v2.59.0

> This comment was posted by Codex Desktop using gpt-6.1-sol on behalf of David.

## What's Changed
### 🛡️ Security
* **High — HTML conversion in `web_fetch`:** [GHSA-4whf-38hw-pxxh](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4whf-38hw-pxxh). When `web_fetch_tool` fetched attacker-controlled HTML containing many elements, conversion could delay unrelated work in the same process. Fixed in v2.59.0 and v1.107.9. Upgrade if the tool can fetch such pages.

### ⚠️ Compatibility Notes
* Remove shut-down Groq models `playai-tts`, `playai-tts-arabic`, `meta-llama/llama-guard-4-12b` and `meta-llama/llama-4-maverick-17b-128e-instruct` by @mekanbaymyradov in https://github.com/pydantic/pydantic-ai/pull/10306
* Distinguish omitted provider usage from reported zero and add `UsageLimitUnavailableWarning` by @mpfaffenberger in https://github.com/pydantic/pydantic-ai/pull/9491
* Add `on_change='append'` to preserve dynamic instruction prefixes by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/8188
* Stop recording that a realtime session ended when a tool raised, and document that it goes on by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10782
* Record what the user heard of ElevenLabs Agents replies they barged in on, adding the `OutputItemCut` lifecycle event by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10739
* Append the next hour to `LogfireMCP` history instead of rewriting its instructions, keeping the prompt cache by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10543
* Settle a realtime reply only with the response that answers it, adding `AnswersRevised` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10668
* Add provider-neutral model error categories like `ModelRateLimitError`, `ModelUnavailableError`, `ModelServerError` and `ModelContextWindowExceededError`, and `ModelHTTPError.for_category` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/9354
* Frame `BackgroundTools` results as `<tool_result>` tool output instead of untagged user text by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10548
* Send `TrajectoryJudge` steering as a framework `SystemPromptPart` note plus the judge message as escaped `<judge_feedback>` data, both marked with `metadata` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10545
* Check `tool_calls_limit` before each `CodeMode` nested tool call by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/10362
* Let `GitHubCopilotProvider` send a configurable `copilot-integration-id` via `integration_id` or `GITHUB_COPILOT_INTEGRATION_ID` by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/10784
### 🚀 Features
* Add `DaytonaSandbox`: a workspace that runs `Coder`, `Shell`, `FileSystem` and every other harness capability in a Daytona sandbox by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/10610
* Add `ElevenLabsRealtimeModel` for Eleven Realtime speech-to-speech models by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10738
* Let `FunctionToolset.instructions` and instruction functions opt into `on_change='append'` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10788
* Give `FileSystem` tools registered tool kinds and typed call parts by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10674
* Add `non_retryable_model_errors` to `TemporalDurability` to stop Temporal retrying specific model error categories by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10803
### 🐛 Bug Fixes
* Keep a push-to-talk turn in realtime history when the session ends before the provider confirms its `commit_audio()` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10652
* Accept non-string `metadata` values from OpenAI-compatible chat completions by @dergachoff in https://github.com/pydantic/pydantic-ai/pull/8010
* Record a realtime barge-in's cut in history when `interrupt()` races a failed send, the reply's end, or a later cancel by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10723
* Apply an ElevenLabs Agents `agent_response_correction` only to the message it names by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10709
* Raise for `elevenlabs_agents_llm` and `elevenlabs_agents_tts` `model_id` overrides on ElevenLabs Agents in Realtime voice mode by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10728
* Match OpenAI Realtime audio-commit acknowledgements to the commit that caused them by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10722
* Move unsupported Bedrock array `contains` constraints into descriptions by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/10720
* Preserve boolean `$defs` semantics during schema transformation by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/10714
* Fix `DynamicWorkflow` revealed type names, nested tool exposure, and empty `WorkflowAgent` descriptions by @mpfaffenberger in https://github.com/pydantic/pydantic-ai/pull/10747
* Retry deeply nested `BackgroundTools` optional-tool args instead of raising `RecursionError` by @mpfaffenberger in https://github.com/pydantic/pydantic-ai/pull/10721
* Return the value of `BackgroundTools` tools that code mode's `run_code` calls, instead of a started message by @mpfaffenberger in https://github.com/pydantic/pydantic-ai/pull/10750
* Schedule a tool once when `BackgroundTools` instances with distinct ids select it by @mpfaffenberger in https://github.com/pydantic/pydantic-ai/pull/10757
* Treat `auth=''` as unset alongside `client` in `DayAI` and warn about tokens in Temporal history by @mpfaffenberger in https://github.com/pydantic/pydantic-ai/pull/10718
* End an `on_change='append'` window that opened without blocks when a hook unsets `instruction_parts` by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10766
* Recognize Bedrock inference profile and foundation model ARNs in `split_bedrock_model_id`, so they get the same model capabilities as the bare ID by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10664
* Render carried thinking as a bare `<assistant_thinking>` tag so UI round trips keep the prompt cache by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10642
* Mark `CodeMode` discovery announcements with `SystemPromptPart.metadata`, and announce a tool again when its announcement was dropped by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10666
* Escape the `SummarizingCompaction` summarizer transcript so tool output can't forge messages by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10544
* Deliver tool-tied `'asap'` enqueue content into the same `ModelRequest` as the tool's `ToolReturnPart` by @divyankmalik in https://github.com/pydantic/pydantic-ai/pull/7043
* Keep typed `const` constraints, such as `Literal` discriminators, in Anthropic strict schemas by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10675
* Use `<context_diff>` instead of `<context-diff>` for instruction deltas by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10790
* Add the `ToolCallsAbandoned` realtime lifecycle event, so an abandoned tool call no longer holds its exchange open by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10793
* Add `grok-4.7` to xAI known models and Grok reasoning profile by [@pydanty[bot]](https://github.com/apps/pydanty) in https://github.com/pydantic/pydantic-ai/pull/9750
* Let `DeduplicateFileReads` and `ClearToolResults` clear typed `read_file` results again by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10839
* Tie `TrajectoryJudge`'s steering note to its own frame with a `ref`, so forged `<judge_feedback>` tags get no authority by @DouweM in https://github.com/pydantic/pydantic-ai/pull/10869

## New Contributors
* @mekanbaymyradov made their first contribution in https://github.com/pydantic/pydantic-ai/pull/10306
* @dergachoff made their first contribution in https://github.com/pydantic/pydantic-ai/pull/8010
* @divyankmalik made their first contribution in https://github.com/pydantic/pydantic-ai/pull/7043

**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v2.58.0...v2.59.0