Pydantic AI v2.59.0

Summary

Pydantic AI 2.59.0 is dated 2026-10-20 in its notes and was published on GitHub on 2026-10-21. It fixes a high-severity denial-of-service issue in the web_fetch tool's HTML conversion, also fixed in 1.107.9. New features: a Daytona sandbox for the coding harness, ElevenLabs realtime speech-to-speech models, and finer control over Temporal retries.

Key points

• Security (GHSA-4whf-38hw-pxxh, high): attacker-controlled HTML with many elements could make web_fetch conversion slow down unrelated work in the same process. Upgrade to 2.59.0 or 1.107.9 if agents fetch untrusted pages.
• DaytonaSandbox: runs the Coder, Shell, FileSystem, and other harness capabilities in a Daytona sandbox. This adds to the existing E2B, SSH, Bubblewrap, and Sprites options.
• ElevenLabsRealtimeModel: support for Eleven Realtime speech-to-speech models.
• Durability: TemporalDurability(non_retryable_model_errors=...) stops Temporal retrying chosen model error categories. New typed errors include ModelRateLimitError, ModelUnavailableError, and ModelContextWindowExceededError.
• Caching: FunctionToolset.instructions can use on_change='append' so that changing instructions do not rewrite (and un-cache) the prompt prefix.
• Fixes: the SummarizingCompaction transcript is escaped so tool output cannot forge messages. A new ToolCallsAbandoned realtime event is added. Strict Anthropic schemas keep Literal discriminators.

Why it matters

Anyone exposing Pydantic AI's web_fetch to the open web should upgrade. The compaction escape fix closes a prompt-injection path through summarised history.