Pydantic AI v2.44.0 (2026-09-16)
Pydantic AI v2.44.0 fixes four security vulnerabilities affecting web fetch and OpenTelemetry spans, and includes compatibility updates such as requiring JSON Content-Type headers for UI adapter requests.
原始内容为英文；当前页面提供中文导航与来源说明，具体事实请以原文为准。
为什么值得关注
Pydantic AI v2.44.0 resolves four security issues across web fetch tools and OpenTelemetry instrumentation: (1) an IPv6 zone identifier bypass on local network access blocklists (GHSA-vmxc-h2x2-jmf3), (2) a DoS vulnerability caused by superlinear HTML conversion and charset decoding in web fetch responses (GHSA-fpf4-vwcp-v4hp), (3) unnormalized domain comparisons allowing domain blocklist bypasses (GHSA-22h6-qm39-v87j), and (4) information leakage in OpenTelemetry spans despite include content=False (GHSA-4x9p-g9wm-8q7f). These fixes are also backported to v1.107.6. Breaking and compatibility changes include requiring a JSON Content-Type header on UI adapter requests, thread-safety updates for RunContext.enqueue(), and proper dispatching of @durable capability operations invoked in per-request hooks.
可执行摘要
Pydantic AI v2.44.0 addresses four security advisories (GHSA-vmxc-h2x2-jmf3, GHSA-fpf4-vwcp-v4hp, GHSA-22h6-qm39-v87j, GHSA-4x9p-g9wm-8q7f) involving URL validation bypasses, superlinear processing DoS in web fetch, domain matching, and telemetry data leakage. Compatibility changes include enforcing a JSON Content-Type on UI adapter requests and making RunContext.enqueue() thread-safe.
- Agent 实用度
- 82/100
- 可信度
- 96%
- 机器格式
- JSON + Markdown
开发者应核对什么
- Upgrade Pydantic AI to v2.44.0 (or v1.107.6 for v1 users) to remediate web fetch and OpenTelemetry security vulnerabilities.
- Ensure client requests to UI adapters explicitly include a JSON Content-Type header to avoid breaking changes.
- Verify web fetch configurations if using custom domain blocklists or local network access settings.