Posts in the AI Framework Changelog series
Mastra 1.59.0 highlights: (1) CostGuardProcessor renamed and upgraded to TokenCostControl, now supporting user/organization/session tiered budgets with warnAtPercent alerts; (2) Breaking: Factory's autoRunEnabled now defaults to false — rule-suggested executions enter a proposed state pending approval; (3) New listActiveThreadRuns() for low-cost querying of in-progress runs, enabling status-polling UIs.
AG2 v1.0.2 highlights: (1) AG2 agents can now be exposed as ACP agents, serving remote clients over HTTP/WebSocket; (2) A2A agent cards switch from plaintext to signed-and-verified, plus gRPC TLS transport; (3) LiveAgent adds ElevenLabs as a voice provider, and community extensions (Tenki sandbox, TealTiger governance middleware) land for the first time. No breaking changes.
Mastra 1.60.0 highlights: (1) Stored Agents gain durable: true for durable execution without redeployment, inheriting the server's cache/pubsub for multi-replica persistence; (2) new @mastra/cloudflare-sandbox provider executes commands and file operations through a deployed Sandbox Bridge Worker; (3) @mastra/mcp supports the stateless 2026-07-28 MCP protocol revision and multi-turn elicitation. No breaking changes.
CrewAI 1.15.17 highlights: (1) declarative Flow definitions can now enable conversational mode — the framework auto-synthesizes built-in conversation methods, no Python `Flow` subclass required; (2) conversational mode is explicitly marked as opt-in to reduce misuse risk; (3) fixes for AMP slug loss during slug-reference tool resolution and chunking of oversized single messages. No breaking changes.
Agno 3.0 in three points: (1) Runs table restructuring — runs move from session JSON blobs into a dedicated agno_runs table, reducing write amplification from O(N²) to O(N); you must run MigrationManager before upgrading or you'll hit MigrationRequiredError; (2) New Tool Result Offloading and Media Offloading — tool results over 16,000 characters and images/audio/video get moved to AgentFS or S3, leaving only a slim envelope in messages; (3) Breaking changes are extensive — multiple Agent parameter renames, reasoning=True removed, DuckDuckGoTools methods renamed, etc. This is an upgrade that requires going through the migration guide item by item.
Haystack 3.1.0 highlights: (1) Experimental `CompactionHook` with `SlidingWindowCompactor` (drop old turns) and `ToolResultPruningCompactor` (replace old tool results with placeholders) for managing context blowup in long conversations; (2) `AgentTool` lets you wrap a full Agent as another Agent's tool — the caller sees only the final reply, not intermediate steps; (3) Multiple pipeline deserialization and Jinja sandbox RCE vulnerabilities patched, plus several behavioral changes requiring migration (e.g. `Agent.state_schema` semantics changed, `custom_filters` now requires `unsafe=True`).
Mastra @mastra/core@1.62.0 has three highlights: (1) new Computer-Use Sandboxes let agents drive a virtual desktop through the Daytona or E2B Desktop providers — 11 tools for screenshots, clicks, typing, and scrolling; (2) new `@mastra/elasticsearch` and `@mastra/valkey`/`@mastra/valkey-streams` storage backends widen production storage options; (3) 7 breaking changes, including dropped Cloudflare KV/ClickHouse support for background task storage, a changed `DaytonaSandbox` command result format, and the removed `persistPartialOnAbort` option on `agent.stream()`.
CrewAI 1.15.18 highlights: (1) conversational Flow is officially promoted from crewai.experimental to a stable API — the canonical implementation moves to crewai.flow, while crewai.experimental.conversational stays importable as a compatibility alias, so existing code doesn't break; (2) the shim currently emits no deprecation warning, so migrating is entirely opt-in for now; (3) also fixes a wrong Claude Sonnet 4.6 context-window mapping and a too-low Anthropic max_tokens default for large tool calls. No breaking changes.
Mastra @mastra/core@1.63.0 in three points: (1) a new `AdaptableLogger` contract writes trace_id/span_id straight into native log records, replacing the old dual-write wrapper — `PinoLogger` in `@mastra/loggers` is the first to support it; (2) `@mastra/deployer` adds a standalone worker entry with a `/health` endpoint (503 while starting, 200 once ready) so deployment platforms can judge whether a rollout is safe; (3) breaking change: `@mastra/playground-ui`'s DataList drops `variant="lined"`/`flushLeft`/`flushRight`/`MonoCell` in favor of `DataList.TextCell font="mono"`.
Pydantic AI 2.36.0 highlights: (1) new `@durable_operation` decorator turns any custom capability method into a replay-safe durable unit under Temporal/Prefect/DBOS and other engines; (2) a public backend API (`BaseDurabilityCapability`, `CallableOperationBackend`, `RegisteredOperationBackend`) lets third-party durable engines integrate with zero private imports — verified against three out-of-tree engines; (3) one compatibility tightening: MCP tools can no longer opt out of durable execution via tool metadata (previously allowed on DBOS), plus a Prefect dynamic-tool cache-key fix.
Agno 3.0.2 highlights: (1) Agents/Teams/Workflows/Toolkits can now be published directly as individually named MCP tools via MCPConfig.tools or component.as_tool(), instead of wrapping everything in run_agent(agent_id=...); (2) three behavior changes that don't bump the major version but will bite you: metadata resolution order flips (call-site now wins over component), MCPConfig rejects unknown fields at construction, and BaseRemote.acancel_run gains a required auth_token parameter; (3) four new integrations — Synthorai model provider, WaveSpeed image/video generation, Serply search, and AtomicMail inbox — plus a naming cleanup around mcp=/MCPConfig/default_tools (old names stay as aliases until 3.1).
Agno 3.0.5 highlights: (1) Knowledge ingestion no longer swallows embedding failures — a new partial status sits between completed and failed, and embedders raise EmbeddingError instead of returning an empty vector; (2) Breaking: code catching ModelProviderError around Bedrock embedding failures stops working — switch to EmbeddingError — and the content status API returns 404 for missing content again; (3) adds an opt-in embedding retry, a GandrTools text-to-speech toolkit, an llmman model provider, and an embed_before_replace guard that stops a failed re-ingest from wiping existing data.
Pydantic AI 2.38.0 highlights: (1) new typed `CustomEvent`/`CapabilityEvent` — application code and capabilities can now emit custom events into the Agent's run event stream and subscribe with `@on_event`, filling in a general-purpose observability and extension layer; (2) `RunContext` gains `context_window_used` and `ModelProfile` gains `context_window`, so agent code can read how much of the model's context window remains, for the first time; (3) new model support for `gemini-3.8-flash`, Claude Fable 5.1, and Claude Mythos 5.1, plus a new `VLLMProvider`. No breaking changes in this release.
Mastra @mastra/core@1.64.0 highlights: (1) a new reusable sandbox template (`@mastra/platform-workspace` plus `@mastra/e2b`) lets sandboxes start from a pre-cloned, pre-built repo image, cutting cold-start time for code sessions and workspace-backed agents; (2) `MastraSandboxOptions.workingDirectory` unifies default working-directory behavior across every sandbox provider (Docker, E2B, Vercel, Railway, etc.); (3) breaking: `@mastra/factory`'s `sandbox` config changes from an options object to a callback, and `@mastra/playground-ui` removes `Chip`/`ChipsGroup`/`StatusBadge` in favor of `Badge`.
Agno 3.0.6 highlights: (1) `MCPConfig(stateless=True)` serves `/mcp` without session tracking so any replica can answer any request, removing the need for session affinity in multi-instance deployments (at the cost of server-initiated notifications and SSE resumability); (2) `MCPTools(protocol_mode="auto")` negotiates the newest MCP protocol era both sides support, including the sessionless capability from the 2026-07-28 spec, while the default `"legacy"` mode keeps today's behavior unchanged; (3) adds an AgentOS MCP Server Card (`GET /mcp/server-card`), `.zip`/`.eml` file uploads, `AuthorizationConfig.excluded_route_paths`, and fixes for Anthropic thinking-block replay, Gemini image MIME types, and more. No breaking changes in this release.
Pydantic AI v2.40.0 highlights: (1) @agent.on_event decorator gives Agents native event listening; (2) realtime voice sessions now handle barge-in natively; (3) RealtimeSession.enqueue() lets external code inject out-of-band prompts. No breaking changes.
Mastra @mastra/core@1.65.0 highlights: (1) a new advanced trace query contract implemented across ClickHouse, DuckDB, and Postgres, with bounded time ranges, recursive predicates, and cursor pagination; (2) tenant-scoped batch deletion (up to 1,000 traces per request) that cascades to spans/scores/feedback/metrics/logs; (3) breaking: `@mastra/factory`'s `defineBoard()` becomes a typed phase contract, the global rules object is removed, and two `@mastra/playground-ui` components got renamed slots/props.
Pydantic AI v2.42.0 highlights: (1) a new `GitHubCopilotProvider` lets Agents use GitHub Copilot's OpenAI-compatible API directly as a model backend; (2) `DeferredToolResults.approvals` now rejects invalid values outright — a compatibility change; (3) fixes for Bedrock Converse sampling settings, `$ref` resolution in code-mode function schemas, and lost Anthropic error-recovery state across normalized history.
Temporal v1.32.0 highlights: (1) Standalone Activities reach GA, with delayed starts, operator APIs (pause/resume/reset), and batch operations; (2) Nexus callbacks now route by URL scheme by default, removing the old header-based config — a breaking, security-driven change; (3) the Unified Query Converter becomes the default, tightening type validation and empty-string filtering on Visibility queries.
Agno v3.0.10 in three points: (1) `CodingTools.run_shell` moves from enabled-by-default to requiring `enable_run_shell=True`, and restricted mode no longer routes commands through a shell at all, closing off interpreter-RCE-style shell injection; (2) `PublicSurface(authorization=True, mcp=True)` now accepts only localhost by default — non-local callers need an explicit `MCPConfig(allowed_hosts=[...])` allowlist; (3) new `AzureOpenAIResponses` model, an Elasticsearch vector database, and a `DocumentationMarkdown` transform that converts Mintlify/Fumadocs docs sites into plain Markdown.
Mastra @mastra/core@1.67.0 in four points: (1) the Studio Workflow Builder backend lets an editor-owned agent generate and persist workflow definitions directly — describe a flow in natural language and get a real, runnable workflow back; (2) the new `@mastra/connect` package wraps Mastra Platform integration connections as agent tools, with credentials injected by the platform's connection proxy so agent code never touches a secret; (3) `Memory.updateThreadResourceId()` lets a thread be transferred to a new `resourceId`, implemented transactionally across every major SQL adapter; (4) breaking: `subscribeQueuedMessages` is renamed `subscribeThreadEvents`, and `ArchilFilesystem.grep()` is renamed `diskGrep()`.
Pydantic AI v2.44.0 in three points: (1) four security patches, the most serious being `web_fetch` running both its HTML conversion and charset decoding in superlinear time on the event loop — an attacker-chosen page can stall every agent sharing that process; (2) three compatibility notes: `RunContext.enqueue()` is now safe to call from worker threads, UI adapter requests must carry a JSON `Content-Type`, and a capability's `@durable_operation` invoked from a per-request hook now dispatches properly instead of running inline; (3) a new Vercel AI SDK/Eve migration skill, and `AgentRunResult` now settles into a stable serialized shape.
CrewAI 1.15.22 in three points: (1) a new `llm_overlay` context variable that routes a specific agent role to a different model at runtime, instead of hardcoding the model when the agent is created; (2) CrewAI Platform integration gains an application catalog, connection aliases, setup-time integration validation, and deployment-failure logging; (3) tracing now captures human feedback and pause events; no breaking changes in this release.
Three things worth knowing about Microsoft Agent Framework python-1.19.0: (1) four BREAKING changes land together, covering HTTP cookie persistence, MCP skill archive format, MCP session scoping, and Redis history key scoping; (2) a new generic vector store provider protocol ships with three new connectors at once — MongoDB (alpha), Azure DocumentDB (alpha), and Azure Cosmos DB NoSQL; (3) built-in orchestration workflows now have stable names and registered checkpoint types, so the built-in sequential/concurrent/handoff/group-chat patterns can be restored after a restart, not just custom workflows.
Three things worth knowing about Pydantic AI v2.46.0: (1) the previous release (2.45.0) introduced TypeSafeModel — a provider for TypeSafe's Jev, a classifier that answers typed questions instead of writing text — and this release fills in what it couldn't do yet: filling tool call arguments and picking a type before filling a union output; (2) a new `typesafe_boolean_threshold` turns the yes/no decision boundary from a fixed distance-from-0.5 into a tunable parameter; (3) `supports_text_output` lets `LLMJudge` and `GEval` run on models that don't produce text at all, so Jev can now serve as the judge model in evals. No breaking changes.
Four things worth knowing in Mastra @mastra/core@1.69.0: (1) a new Classifier primitive turns fixed-option LLM judgments into a first-class component you can register on a Mastra instance, with automatic tracing; (2) a Classifier can be used directly as a typed workflow step for branching, or wrapped in a ClassifierProcessor to guard agent input/output/streaming content, failing closed by default; (3) context.background.adopt() lets a tool acknowledge immediately while handing off a long-running background task, and @mastra/connect@0.3.0 ships ten new SaaS integrations at once; (4) breaking changes: @mastra/playground-ui's PageLayout/FluidHoverHighlight APIs were reworked, and the group option on trace queries is now deprecated.
Four things in Mastra @mastra/core@1.71.0: (1) Eager Tool Execution is on by default, starting a tool call as soon as its own arguments are ready instead of waiting for the whole step; (2) Observability Capabilities Negotiation lets Studio and custom clients probe which tracing APIs a storage backend supports before calling them, fixing hard 500s on legacy stores; (3) a new `@mastra/discord` channel, sandbox credential materialization, and server-side MongoDB Vector embeddings; (4) breaking: `@mastra/playground-ui`'s `TaskList` drops `title`, `TaskListHeader`, and `hideWhenEmpty`.
Three things in AG2 v1.1.1: (1) breaking — BedrockConfig switches from thread-wrapped boto3 to native async aiobotocore, and passing a boto3.Session now fails outright; (2) security — restricted shell mode parses a command into argv exactly once and runs that argv, so pipes, redirects, and globs can no longer smuggle a second command past the allowlist; (3) security — when multiple tools share a name, only one now resolves per turn, with code-declared tools taking priority over MCP or client tools. The version bump is a patch (1.1.0 → 1.1.1); the content is not.
Three things in Pydantic AI v2.52.0: (1) security — GHSA-v36g-jcw9-x7cw (moderate): attacker-controlled HTML with deeply nested elements fed into the local web_fetch tool could exhaust CPU/memory; provider-native web fetching is unaffected; patched in both 2.52.0 (v2) and 1.107.7 (v1); (2) a new Workspace abstraction — Coder/Shell/FileSystem and the rest of the harness now go through ctx.workspace, sharing one API across local execution and four sandbox backends (SSHWorkspace, BubblewrapSandbox, E2BSandbox, SpritesSandbox), with ModalSandboxSession renamed to ModalSandboxBackend; (3) pydantic-ai-harness jumps from 0.36.0 to 0.52.0 and now ships with every release, alongside the first pydantic-clai2 (`uvx pydantic-clai2`) CLI release, bundled with plugins like github, slack, notion, and logfire_mcp.
Three things in Agno v3.1.0: (1) a new `agno.os.authz` package gives AgentOS a native role store, scope policy, audit log, and user directory, with pluggable native and `fga` authorization engines; (2) a new `agno.fs`/`DbFileSystem` adds dedicated `/filesystem` routes to AgentOS, but existing `agno_fs` tables must be migrated offline or they raise `SchemaOutdatedError`; (3) Breaking: `MCPConfig`'s bundled default tools and lifecycle tools (`continue_run`/`cancel_run`) switch from automatically included to explicit opt-in.
Three things in Haystack v3.3.0: (1) security — `anyio` is bumped to `>=4.14.2`, patching CVE-2026-63374 (GHSA-82r6-8w77-94w6); it's pulled in transitively through `httpx`/`openai`, so older versions were vulnerable; (2) performance — `SentenceWindowRetriever` now queries the Document Store once per `run`/`run_async` call instead of once per retrieved document; (3) Breaking: BM25L/BM25Plus (the default) now only return documents that contain at least one query term, which can shrink result counts; passing a negative `top_k` now raises `ValueError` instead of silently slicing; and a fix for lost whitespace at quoted sentence endings shifts chunk boundaries for re-indexed corpora.
Three things in Pydantic AI v2.53.0: (1) security — GHSA-6fqq-452j-qhrp (high): a streamed request through ConcurrencyLimitedModel or limit_model_concurrency could keep its concurrency slot stuck in a 'released but not really released' state when the consumer exited early (stopped iterating, raised, or was cancelled) or fully consumed stream_text() with its default debouncing; repeating this could block every request sharing the limiter; (2) the fix also changes limiter semantics — a model wrapper now raises UserError when it shares a limiter with the agent making the request or an enclosing wrapper, ConcurrencyLimiter.acquire() takes a new slot on every call (even within the same task), and a custom AbstractConcurrencyLimiter must allow release() from another task; (3) a new ToolCallJudge reviews tool calls before they execute, and the internal repair_messages pipeline is now a public API.
Three things in Mastra @mastra/core@1.74.0: (1) agent.getMessages() lets a tool, at execution time, read the full current conversation (including remembered messages and responses already produced in this run) without changing the existing input-only messages field; (2) getObservationalMemoryHistory gains group filtering, ordering, and direct recordId lookup, and memory recall can now page before/after a matched observation group; (3) breaking: @mastra/playground-ui's ThreadViewByTrace/TraceThreadPanel/ThreadTrace drop anchorTraceId, ThreadTrace.LoadMoreSentinel is removed entirely, and pagination now runs through pageSize/onLoadOlder.
Three things in Inngest v1.46.0: (1) after running `inngest login`, a local workflow can connect directly to a Cloud sandbox to run agent code, with no need to deploy a full app or configure an SDK sandbox token (experimental); (2) API keys move from one all-powerful credential to versions scoped to the v2 API, CLI, or MCP, with optional expiry; (3) a Dashboard dependency, TanStack Start, is patched for CVE-2026-102989, a reflected XSS. No breaking changes — just upgrade.
Four things in Mastra @mastra/core@1.75.0: (1) a new storage.querySpans() lets you query individual spans directly (filters, cursors, cost) instead of locating a trace first; (2) aggregateTraces() gains token/cost measures, implemented across ClickHouse, DuckDB, and Postgres observability stores; (3) Semantic Recall now works with self-embedding vector stores (like MongoDBVector's autoEmbed), so you no longer need to configure a client-side embedder; (4) @mastra/connect reaches 1.0, but integrations is renamed providers, discovered MCP tools no longer require approval by default, and the Slack channel id changes from slack to slack-channels — all breaking.
Three things in Agno v3.1.2: (1) `Agent(compaction=True)` folds older turns into a summary stored in a new `agno_compactions` table without overwriting the original messages, so it can be triggered manually with `agent.compact()` or reverted at any time; (2) a new `CodexAgent` brings OpenAI Codex into Agno's external-agent family alongside the Claude Agent SDK, LangGraph, DSPy, and Antigravity adapters; (3) a new `HyDE` query transformer searches with a hypothetical answer instead of the raw question, while rerankers still score against the original query. No breaking changes in this release.
Three things in Pydantic AI 2.55.0: (1) a new Conversation object carries and stores a conversation's run history, accepted as conversation= by every entry point, so you no longer wire message_history between calls yourself; (2) a unified, cross-provider cache setting and Caching capability, where cache=True now caches instructions and tool definitions on Anthropic, not just messages; (3) new officially hosted PostgresStepStore and PostgresMediaStore backends. Compatibility: every package now requires Python 3.11+, and LogfireMCP tool names gain a logfire_ prefix.
Agno v3.1.3 is all about bringing external agents (ClaudeAgent / CodexAgent) up to parity with native Agent capabilities: (1) SDK conversation history now persists to the database, so a session can resume on a different machine; (2) background execution, cancellation, and checkpoint-based step replay all land; (3) retries, token/cost metrics, compaction, structured output, and file attachments are added. No formal breaking changes, but "one turn per session" now returns a 409 up front instead of accepting a second turn and failing it later.
Two things matter in DSPy 3.4.1: (1) dspy.RLM's sandboxed code can now import dspy and build Predict / ChainOfThought / ReActV2 / nested RLM sub-agents, all sharing one max_llm_calls budget; (2) GEPA now defaults to a structured InstructionProposer. Breaking changes: GEPA can produce different results than 3.4.0 with the same seed, reflection_lm must be a dspy.LM, ReActV2 signatures can no longer declare history/tools input fields, the dspy.predict.flex.bridge import path is gone, and programs saved on 3.4.0 with a null Score criterion fail to load.
Mastra @mastra/core@1.76.0 centers on multi-instance correctness: (1) each run is claimed by the process actually driving it, so crash recovery no longer restarts a run that's still executing; (2) storage adapters can enforce run fencing to reject writes from an execution that lost ownership; (3) PostgreSQL working-memory updates now merge atomically inside a row-locked transaction. Breaking changes: `@mastra/playground-ui` dropped its old Metrics card components, with `MetricsCardGroup`/`MetricsLineChart` losing a few props; Observational Memory now defaults to `model: 'auto'` instead of a fixed Gemini 2.5 Flash, so anyone who didn't pin a model explicitly will silently switch providers.
Three things in Mastra 1.77.0: Factory gets a formal sandbox provider contract (Docker, E2B, Mastra Platform) and prebuilt environments; the previous release's run fencing now covers Cloudflare DO/D1, DynamoDB, MongoDB, Redis and a dozen more, so a durable run that lost ownership can't overwrite the recovered run's state; spans support links, and `@mastra/mcp` connects client tool-call traces and server request traces in both directions. Breaking: `@mastra/server` workflow routes can no longer start or resume internal workflows, so durable agents must go through agent routes.
Pydantic AI v2.56.0: `SmolSandbox` runs harness capabilities in a local smolvm microVM; `PGTaskDurability` provides durable execution on pgtask, alongside a Render Workflows integration; `Skills` can layer project and personal libraries; Python 3.15 and Gemini 4 Argon are supported, with the Google providers' default timeout raised to 20 minutes. Compatibility note: `BrowserUse` now runs on the host model by default and browser-use telemetry is opt-in; `MCPToolset(http_client=...)` now applies auth and no longer closes the user-supplied client.
Haystack v3.4.0, three things worth knowing: (1) new feature — the experimental `ToolResultOffloadCompactor` lets `CompactionHook` write old tool-call results to a `ToolResultStore` and leave only a reference behind; a dedicated read tool can pull the full content back on demand, so nothing is actually lost; (2) breaking — the default embedding model on `OpenAITextEmbedder` and friends changes from `text-embedding-ada-002` to `text-embedding-3-small`; the vectors aren't compatible, so existing corpora need re-indexing or an explicit pin to the old model; (3) breaking — `ChatMessage.from_openai_dict_format` now raises `ValueError` for content parts it can't convert, such as image URL references or `file_id` file references, instead of silently stuffing them into a text string. The same release adds official Python 3.15 support and drops Python 3.10, which reached end of life.
Three things in Mastra 1.78.0: (1) agent scopes let the caller, the agent itself, and trusted middleware all carry `<type>:<value>` scopes, and memory derives resource/thread from them; (2) `queueSignal()` queues a typed signal behind the current run instead of faking it as a user message; (3) a trace aggregation API adds output/error previews that cut the cost of reading traces. Breaking: `@mastra/server` tightens cross-resource run access — privileged access now fails without a connected FGA provider when `mapUserToResourceId` is set; command output is capped at 1 MiB by default; `stream()` without a `resourceId` only delivers resource-less tasks.
Two things in Pydantic AI v2.57.0: (1) a new harness `ApprovalReviewer` lets a model review low-risk tool calls before a person ever sees them; (2) a new `MetaProvider` adds support for the Meta Muse model family. MCP Apps tool results now forward to AG-UI and Vercel AI front ends, and `MCPToolset` gains `read_resource_contents`/`call_tool_for_app`. Compatibility notes: `BackgroundTools` completions carry namespaced `origin`/`tool_call_id` metadata, Gemini Live and GPT-Live realtime history, usage, and reply-wait handling moved into the session core, and `Skills` now honors `disable-model-invocation`/`user-invocable` flags.
The core of Agno v3.1.4 is Sandboxed Harness Agents: ClaudeAgent/CodexAgent can now run inside isolated, per-session containers (DockerSandbox or AWS Bedrock AgentCore), restoring session state from checkpoints so a lost container doesn't force a brand-new conversation; warm sandboxes make the next turn start faster. It also adds Queue Per Session — background runs on one session now default to running strictly one at a time in order, instead of the old accept-then-fail behavior. No formal breaking changes, but sandbox import paths moved, `sandbox="read-only"` was renamed to `sandbox_mode`, and old sandbox binding tables need a manual migration — all worth checking after upgrading.
Three things in Pydantic AI v2.58.0: (1) `DelegationTasks.steer` lets a running delegated task be redirected mid-flight instead of being cancelled and restarted; (2) a run-level `timeout=` and `RunContext.deadline`, plus per-request `request_timeout`/`max_retries` on `ModelSettings`; (3) two medium-severity security fixes — provider-native MCP configuration could leak server URLs/tokens into OpenTelemetry traces, and a frontend-adapter misconfiguration could let a tool execute with client-chosen arguments without a model request. Also new: an `openai-chatgpt` provider and `ElevenLabsAgentsRealtimeModel`.
Three things in Pydantic AI v2.59.0: (1) a high-severity security fix (GHSA-4whf-38hw-pxxh) — the `web_fetch` tool could stall unrelated work in the same process when it fetched attacker-crafted HTML with many elements; (2) `DaytonaSandbox`, which runs the whole harness toolset (Coder, Shell, FileSystem) inside a Daytona sandbox; (3) provider-neutral model error categories like `ModelRateLimitError` and `ModelContextWindowExceededError`, so retry logic no longer has to special-case each provider.
Three things in Agno v3.1.8: (1) `PostgresCheckpointStore` lets sandbox checkpoints live in Postgres, so multi-replica deployments can restore a session without S3 or a shared filesystem; (2) a behavior change: sandboxes now keep only the 3 newest checkpoints per session by default, set `retain_checkpoints=None` to keep them all; (3) `Claude()` now defaults to `claude-sonnet-5-5`, replacing the soon-to-retire `claude-sonnet-4-5-20250929`.
Four things in Mastra 1.79.0: (1) agent controller sessions now address by a standalone sessionId, so one resourceId can hold several sessions; (2) experimental MCP Events (SEP-3415 draft) let an MCP server publish an event stream, picked up via poll, a kept-open stream, or signed webhooks; (3) span-level observability aggregation (`aggregateSpans()`) answers p95 latency and token-cost questions; (4) sandboxes gain a native filesystem API that drops the per-step shell command. Breaking: session addressing changed, `querySpans()` drops some filters and fields, and channel resolvers now require requestContext.
Three things in CrewAI 1.15.29: (1) `AgentExecutor` graduates out of experimental status to a stable API; (2) a new Azure DocumentDB vector search integration, plus `crewai eval` gains evaluation export and a single command to run the whole crew for a verdict; (3) the CLI picks up platform application search and an organization picker at login. No breaking changes — just upgrade.
Two things in Inngest v1.49.0: (1) a new v2 API for function replay, which replays a specific run by time range and status, callable from the API, CLI, or MCP; (2) a new v2 API for resuming a function, letting a paused workflow recover straight from the control plane without hand-rolled polling. No breaking changes for SDK users; self-hosted teams should follow the migration notes' deployment order.
Three things in Pydantic AI v2.61.0: (1) structured citations — `TextPart` can now carry citations, normalized across Bedrock, OpenRouter, and xAI, and replayed back to whichever provider originally produced them across turns; (2) the durable execution engine's extension surface is now public (operation types, `ParameterTransports`, `DurableRunContext`, run identity hooks), so third parties can wire in their own durable backend; (3) several compatibility notes: `thinking=False` now sends the least thinking a model will accept instead of silently misbehaving, and `CohereModel` raises instead of silently dropping a file returned by a tool.
Three things in Pydantic AI v2.62.0: (1) a new `ModelSettingsDeltaPart` lets you change thinking effort mid-conversation via OpenAI's `configuration_update` or Anthropic's per-message `output_config`, preserving the prompt cache on OpenRouter; (2) `SummarizingCompaction` now stores its summary as a `CompactionPart` instead of a system prompt, and sends it to every provider; (3) Breaking: `GraphBuilder` broadcast branches now start in `.to()` declaration order instead of reversed, which can change behavior for durable workflows that were paused before the upgrade and are resumed after it.
Three things in Pydantic AI v2.63.0: (1) Breaking: `CodeMode` now defaults to `dynamic_catalog=True`, so a disclosed tool gets appended instead of rewriting the cached prompt, and `GoogleRealtimeConnection.dial`'s `replay` argument is now keyword-only; (2) a new `DetectLoops` capability catches and interrupts repeated-action loops, and `IPythonCodeMode` arrives as an alternative to the Monty-based CodeMode; (3) a new `PostgresSpendStore` lets harness `SpendLimits` budgets be shared across workers through PostgreSQL instead of each worker tracking its own allowance.
Three things in Agno v3.1.11: (1) Harness Agents arrive — `ClaudeAgent`/`CodexAgent` can now join a `Team` directly as members or serve as a step inside `Parallel`/`Loop`/`Condition`/`Router` in a `Workflow`, each running its own model, tools, and workspace while keeping its own conversation history within a session; (2) advanced Session Search — `POST /sessions/search` supports nested AND/OR/NOT filters over sessions; (3) Company Tasks and Routines get full lifecycle management APIs (Tasks can be created or edited at any stage, Routines can be cancelled, archived, or restored).
Three things in Mastra @mastra/core v1.80.0: (1) `tools({ resourceId })` plus `userConnectRoutes()` let each end user bind their own OAuth connection, with the server hard-enforcing that one user's connection can't be used by another user's agent; (2) a new `request_connection` tool lets an agent return a structured card when it's missing an integration, so the chat UI can render a connect prompt; (3) four breaking changes: `queryTraceThreads()` drops `model`/`provider` and caps `page.limit` at 100, the connect-session creation API renamed its response field, `code-sdk` no longer registers built-in subagents by default, and `TracesExplorer`'s sort API changed to a single object.
Agno v3.1.12 headline: Native Approvals for Harness Agents — `ClaudeAgent`/`CodexAgent`'s own permission requests (Claude's `permission_mode`, Codex's `approval_policy`) now turn into a PAUSED run inside AgentOS, showing up in the existing Chat and Approvals views; Resolve plus Continue Run sends the decision back into the same native execution without replaying the prompt, and sandboxed environments (Docker/AgentCore) keep this capability too. Also new: `Routine(enabled=False)` for a company routine a template can ship disabled and let users turn on later, and a headline number on charts.
Four things in Pydantic AI v2.64.0: (1) Breaking: a retrying transport that gives up now raises `ModelHTTPError` so fallback can take over, `Coder`'s tools turn off strict schemas by default, and `json-repair` becomes an optional dependency; (2) a new `ModelFallback` capability with a `sticky` option that stays on whichever fallback model just answered, plus a `prepare_model_request` hook and `RetryModelRequest`; (3) a new `BoxdSandbox` that bundles `Coder`, `Shell`, `FileSystem` and other harness capabilities into one boxd sandbox machine; (4) a new `ArtifactScanner` that screens `Memory` and `Skills` artifacts for safety.
Three things in Composio CLI 0.6.0: (1) Breaking: SIGINT/SIGTERM/SIGHUP now map to explicit exit codes (130/143/129) instead of being treated as a clean finish; (2) Breaking: linking a developer account now requires a resolvable project and acting user, or the command fails outright; (3) Breaking: when a toolkit has multiple connected accounts and no default alias, the CLI no longer silently picks the newest one — you must specify it.