Pydantic AI v1.107.6 (2026-09-16)

Pydantic AI releases published Pydantic AI v1.107.6 (2026-09-16). This release-watch entry was generated from the project's official GitHub release feed and is kept separate from human-reviewed editorial analysis. Release notes: 🛡️ Security A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in 2.44.0 . See each advisory for full details and affected versions. GHSA-vmxc-h2x2-jmf3 (moderate): cloud-metadata and private-IP blocklist bypass via an IPv6 zone identifier, on a URL opted into local network access. Reported by @euriconicacio . ( 8402 ) GHSA-fpf4-vwcp-v4hp (moderate): superlinear response processing in web fetch , in both the HTML conversion and the charset decode, blocking the event loop. Reported by @BrianWillows . ( 8399 , 8434 ) GHSA-22h6-qm39-v87j (low): web fetch tool domain lists compared as written rather than in the form the resolver uses. ( 8409 ) GHSA-4x9p-g9wm-8q7f (low): OpenTelemetry spans carrying exceptions, error statuses, instructions and the output template under include content=False . Reported by @BrianWillows . ( 8404 , 8422 , 8429…

• Review the official Pydantic AI releases release notes before upgrading.
• Check compatibility, migration, and security notes against your current agent stack.
• Run focused regression tests before production rollout.