pydantic/pydantic-ai v1.107.10

v1.107.10 (2026-11-04)

on GitHub

What's Changed

🛡️ Security

• GHSA-m5vj-8mcw-82qx (high): web_fetch_tool and the WebFetch capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected if an attacker can choose or influence the URLs the tool fetches. Provider-native web fetching is not affected. Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-5fj9-5pjw-vpwc (medium): The cloud-metadata blocklist that URL downloads check did not include Tencent Cloud's instance metadata address 169.254.0.23, so someone who can supply a URL the application downloads could have it fetch the instance's temporary role credentials. You are affected if you run on Tencent Cloud and allow local URLs, through force_download='allow-local' on a FileUrl or web_fetch_tool(allow_local_urls=True). Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-jp94-mmr3-2pvv (medium): With OpenTelemetry instrumentation enabled for embedding models, embedding spans recorded the extra_headers and extra_body embedding settings, so credentials passed through them could be read by anyone with access to the exported traces. You are affected if you instrument embedding models and pass secrets through those settings. Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim). Restrict access to historical traces and rotate credentials they exposed.
• GHSA-7494-925c-rrxv (medium): For models whose profile requires tool schemas without $defs and $ref, a small tool schema whose definitions reference one another repeatedly expanded exponentially when inlined on the event loop, which can take minutes of CPU time and gigabytes of memory. You are affected if you serve such a model through the AG-UI adapter, where clients submit their own frontend tool schemas. Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-r879-rxgj-3g75 (medium): The Vercel AI and AG-UI adapters took time that grows with the square of the number of parts to load a submitted message, on the event loop, so a single request could delay other work in the same process. You are affected if you pass client-submitted conversations to VercelAIAdapter or AGUIAdapter. Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-4cj4-hgwf-4hc4 (medium): When message history was serialized and loaded again, a tool result containing a JSON object in the serialized shape of one of Pydantic AI's file types was rebuilt as that file. A third party who controls data a tool returns could use this to make the application download a URL on its local network, or make the model provider read an s3:// object or uploaded file with the application's credentials. You are affected if tool results can contain data third parties control, that history is stored and reloaded or carried by Temporal, DBOS or Prefect durable execution, and your model or its provider fetches or resolves such files; the advisory lists which do. Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim).
• GHSA-5ppx-9jq6-6pmw (low): allowed_domains on the local web-fetch tool looked a refused hostname up in DNS before rejecting it, so data encoded in the hostname could reach that domain's nameserver. Domain lists are now checked before resolution. You are affected only if you rely on such an allowlist while the model processes content untrusted parties can influence. Fixed in v1.107.10 and v2.66.0 (pydantic-ai, pydantic-ai-slim).

Full Changelog: v1.107.9...v1.107.10