Framework Watch: Pydantic AI Stops Sending Server State to the Wrong Endpoint

Most of this week's changes fix data that ended up somewhere it was not meant to go.

Pydantic AI 2.64: state belongs to an endpoint, not a provider name

Released October 30, 2026, Pydantic AI 2.64 lists several compatibility notes. The one to read first is PR #11774. One provider name can cover many endpoints, since OpenAIProvider takes any base_url. Server-side state such as a stored response, its item IDs, a conversation or a code-execution container "can only be looked up at the endpoint that created it, but it was sent back to any provider with the same name." Now a history that moves to another endpoint no longer sends previous_response_id, item IDs or the Anthropic container from the old one; text, function calls and encrypted reasoning still go. If two URLs really share state, such as a proxy alias, override Provider.shares_server_state_with().

The same release adds ArtifactScanner (PR #11470) for Memory and Skills. The PR explains why: memory files and skills persist, so an instruction planted in one run "takes effect in a later one", and existing guardrails see only prompts, tool calls and outputs. With the opt-in scanner, a flagged memory write fails and stores nothing, and a flagged SKILL.md is left out of the catalog while keeping its name, so an unscanned copy with the same name cannot replace it. Other notes add a first_event_timeout so a stream that never starts can fall back, and turn a status a retrying transport gave up on into ModelHTTPError so fallback moves on.

ADK Python: thoughts are not memories

A commit merged October 31 keeps thought parts out of FirestoreMemoryService. Issue #7830 shows that words found only in the model's hidden reasoning became search keywords, and that load_memory handed the model "its own earlier reasoning back as a 'memory'." The other memory services already excluded thoughts. Search now drops thought parts from documents written before the fix. Separately, McpToolset callers can pass a message_handler to receive MCP server notifications such as notifications/tools/list_changed, and the evaluator no longer drops Gemini Live token usage that arrives separately from content.

LangGraph 1.2.19 and Gemini CLI

LangGraph 1.2.19, released October 30, fixes PR #9486: a node's trace_policy was applied to every callback handler, not only tracers. With process_outputs=omit_payload, "messages a node returned never reached stream_mode="messages"". Tracers now get the processed payload and stream handlers the real one. Another fix stops the tools stream reporting a tool paused on interrupt() as failed. In Gemini CLI, PR #30042, merged October 30, resolves symlinked workspace roots and entries to canonical paths in GlobTool, which had returned "No files found" or paths that the read and edit tools did not expect.

What remains uncertain. None of these notes says how often the bugs hit production. The ADK fixes are on main and not yet in a tagged release, and the Gemini CLI fix ships in nightly builds but not yet in a stable release.

Analysis: If you route one provider class to several base URLs, upgrade Pydantic AI and test a conversation that moves between them. For the help-desk agents at Belgavi's Book Store, Dinky could add two checks: that a memory search never returns the model's reasoning, and that a trace setting meant to shrink logs leaves the streamed reply unchanged.

Sources and evidence

Pydantic AI 2.64 (October 30) stops sending stored response, item and container IDs to a different endpoint under the same provider name and adds an opt-in ArtifactScanner for planted instructions in Memory and Skills; ADK Python (October 31) keeps the model's thought parts out of FirestoreMemoryService; LangGraph 1.2.19 stops trace_policy from emptying streamed messages; Gemini CLI resolves symlinked paths in GlobTool.