What changed
The day after v2.60.0's major feature release, v2.61.0 ships hardening and a meaningful new capability. Citations: TextPart now carries structured citations (#7434); citations from Bedrock, OpenRouter, and xAI are normalized and replayed to the provider that produced them (#7750, #7752); the Vercel AI adapter also preserves them (#9639). Thinking guardrails: Models that can't disable thinking now receive the lowest thinking level they accept when thinking=False (#11036); a warning fires when a provider-specific thinking override silently conflicts with the thinking= parameter (#10231). Security: InputGuardrail now redacts the user's own prompt in fail-open paths (#10841), closing a path where an unhandled guardrail exception could leak the prompt to the model. New models: kimi-k3.1-pro and kimi-k3.1-pro-highspeed model names are added (#11173). Also: LocalStack now shares one container within async with agent: rather than spawning fresh ones per run, fixing resource waste in test suites.
TL;DR
pydantic-ai v2.61.0 adds structured citations in TextPart (normalized across Bedrock/OpenRouter/xAI), closes a guardrail fail-open security path, and adds kimi-k3.1-pro model names.
Developer signal
Citations: If you build applications where model responses need to trace back to sources (RAG, document Q&A), update to v2.61.0 and explore TextPart.citations — Bedrock, OpenRouter, and xAI citations are already normalized, so provider-switching preserves citation structure. Thinking guardrails: If you pass thinking=False to a model that can't actually disable thinking (e.g., some Anthropic extended thinking models), the behavior was previously undefined — now it sends the minimum allowed thinking level. If you pass provider-specific thinking configs at a broad scope (e.g., in a model default), you'll now get a warning when it silently overrides a narrower thinking= setting. Review your model configuration if you use extended thinking. InputGuardrail: If you have custom guardrails with fail-open exception handling, update immediately — the previous behavior could expose the user's prompt to the model on a guardrail error. Check #10841 for the exact fix. LocalStack: If you run AWS integration tests with LocalStack, you're no longer spawning a new container per async with agent: — shared container reduces test setup time.