v1.107.2

pydantic/pydantic-aiv1.107.2Aug 8, 2026by dsfaccini

AI Summary

Security patch to prevent unbounded memory use when downloading remote content via the local web_fetch tool.

Key Highlights

Fix for unbounded memory use vulnerability (GHSA-v2xh-2vp8-57h8)
Enforce default 50 MiB download cap

Full Release Notes

### 🛡️ Security

Fixes an availability vulnerability: unbounded memory use when downloading remote content via the local `web_fetch` tool or `FileUrl` media downloads, which could exhaust process memory and crash the worker. Patched versions enforce a default 50 MiB download cap. See [GHSA-v2xh-2vp8-57h8](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8). Patched in `1.107.2` (v1) and `2.24.0` (v2).

## What's Changed
### 🐛 Bug Fixes
* Bound HTTP response body sizes for `web_fetch` and media URL downloads by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7308


**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.107.1...v1.107.2