Instructor Python Files

Security

• Bedrock: Block remote HTTP(S) image URL fetching in _openai_image_part_to_bedrock — only data: URLs accepted, preventing SSRF via user-controlled image URLs
• Bedrock/PDF: Block remote URL and local file fetching in PDF.to_bedrock — only base64 data or s3:// sources supported, preventing SSRF and local file disclosure

Added

• Hooks: completion:error and completion:last_attempt handlers now receive attempt_number, max_attempts, and is_last_attempt as keyword arguments. Old-style handlers remain fully backward-compatible.
• Anthropic: from_provider("anthropic/...") now sets a User-Agent: instructor/<version> header on the Anthropic client

Fixed

• Anthropic usage: Initialize usage correctly for ANTHROPIC_REASONING_TOOLS and ANTHROPIC_PARALLEL_TOOLS modes
• OpenRouter: Use reask_md_json for OPENROUTER_STRUCTURED_OUTPUTS retries instead of reask_default (tool-call format)
• Templating: Return kwargs unchanged instead of None in handle_templating when message list is empty or unrecognized
• from_openai: Allow Mode.JSON_SCHEMA for the OpenAI provider
• Bedrock: Pass through cachePoint dicts in message content unchanged (regression since v1.13.0)
• Bedrock: Allow Mode.MD_JSON in from_bedrock
• Parallel tools: ParallelBase generator consumed into ListResponse in both sync and async paths, fixing AttributeError

Dependencies

• Bump anthropic 0.76.0 → 0.88.0
• Bump litellm upper bound to ≤1.83.0
• Bump aiohttp 3.13.3 → 3.13.5