v2.9.1

pydantic/pydantic-aiv2.9.1Jul 14, 2026by dsfaccini

AI Summary

A patch release addressing critical security vulnerabilities and stability issues, including a ReDoS fix via `soupsieve` and improvements to timeout handling and model availability.

Key Highlights

Security fix: Bump `soupsieve` to 2.8.4 to fix ReDoS (CVE-2026-49477)
Fix typed composition members recursion in `JsonSchemaTransformer`
Fix timeout handling in `MistralModel._get_timeout_ms`
Restore Gateway-supported models by removing retired models from `KnownModelName`

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at main -->

## What's Changed
### 🐛 Bug Fixes
* Fix typed composition members recursion in `JsonSchemaTransformer` by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6440
* fix: handle int timeout values in `MistralModel._get_timeout_ms` by @Ricardo-M-L in https://github.com/pydantic/pydantic-ai/pull/5019
* Remove retired models from `KnownModelName` and restore Gateway-supported models by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/5843
### 📦 Dependencies
* fix(deps): bump soupsieve to 2.8.4 to fix ReDoS (CVE-2026-49477) by @hramezani in https://github.com/pydantic/pydantic-ai/pull/6442


**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v2.9.0...v2.9.1