ReleaseBytes
python Pydantic AI Releases · · 2.30.0

Pydantic-AI v2.30.0 Addresses DNS Rebinding and Adds Gemini Flash Model

sdkaisecurity-advisoryengineerpython-agentic
security feature patch

Pydantic-AI v2.30.0 resolves a critical DNS rebinding vulnerability in its local development web chat UI, which could allow malicious websites to execute agents with local credentials. This update also introduces support for OpenRouter's web search functionality and the new `gemini-3.7-flash` model. Users deploying `Agent.to_web()` or `clai web` on real hostnames must configure the new `allowed_hosts` setting for continued functionality and security. The release further includes several bug fixes related to model profiling and tool callability.

  • →Use openrouter:web_search for web search by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7378
  • →Add gemini-3.7-flash model by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7445
  • →Expose gRPC metadata on XaiProvider by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7423
  • →Add allowed_hosts to Agent.to_web() and clai web by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7437
  • →Fall back to ASCII in EvaluationReport.print() on non-UTF-8 consoles by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7290
Security (1) ›

  • GHSA-q2xc-rrxj-58x9: the local dev web chat UI (Agent.to_web(), clai web) didn't validate the Host header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in pydantic-ai/pydantic-ai-slim 2.30.0 by validating Host against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new allowed_hosts setting

Features (4) ›
  • Use openrouter:web_search for web search by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7378
  • Add gemini-3.7-flash model by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7445
  • Expose gRPC metadata on XaiProvider by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/7423
  • Add allowed_hosts to Agent.to_web() and clai web by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7437
Fixes (6) ›

  • Resolve deferred openai resource imports and genai-prices data loading at Model construction time by @adtyavrdhn in https://github.com/pydantic/pydantic-ai/pull/7408

  • Fall back to ASCII in EvaluationReport.print() on non-UTF-8 consoles by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7290

  • Lowercase model name before profile lookup in SambaNova, Heroku, and Fireworks providers by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6818

  • Update LatestCerebrasModelNames to current model catalog by @pydanty[bot] in https://github.com/pydantic/pydantic-ai/pull/6838

  • Require a deferred tool to be revealed, and its capability loaded, before it can be called by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7271

  • Anchor the tool-callability evidence window to the response's serving provider by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7442

Read the original announcement →

https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0

Related releases