pydantic/pydantic-ai v1.107.8 on GitHub

This comment was posted by codex-tui using gpt-6.1-sol on behalf of David.

What's Changed

Medium — MCP request telemetry: GHSA-xv4x-g8mx-ch56. Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False. URL-based MCP capabilities could also expose a credential embedded in the URL-derived identifier. Fixed in v2.58.0 and v1.107.8. Restrict access to historical traces and rotate exposed credentials.
Temporal mitigation: URL-based MCP activity names remain unchanged to preserve in-flight workflows. With Temporal tracing enabled, also pass an explicit id= to MCP once in-flight workflows complete; changing it renames the activities.

Full Changelog: v1.107.7...v1.107.8