ReleaseBytes
python Pydantic AI Releases · · 1.107.6

Pydantic AI v1.107.6 Delivers Critical Security Fixes Backported from v2.44.0

sdksecuritysecurity-advisoryengineerpython-agentic
security

Pydantic AI v1.107.6 has been released, providing a maintenance update that backports four security fixes previously addressed in the v2 line's 2.44.0 release. These fixes resolve vulnerabilities including an IPv6 zone identifier bypass, superlinear response processing, domain comparison issues in web_fetch_tool, and sensitive content in OpenTelemetry spans. Additionally, the update ensures credentials are now dropped on `safe_download` redirects when the full origin changes, enhancing security for users on the v1 branch.

  • →GHSA-22h6-qm39-v87j (low): web_fetch_tool domain lists compared as written rather than in the form the resolver uses. (#8409)
  • →Repair v1 CI and its mcp, anthropic, and duckduckgo extras (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/8406
  • →Pin FastA2A below 1 in the a2a extra (v1) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/8412
Security (6) ›

  • GHSA-vmxc-h2x2-jmf3 (moderate): cloud-metadata and private-IP blocklist bypass via an IPv6 zone identifier, on a URL opted into local network access. Reported by @euriconicacio. (#8402)

  • GHSA-fpf4-vwcp-v4hp (moderate): superlinear response processing in web_fetch, in both the HTML conversion and the charset decode, blocking the event loop. Reported by @BrianWillows. (#8399, #8434)

  • GHSA-22h6-qm39-v87j (low): web_fetch_tool domain lists compared as written rather than in the form the resolver uses. (#8409)

  • GHSA-4x9p-g9wm-8q7f (low): OpenTelemetry spans carrying exceptions, error statuses, instructions and the output template under include_content=False. Reported by @BrianWillows. (#8404, #8422, #8429)

  • Repair v1 CI and its mcp, anthropic, and duckduckgo extras (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/8406
  • Pin FastA2A below 1 in the a2a extra (v1) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/8412
Read the original announcement →

https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6

Related releases