Pydantic AI v1.107.8 (2026-10-19)

Pydantic AI releases published Pydantic AI v1.107.8 (2026-10-19). This automated release-watch entry was generated from the project's official GitHub release feed and is kept separate from human-reviewed editorial analysis. Release notes: This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security Medium — MCP request telemetry: GHSA-xv4x-g8mx-ch56 (https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-xv4x-g8mx-ch56). Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include content=False . URL-based MCP capabilities could also expose a credential embedded in the URL-derived identifier. Fixed in v2.58.0 and v1.107.8. Restrict access to historical traces and rotate exposed credentials. Temporal mitigation: URL-based MCP activity names remain unchanged to preserve in-flight workflows. With Temporal tracing enabled, also pass an explicit id= to MCP once in-flight workflows complete; changing it renames the activities. Full Changelog :…

• Review the official Pydantic AI releases release notes before upgrading.
• Check compatibility, migration, and security notes against your current agent stack.
• Run focused regression tests before production rollout.