional dependency, needed only by Coder and RepairToolArguments by @m…
P
v2.63.0 (2026-10-27)
What's Changed ⚠️ Compatibility Notes Default CodeMode to dynamic_catalog=True, so a revealed tool is appended instead of rewriting the cached prompt by @DouweM in #11358 Pass the Gemini Live reconnect replay to GoogleRealtimeConnection's dial as a keyword-only replay argument by @DouweM in #11515 Give Harness LLMReminder a default interval=10 instead of generating on every request by @DouweM in #…
P
v2.62.0 (2026-10-26)
What's Changed ⚠️ Compatibility Notes Change thinking effort mid-conversation via OpenAI configuration_update and Anthropic per-message output_config, recorded as ModelSettingsDeltaPart by @DouweM in #11111 Add ModelRequestRejectedError, ModelAuthenticationError and ModelNotFoundError model error categories by @DouweM in #11081 State loaded deferred capabilities' instructions in the system voice,…
P
v2.61.0 (2026-10-23)
What's Changed ⚠️ Compatibility Notes Warn when a provider-specific thinking setting from a broader scope overrides thinking by @dsfaccini in #10231 Send the least thinking a model accepts for thinking=False on models that can't turn thinking off by @DouweM in #11036 Raise NotImplementedError for a file in a CohereModel tool return instead of dropping it by @dsfaccini in #11114 Keep concurrent wor…
P
v2.60.0 (2026-10-22)
What's Changed ⚠️ Compatibility Notes Raise model error categories like ModelRateLimitError from embedding models by @DouweM in #10804 Add usage_limits, deadline, run_id and conversation_id to ModelSelectionContext by @DouweM in #10856 Default BedrockConverseModel's maxTokens to Claude's maximum output, streaming such requests behind the scenes by @DouweM in #10845 Deprecate RetryPromptPart in fav…
P
v1.107.9 (2026-10-20)
This comment was posted by Codex Desktop using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security High — HTML conversion in web_fetch: GHSA-4whf-38hw-pxxh. When web_fetch_tool fetched attacker-controlled HTML containing many elements, conversion could delay unrelated work in the same process. Fixed in v2.59.0 and v1.107.9. Upgrade if the tool can fetch such pages. Full Changelog: v1.107.8.…
P
v2.59.0 (2026-10-20)
This comment was posted by Codex Desktop using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security High — HTML conversion in web_fetch: GHSA-4whf-38hw-pxxh. When web_fetch_tool fetched attacker-controlled HTML containing many elements, conversion could delay unrelated work in the same process. Fixed in v2.59.0 and v1.107.9. Upgrade if the tool can fetch such pages. ⚠️ Compatibility Notes Re…
P
v1.107.8 (2026-10-19)
This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security Medium — MCP request telemetry: GHSA-xv4x-g8mx-ch56. Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False. URL-based MCP capabilities could also expose a credential embedded in the…
P
v2.58.0 (2026-10-19)
This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security Medium — MCP request telemetry: GHSA-xv4x-g8mx-ch56. Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False. URL-based MCP capabilities could also expose a credential embedded in the…
P
v2.57.0 (2026-10-15)
What's Changed ⚠️ Compatibility Notes Attach namespaced origin and tool_call_id metadata to BackgroundTools completions by @michaeldunn9 in #10196 Take GPT-Live realtime history, usage, and reply waits from the session core by @DouweM in #10083 Honour disable-model-invocation and user-invocable in Skills, and skip stray skill library paths by @DouweM in #10378 Take Gemini Live realtime history, us…
P
v2.56.0 (2026-10-13)
What's Changed ⚠️ Compatibility Notes Run BrowserUse on the host model by default and make browser-use telemetry opt-in by @mpfaffenberger in #9506 🚀 Features Let Skills layer project and personal libraries, name each skill's directory, and render a skill for a host command by @DouweM in #9802 Add base_url argument to ZaiProvider by @aisk in #10099 Adds PGTaskDurability based on pgtask by @adtyavr…
P
v2.53.0 (2026-10-01)
🛡️ Security This release fixes one security issue in ConcurrencyLimitedModel. See the advisory for full details and affected versions. GHSA-6fqq-452j-qhrp (high): a streamed request through ConcurrencyLimitedModel or limit_model_concurrency could keep its concurrency slot when the slot was released on a different task than the one that acquired it: after an early exit (the consumer stopped iterati…
P
v2.52.0 (2026-09-29)
🛡️ Security This release fixes one security issue in web_fetch. See the advisory for full details and affected versions. GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @SounLabs. (#8984) Patched in 2.52.0 (v2) and 1.107.7 (v1…
P
v2.54.0 (2026-10-02)
What's Changed ⚠️ Compatibility Notes Handle draft-7 list-form items in JsonSchemaTransformer, TestModel and Mistral streamed output, and make TestModel accept boolean subschemas and cap prefixItems at maxItems by @dsfaccini in #9560 Fix ImageGeneration under FallbackModel and dataclasses.replace, and compare Embedder by identity by @dsfaccini in #9477 Refuse a second durable execution engine on a…
P
v2.55.0 (2026-10-09)
What's Changed ⚠️ Compatibility Notes Require Python 3.11 or newer in every package; Python 3.10 installs resolve to 2.54.0 and earlier by @Kludex in #9526 Record the tool requests of ExaSearch, YouSearch, LocalStack and other harness capabilities under durable execution by @DouweM in #9705 Bound retained realtime audio like retained images with retain_audio_max_seconds by @DouweM in #9702 Prefix…
P
v1.107.7 (2026-09-29)
🛡️ Security A maintenance release for the v1 line, carrying the v1 backport of the security fix released in 2.52.0. See the advisory for full details and affected versions. GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @Soun…
P
v2.51.0 (2026-09-25)
What's Changed ⚠️ Compatibility Notes Match dated gemini-3.8-live ids, reject google_affective_dialog on Gemini 3.1 Flash Live and 3.8 Live at connect, and raise RealtimeError for Gemini Live close codes by @DouweM in #8761 Raise a UserError for a realtime tool_choice that forces a tool call on OpenAI, Azure OpenAI, and xAI by @DouweM in #8755 🚀 Features Add OpenAI GPT-Live support with OpenAILive…
P
v2.50.0 (2026-09-24)
What's Changed ⚠️ Compatibility Notes Ask a DecisionModel which route to take by name, with one label per route by @DouweM in #8733 Make ModelSelectionContext.messages end with the request being routed, and add ModelSelectionContext.prompt by @DouweM in #8737 Replace the decision model's tool-call lean with an opt-in decision_route_threshold by @DouweM in #8739 🚀 Features Expose OpenAI service_tie…
P
v2.49.0 (2026-09-23)
What's Changed 🚀 Features Add GitHubCopilotOAuthFlow for device authorization by @Kludex in #8618 Add BoolCriteria to say what a bool field's yes and no mean, and let a True/False Enum do the same by @DouweM in #8586 Use what the user wrote about None as the "none of these" option in TypeSafeModel by @DouweM in #8684 Offer whole numbers that are not a rubric as a Choice in TypeSafeModel by @DouweM…
P
v2.48.0 (2026-09-22)
What's Changed 🚀 Features Support genai-prices 0.1.7 and new OpenAI audio models by @adtyavrdhn in #8617 Add OpenAI gpt-6-sol and gpt-6-luna model support by @DouweM in #8635 Add Claude Opus 5.5 (claude-opus-5-5) support by @DouweM in #8637 🐛 Bug Fixes Preserve UIMessage.id across Vercel AI load_messages and dump_messages by @adtyavrdhn in #8623 Preserve AG-UI Message.id across AGUIAdapter.load_me…
P
v2.47.0 (2026-09-21)
What's Changed ⚠️ Compatibility Notes Name a None output route None rather than NoneType by @DouweM in #8590 Raise when UserPromptPart.content is not a str or a sequence, instead of silently sending a dict's keys by @DouweM in #8595 🚀 Features Ask three more field types TypeSafeModel can already answer by @DouweM in #8544 🐛 Bug Fixes Refuse a tuple output field and a self-contained model instead o…
P
v2.46.0 (2026-09-18)
What's Changed 🚀 Features Let TypeSafeModel fill a tool's arguments when Jev can express them by @DouweM in #8501 Add RealtimeSession.wait_for_playback() and let the docs examples finish the reply before closing by @DouweM in #8141 Add supports_text_output to ModelProfile, and run LLMJudge and GEval on a model without it by @DouweM in #8480 Add typesafe_boolean_threshold for what a yes/no has to b…
P
v2.45.0 (2026-09-17)
What's Changed 🚀 Features Add TypeSafeModel for TypeSafe's Jev by @adtyavrdhn in #8450 🐛 Bug Fixes Pass xhigh effort through on Bedrock when the model profile supports it by @willfrey in #8392 Allow gpt-5.6-sol, gpt-5.6-luna, and gpt-5.6-terra on Bedrock Converse by @pydanty in #7825 Resolve a DynamicToolset once per durable run instead of inside every durable unit by @DouweM in #8455 Hold one MCP…
P
v2.44.0 (2026-09-16)
🛡️ Security This release fixes four security issues, all of them reached through web_fetch_tool or OpenTelemetry instrumentation. See each advisory for full details and affected versions. GHSA-vmxc-h2x2-jmf3 (moderate): the cloud-metadata and private-IP blocklists could be bypassed with an IPv6 zone identifier on a URL opted into local network access, via FileUrl(force_download='allow-local') or w…
P
v1.107.6 (2026-09-16)
🛡️ Security A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in 2.44.0. See each advisory for full details and affected versions. GHSA-vmxc-h2x2-jmf3 (moderate): cloud-metadata and private-IP blocklist bypass via an IPv6 zone identifier, on a URL opted into local network access. Reported by @euriconicacio. (#8402) GHSA-fpf4-vwcp-v4hp (moderate):…
P
v2.43.0 (2026-09-11)
What's Changed 🚀 Features Add a first-run banner describing the run, and open clai sessions with it by @DouweM in #7447 🐛 Bug Fixes Preserve text part boundaries after tool calls in OpenAIChatModel by @KaranJayakumar in #8235 fix(temporal): key tool opt-out checks on operation kind, not an MCP import by @adtyavrdhn in #8257 New Contributors @KaranJayakumar made their first contribution in #8235 Fu…