v1.106.0

crewAIInc/crewAIv1.106.0Jun 5, 2026by dsfaccini

AI Summary

This release patches a security vulnerability in the VercelAIAdapter and adds new configuration options for xAI integration, along with fixes for streaming responses.

Key Highlights

Security advisory: Fixed confused-deputy file read vulnerability in VercelAIAdapter
Added xAI support with seed mapping and api_host/timeout options
Fixed incomplete streamed responses and data URI parsing crashes

New Features

Map base `seed` setting to xAI
Add `api_host` and `timeout` to `XaiProvider`

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at main -->

## What's Changed
### 🛡️ Security
* Handle `UploadedFile` consistently with `FileUrl` in UI adapters by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5772
	* Security advisory: `VercelAIAdapter` trusts client-controlled provider metadata to construct `UploadedFile` references (confused-deputy file read) https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w
	* You are affected **only** if your application passes untrusted client-submitted message history to an agent through a UI adapter (e.g. `VercelAIAdapter`), **AND** your model-provider or cloud-storage account holds files referenceable by an attacker-guessable `UploadedFile` id or storage URI (e.g. `s3://…`, `gs://…`).
	* You are **not** affected if you do not pass untrusted client-submitted message history to the agent, or you strip `UploadedFile` parts before running it.
	* You are **not** affected via `AGUIAdapter` / `Agent.to_ag_ui` on defaults — the `preserve_file_data` flag that re-enables this path is off by default.
### 🚀 Features
* Map base `seed` setting to xAI by @colesmcintosh in https://github.com/pydantic/pydantic-ai/pull/5741
* Add `api_host` and `timeout` to `XaiProvider` by @colesmcintosh in https://github.com/pydantic/pydantic-ai/pull/5742
### 🐛 Bug Fixes
* Fix incomplete streamed response when `event_stream_handler` doesn't consume the stream by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/5771
* fix(messages): from_data_uri crashes on a valid non-base64 data URI by @devteamaegis in https://github.com/pydantic/pydantic-ai/pull/5779

## New Contributors
* @lonelyhty made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5759
* @devteamaegis made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5779

**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.105.0...v1.106.0