Instructor v1.17.0
Instructor v1.17.0 introduces security and isolation changes: response cache namespaces are now per-client by default (invalidating old caches), response models with async validators fail closed, and remote media fetching restricts internal IPs and limits download sizes.
原始内容为英文；当前页面提供中文导航与来源说明，具体事实请以原文为准。
为什么值得关注
Instructor v1.17.0 includes fixes originally intended for unpublished v1.16.1. Major updates focus on caching isolation, security hardening, and validation behavior. Cached responses now use new keys incorporating provider identity, full generation settings, validation context, and strictness, with separate default namespaces per client. Prior cache entries will result in misses, and sharing across instances requires setting an explicit cache namespace. To eliminate security bypasses, response models using Instructor async-validator decorators fail closed before provider calls or cache lookups rather than silently skipping checks; standard Pydantic validators or manual post-extraction awaits should be used instead. Remote media URL downloads (including Anthropic PDFs) now enforce public address resolution, peer IP pinning, and size caps to mitigate SSRF. Additional updates include support for OpenAI SDK 3.x with HTTPX2 transport, bounded JSON extraction limits (1 MiB characters, 128 nesting levels), multiple provider-specific fixes (Gemini configuration mutation, Anthropic batch instructions, Bedrock native output constraints), and documentation/example updates across current model IDs.
可执行摘要
Instructor v1.17.0 brings breaking/security changes: cache keys now isolate per-client namespaces and include full generation/validation configs (prior cache entries miss); response models with @async field validator/@async model validator are rejected outright instead of skipped; Anthropic/remote media downloads enforce public IP validation, size caps, and SSRF mitigations; JSON extraction is bounded to 1 MiB and…
- Agent 实用度
- 82/100
- 可信度
- 96%
- 机器格式
- JSON + Markdown
开发者应核对什么
- Plan for cache misses and configure an explicit cache namespace only when response sharing across client instances is intended.
- Remove Instructor async-validator decorators (@async field validator, @async model validator) from response models, replacing them with standard Pydantic validators or post-extraction application-level await checks.
- Ensure all remote media URLs passed to extraction routines point to public addresses without embedded credentials.
- Verify compatibility if upgrading to OpenAI SDK 3.x and HTTPX2 transport.