v1.107.1

pydantic/pydantic-aiv1.107.1Jul 11, 2026by dsfaccini

AI Summary

A security patch release on the v1 line addressing a moderate vulnerability (GHSA-jpr8-2v3g-wgf9) in the AG-UI `UIAdapter.sanitize_messages` method. The patch prevents dangling tool calls from being re-executed with client-chosen arguments when trailing messages are dropped during sanitization.

Key Highlights

Security patch for GHSA-jpr8-2v3g-wgf9 (CWE-863)
Fixes dangling tool-call re-exposure in AG-UI sanitize_messages
Patches v1 >= 1.88.0, < 1.107.1
Backports fix from v2.5.0

Full Release Notes

## What's Changed

### 🛡️ Security

This release patches **[GHSA-jpr8-2v3g-wgf9](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9)** (moderate, CWE-863) on the v1 line. On the AG-UI serving path (`Agent.to_ag_ui()` / `AGUIAdapter`), `UIAdapter.sanitize_messages` anchored its dangling-tool-call strip to an index computed before sanitization. When a trailing client message was dropped during sanitization (for example a client `system` message under the default `manage_system_prompt='server'`), a preceding assistant response carrying an unresolved tool call could be re-exposed as the new tail and executed with client-chosen arguments.

- **Affected**: `pydantic-ai` / `pydantic-ai-slim` `>= 1.88.0, < 1.107.1` (v1) and `>= 2.0.0, < 2.5.0` (v2)
- **Patched**: `1.107.1` (v1) and `2.5.0` (v2)
- **Not affected** if every sensitive tool uses `requires_approval=True` / `ApprovalRequiredToolset`, or if your tool handlers validate their arguments and enforce authorization themselves.

See the [advisory](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9) for details and workarounds.

### 🐛 Bug Fixes
* Fix `sanitize_messages` tail handling when a trailing client message is dropped by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6407

**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.107.0...v1.107.1