Starstruk Logo MarkStarstruk

v1.106.0

dforwardfeed/memo_generatorv1.106.0Jun 5, 2026by dsfaccini

AI Summary

This release focuses on security improvements for file handling and adds configuration options for xAI providers, alongside various bug fixes for streaming and data URI parsing.

Key Highlights

  • Security fix for confused-deputy file read vulnerability
  • New `api_host` and `timeout` options for `XaiProvider`
  • Support for mapping base `seed` to xAI
  • Bug fix for incomplete streamed responses
  • Bug fix for `from_data_uri` crashes

New Features

  • New `api_host` and `timeout` options for `XaiProvider`
  • Support for mapping base `seed` to xAI

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at main -->

## What's Changed
### 🛡️ Security
* Handle `UploadedFile` consistently with `FileUrl` in UI adapters by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5772
	* Security advisory: `VercelAIAdapter` trusts client-controlled provider metadata to construct `UploadedFile` references (confused-deputy file read) https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w
	* You are affected **only** if your application passes untrusted client-submitted message history to an agent through a UI adapter (e.g. `VercelAIAdapter`), **AND** your model-provider or cloud-storage account holds files referenceable by an attacker-guessable `UploadedFile` id or storage URI (e.g. `s3://…`, `gs://…`).
	* You are **not** affected if you do not pass untrusted client-submitted message history to the agent, or you strip `UploadedFile` parts before running it.
	* You are **not** affected via `AGUIAdapter` / `Agent.to_ag_ui` on defaults — the `preserve_file_data` flag that re-enables this path is off by default.
### 🚀 Features
* Map base `seed` setting to xAI by @colesmcintosh in https://github.com/pydantic/pydantic-ai/pull/5741
* Add `api_host` and `timeout` to `XaiProvider` by @colesmcintosh in https://github.com/pydantic/pydantic-ai/pull/5742
### 🐛 Bug Fixes
* Fix incomplete streamed response when `event_stream_handler` doesn't consume the stream by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/5771
* fix(messages): from_data_uri crashes on a valid non-base64 data URI by @devteamaegis in https://github.com/pydantic/pydantic-ai/pull/5779

## New Contributors
* @lonelyhty made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5759
* @devteamaegis made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5779

**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.105.0...v1.106.0