Pydantic AI Updates: September 17, 2026

1. Four Security Advisories Landed, All Reached Through web_fetch_tool or OTel Instrumentation

Pydantic AI. Version 2.44.0 patches four issues, backported to 1.107.6 on the v1 line. Two are rated moderate: an IPv6 zone identifier could bypass the cloud-metadata and private-IP blocklists on URLs opted into local network access via FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True) (both off by default), and web_fetch processed responses in superlinear time on the event loop during HTML conversion and charset decode, so one attacker-chosen page could stall every agent in the process. The two low-severity issues: web_fetch_tool compared domain lists as written rather than in resolver form, letting a blocked domain be reached under another spelling, and InstrumentationSettings(include_content=False) still emitted exceptions, error statuses, instructions, and the output template on spans. Source

2. The Same Release Added a Vercel AI SDK Migration Skill and a Stable Result Shape

Pydantic AI. Beyond the security work, 2.44.0 shipped a migration skill for moving from the Vercel AI SDK and eve, gave AgentRunResult a stable serialized shape with finished streams settling into it, and started emitting EnqueuedMessagesEvent when a realtime session delivers enqueued content. Three compatibility notes accompany the release: RunContext.enqueue() is now safe to call from worker threads, UI adapter requests require a JSON Content-Type, and a capability @durable_operation invoked from a per-request hook is dispatched rather than silently run inline. Source