Starstruk Logo MarkStarstruk

v2.30.0

pydantic/pydantic-aiv2.30.0Aug 14, 2026by dsfaccini

AI Summary

Includes a security fix for Host header validation and introduces new models, web search capabilities, and configuration options.

Key Highlights

  • Fix for Host header validation vulnerability (GHSA-q2xc-rrxj-58x9)
  • New `allowed_hosts` setting for web UI
  • Support for OpenRouter web search
  • New model: `gemini-3.7-flash`
  • Expose gRPC `metadata` on `XaiProvider`

New Features

  • Use `openrouter:web_search` for web search
  • Add `gemini-3.7-flash` model
  • Expose gRPC `metadata` on `XaiProvider`
  • Add `allowed_hosts` to `Agent.to_web()`

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at main -->

## What's Changed
### 🛡️ Security
* [GHSA-q2xc-rrxj-58x9](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9): the local dev web chat UI (`Agent.to_web()`, `clai web`) didn't validate the `Host` header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in `pydantic-ai`/`pydantic-ai-slim` 2.30.0 by validating `Host` against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new `allowed_hosts` setting.
### 🚀 Features
* Use `openrouter:web_search` for web search by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7378
* Add `gemini-3.7-flash` model by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7445
* Expose gRPC `metadata` on `XaiProvider` by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7423
* Add `allowed_hosts` to `Agent.to_web()` and `clai web` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7437
### 🐛 Bug Fixes
* Resolve deferred `openai` resource imports and genai-prices data loading at `Model` construction time by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/7408
* Fall back to ASCII in `EvaluationReport.print()` on non-UTF-8 consoles by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7290
* Lowercase model name before profile lookup in SambaNova, Heroku, and Fireworks providers by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6818
* Update LatestCerebrasModelNames to current model catalog by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6838
* Require a deferred tool to be revealed, and its capability loaded, before it can be called by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7271
* Anchor the tool-callability evidence window to the response's serving provider by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7442


**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v2.29.0...v2.30.0