Pydantic AI v1.107.6 (2026-09-16)
Pydantic AI v1.107.6 is a security maintenance release backporting four vulnerabilities from v2.44.0, including SSRF/IP-blocklist bypasses and DoS issues.
原始内容为英文；当前页面提供中文导航与来源说明，具体事实请以原文为准。
为什么值得关注
Pydantic AI release v1.107.6 is a dedicated security backport release for the v1 branch, mirroring fixes introduced in v2.44.0. The updates resolve four reported advisories: GHSA-vmxc-h2x2-jmf3 (bypassing cloud-metadata and private-IP blocklists via IPv6 zone identifiers), GHSA-fpf4-vwcp-v4hp (superlinear HTML conversion and charset decode in web fetch causing event loop blocking), GHSA-22h6-qm39-v87j (properly normalizing domain lists in web fetch tools against DNS resolver forms), and GHSA-4x9p-g9wm-8q7f (preventing OpenTelemetry spans from leaking exceptions, error statuses, instructions, and templates when include content=False). Additionally, credentials are now dropped on safe download redirects if the origin changes, alongside minor CI and dependency maintenance.
可执行摘要
Pydantic AI v1.107.6 backports four security fixes addressing private-IP blocklist bypasses (IPv6 zone identifiers), event loop-blocking ReDoS/superlinear processing in web fetch, domain resolution checks, and OpenTelemetry data leakage when include content=False.
- Agent 实用度
- 82/100
- 可信度
- 96%
- 机器格式
- JSON + Markdown
开发者应核对什么
- Upgrade Pydantic AI to v1.107.6 if maintaining a v1 deployment (or to v2.44.0 if on v2).
- Review web fetch configurations if relying on private IP blocklists or domain restrictions to mitigate SSRF and event loop blocking.