Four things in Pydantic AI v2.64.0: (1) Breaking: a retrying transport that gives up now raises `ModelHTTPError` so fallback can take over, `Coder`'s tools turn off strict schemas by default, and `json-repair` becomes an optional dependency; (2) a new `ModelFallback` capability with a `sticky` option that stays on whichever fallback model just answered, plus a `prepare_model_request` hook and `RetryModelRequest`; (3) a new `BoxdSandbox` that bundles `Coder`, `Shell`, `FileSystem` and other harness capabilities into one boxd sandbox machine; (4) a new `ArtifactScanner` that screens `Memory` and `Skills` artifacts for safety.
Three things in Pydantic AI v2.63.0: (1) Breaking: `CodeMode` now defaults to `dynamic_catalog=True`, so a disclosed tool gets appended instead of rewriting the cached prompt, and `GoogleRealtimeConnection.dial`'s `replay` argument is now keyword-only; (2) a new `DetectLoops` capability catches and interrupts repeated-action loops, and `IPythonCodeMode` arrives as an alternative to the Monty-based CodeMode; (3) a new `PostgresSpendStore` lets harness `SpendLimits` budgets be shared across workers through PostgreSQL instead of each worker tracking its own allowance.
Three things in Pydantic AI v2.62.0: (1) a new `ModelSettingsDeltaPart` lets you change thinking effort mid-conversation via OpenAI's `configuration_update` or Anthropic's per-message `output_config`, preserving the prompt cache on OpenRouter; (2) `SummarizingCompaction` now stores its summary as a `CompactionPart` instead of a system prompt, and sends it to every provider; (3) Breaking: `GraphBuilder` broadcast branches now start in `.to()` declaration order instead of reversed, which can change behavior for durable workflows that were paused before the upgrade and are resumed after it.
Three things in Pydantic AI v2.61.0: (1) structured citations — `TextPart` can now carry citations, normalized across Bedrock, OpenRouter, and xAI, and replayed back to whichever provider originally produced them across turns; (2) the durable execution engine's extension surface is now public (operation types, `ParameterTransports`, `DurableRunContext`, run identity hooks), so third parties can wire in their own durable backend; (3) several compatibility notes: `thinking=False` now sends the least thinking a model will accept instead of silently misbehaving, and `CohereModel` raises instead of silently dropping a file returned by a tool.
Three things in Pydantic AI v2.59.0: (1) a high-severity security fix (GHSA-4whf-38hw-pxxh) — the `web_fetch` tool could stall unrelated work in the same process when it fetched attacker-crafted HTML with many elements; (2) `DaytonaSandbox`, which runs the whole harness toolset (Coder, Shell, FileSystem) inside a Daytona sandbox; (3) provider-neutral model error categories like `ModelRateLimitError` and `ModelContextWindowExceededError`, so retry logic no longer has to special-case each provider.
Three things in Pydantic AI v2.58.0: (1) `DelegationTasks.steer` lets a running delegated task be redirected mid-flight instead of being cancelled and restarted; (2) a run-level `timeout=` and `RunContext.deadline`, plus per-request `request_timeout`/`max_retries` on `ModelSettings`; (3) two medium-severity security fixes — provider-native MCP configuration could leak server URLs/tokens into OpenTelemetry traces, and a frontend-adapter misconfiguration could let a tool execute with client-chosen arguments without a model request. Also new: an `openai-chatgpt` provider and `ElevenLabsAgentsRealtimeModel`.
Two things in Pydantic AI v2.57.0: (1) a new harness `ApprovalReviewer` lets a model review low-risk tool calls before a person ever sees them; (2) a new `MetaProvider` adds support for the Meta Muse model family. MCP Apps tool results now forward to AG-UI and Vercel AI front ends, and `MCPToolset` gains `read_resource_contents`/`call_tool_for_app`. Compatibility notes: `BackgroundTools` completions carry namespaced `origin`/`tool_call_id` metadata, Gemini Live and GPT-Live realtime history, usage, and reply-wait handling moved into the session core, and `Skills` now honors `disable-model-invocation`/`user-invocable` flags.
Pydantic AI v2.56.0: `SmolSandbox` runs harness capabilities in a local smolvm microVM; `PGTaskDurability` provides durable execution on pgtask, alongside a Render Workflows integration; `Skills` can layer project and personal libraries; Python 3.15 and Gemini 4 Argon are supported, with the Google providers' default timeout raised to 20 minutes. Compatibility note: `BrowserUse` now runs on the host model by default and browser-use telemetry is opt-in; `MCPToolset(http_client=...)` now applies auth and no longer closes the user-supplied client.
Three things in Pydantic AI 2.55.0: (1) a new Conversation object carries and stores a conversation's run history, accepted as conversation= by every entry point, so you no longer wire message_history between calls yourself; (2) a unified, cross-provider cache setting and Caching capability, where cache=True now caches instructions and tool definitions on Anthropic, not just messages; (3) new officially hosted PostgresStepStore and PostgresMediaStore backends. Compatibility: every package now requires Python 3.11+, and LogfireMCP tool names gain a logfire_ prefix.
Three things in Pydantic AI v2.53.0: (1) security — GHSA-6fqq-452j-qhrp (high): a streamed request through ConcurrencyLimitedModel or limit_model_concurrency could keep its concurrency slot stuck in a 'released but not really released' state when the consumer exited early (stopped iterating, raised, or was cancelled) or fully consumed stream_text() with its default debouncing; repeating this could block every request sharing the limiter; (2) the fix also changes limiter semantics — a model wrapper now raises UserError when it shares a limiter with the agent making the request or an enclosing wrapper, ConcurrencyLimiter.acquire() takes a new slot on every call (even within the same task), and a custom AbstractConcurrencyLimiter must allow release() from another task; (3) a new ToolCallJudge reviews tool calls before they execute, and the internal repair_messages pipeline is now a public API.
Three things in Pydantic AI v2.52.0: (1) security — GHSA-v36g-jcw9-x7cw (moderate): attacker-controlled HTML with deeply nested elements fed into the local web_fetch tool could exhaust CPU/memory; provider-native web fetching is unaffected; patched in both 2.52.0 (v2) and 1.107.7 (v1); (2) a new Workspace abstraction — Coder/Shell/FileSystem and the rest of the harness now go through ctx.workspace, sharing one API across local execution and four sandbox backends (SSHWorkspace, BubblewrapSandbox, E2BSandbox, SpritesSandbox), with ModalSandboxSession renamed to ModalSandboxBackend; (3) pydantic-ai-harness jumps from 0.36.0 to 0.52.0 and now ships with every release, alongside the first pydantic-clai2 (`uvx pydantic-clai2`) CLI release, bundled with plugins like github, slack, notion, and logfire_mcp.
Three things worth knowing about Pydantic AI v2.46.0: (1) the previous release (2.45.0) introduced TypeSafeModel — a provider for TypeSafe's Jev, a classifier that answers typed questions instead of writing text — and this release fills in what it couldn't do yet: filling tool call arguments and picking a type before filling a union output; (2) a new `typesafe_boolean_threshold` turns the yes/no decision boundary from a fixed distance-from-0.5 into a tunable parameter; (3) `supports_text_output` lets `LLMJudge` and `GEval` run on models that don't produce text at all, so Jev can now serve as the judge model in evals. No breaking changes.
Pydantic AI v2.44.0 in three points: (1) four security patches, the most serious being `web_fetch` running both its HTML conversion and charset decoding in superlinear time on the event loop — an attacker-chosen page can stall every agent sharing that process; (2) three compatibility notes: `RunContext.enqueue()` is now safe to call from worker threads, UI adapter requests must carry a JSON `Content-Type`, and a capability's `@durable_operation` invoked from a per-request hook now dispatches properly instead of running inline; (3) a new Vercel AI SDK/Eve migration skill, and `AgentRunResult` now settles into a stable serialized shape.
Pydantic AI v2.42.0 highlights: (1) a new `GitHubCopilotProvider` lets Agents use GitHub Copilot's OpenAI-compatible API directly as a model backend; (2) `DeferredToolResults.approvals` now rejects invalid values outright — a compatibility change; (3) fixes for Bedrock Converse sampling settings, `$ref` resolution in code-mode function schemas, and lost Anthropic error-recovery state across normalized history.
Pydantic AI 2.38.0 highlights: (1) new typed `CustomEvent`/`CapabilityEvent` — application code and capabilities can now emit custom events into the Agent's run event stream and subscribe with `@on_event`, filling in a general-purpose observability and extension layer; (2) `RunContext` gains `context_window_used` and `ModelProfile` gains `context_window`, so agent code can read how much of the model's context window remains, for the first time; (3) new model support for `gemini-3.8-flash`, Claude Fable 5.1, and Claude Mythos 5.1, plus a new `VLLMProvider`. No breaking changes in this release.
Pydantic AI 2.36.0 highlights: (1) new `@durable_operation` decorator turns any custom capability method into a replay-safe durable unit under Temporal/Prefect/DBOS and other engines; (2) a public backend API (`BaseDurabilityCapability`, `CallableOperationBackend`, `RegisteredOperationBackend`) lets third-party durable engines integrate with zero private imports — verified against three out-of-tree engines; (3) one compatibility tightening: MCP tools can no longer opt out of durable execution via tool metadata (previously allowed on DBOS), plus a Prefect dynamic-tool cache-key fix.
These seven tools are not one product category: LangGraph, MAF, and Mastra emphasize durable workflows; CrewAI and AG2 emphasize multi-agent collaboration; Pydantic AI emphasizes typed Python agents; DSPy optimizes AI programs against data and metrics. Choose the control model first.
Pydantic AI models an agent as Agent[Deps, Output]: dependencies, tool inputs, and final outputs are typed, and model results must pass Pydantic validation.
Sorted by GitHub Stars, a survey of 15 mainstream AI Agent frameworks in 2026 — their positioning, key features, and ideal use cases. Not a ranking — it's a map.