v2.27.1

Fosowl/agenticSeekv2.27.1Aug 11, 2026by dsfaccini

AI Summary

This release fixes an information disclosure vulnerability regarding retry prompt content not being redacted, alongside various bug fixes for tool spans, streaming responses, and web UI hosting.

Key Highlights

Fixes information disclosure vulnerability (GHSA-3gh4-cghq-f8v4) for non-tool-retry prompts
Restore tool spans for failed argument validation
Fix XaiStreamedResponse finish_reason mapping for streaming responses

Full Release Notes

### 🛡️ Security

This release fixed an information-disclosure issue: retry-prompt content (validation feedback sent back to the model, which can quote invalid values from its output) was not redacted by `InstrumentationSettings(include_content=False)` when the retry was not tied to a tool call. Now disclosed as [GHSA-3gh4-cghq-f8v4](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4) (low). Fixed here in `2.27.1` ([#7357](https://github.com/pydantic/pydantic-ai/pull/7357)); v1 users should upgrade to `1.107.4` or later.

<!-- Release notes generated using configuration in .github/release.yml at main -->

## What's Changed
### 🐛 Bug Fixes
* Restore tool spans for failed argument validation by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/6601
* Fix `XaiStreamedResponse` finish_reason mapping for streaming responses by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6814
* Point offline web UI hosting at the self-contained chat UI build by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7349
* Allow adaptive thinking with Tool Output and forced tool choice on Anthropic by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7200
* Gate `RetryPromptPart` OpenTelemetry content on `include_content` by @sean-kim05 in https://github.com/pydantic/pydantic-ai/pull/7357


**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v2.27.0...v2.27.1