v1.107.7
pydantic/pydantic-aiv1.107.7Sep 30, 2026by dsfaccini
Upgrading?
AI Summary
A maintenance release for the v1 line addressing a security vulnerability in the local web_fetch tool and fixing a token usage extraction issue.
Key Highlights
- Security fix for GHSA-v36g-jcw9-x7cw: Prevents excessive CPU/memory usage when parsing attacker-controlled HTML in web_fetch.
- Bug fix: Caps `genai-prices` below 0.1 to ensure token usage extraction and limits work correctly.
- Provider-native web fetching is not affected by the security issue.
Full Release Notes
### 🛡️ Security A maintenance release for the v1 line, carrying the v1 backport of the security fix released in `2.52.0`. See the advisory for full details and affected versions. - **[GHSA-v36g-jcw9-x7cw](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw)** (moderate): converting attacker-controlled HTML with deeply nested elements in the local `web_fetch` tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @SounLabs. (#8985) Patched in `1.107.7`; also patched on the v2 line in `2.52.0`. ## What's Changed ### 🐛 Bug Fixes * Cap `genai-prices` below 0.1 to keep token usage extraction and limits working by [@pydanty](https://github.com/apps/pydanty) in https://github.com/pydantic/pydantic-ai/pull/8842 **Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.107.6...v1.107.7
Related Repositories
public-apis/public-apis★ 491,190
A collective list of free APIs
NousResearch/hermes-agent★ 256,045
The agent that grows with you
yt-dlp/yt-dlp★ 200,215
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,537
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.