v1.107.1

docling-project/doclingv1.107.1Jul 11, 2026by dsfaccini

AI Summary

A security-focused patch release addressing a vulnerability (GHSA-jpr8-2v3g-wgf9) where dangling tool calls could be re-executed, alongside a specific bug fix for message sanitization.

Key Highlights

Patched security advisory GHSA-jpr8-2v3g-wgf9 (dangling tool-call execution)
Fixed sanitize_messages tail handling when a trailing client message is dropped

Full Release Notes

## What's Changed

### 🛡️ Security

This release patches **[GHSA-jpr8-2v3g-wgf9](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9)** (moderate, CWE-863) on the v1 line. On the AG-UI serving path (`Agent.to_ag_ui()` / `AGUIAdapter`), `UIAdapter.sanitize_messages` anchored its dangling-tool-call strip to an index computed before sanitization. When a trailing client message was dropped during sanitization (for example a client `system` message under the default `manage_system_prompt='server'`), a preceding assistant response carrying an unresolved tool call could be re-exposed as the new tail and executed with client-chosen arguments.

- **Affected**: `pydantic-ai` / `pydantic-ai-slim` `>= 1.88.0, < 1.107.1` (v1) and `>= 2.0.0, < 2.5.0` (v2)
- **Patched**: `1.107.1` (v1) and `2.5.0` (v2)
- **Not affected** if every sensitive tool uses `requires_approval=True` / `ApprovalRequiredToolset`, or if your tool handlers validate their arguments and enforce authorization themselves.

See the [advisory](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9) for details and workarounds.

### 🐛 Bug Fixes
* Fix `sanitize_messages` tail handling when a trailing client message is dropped by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6407

**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.107.0...v1.107.1