v1.107.8
pydantic/pydantic-aiv1.107.8Oct 20, 2026by dsfaccini
Upgrading?
AI Summary
This release focuses on a security fix addressing a vulnerability in MCP request telemetry that could expose sensitive data like server URLs and authorization tokens in OpenTelemetry traces.
Key Highlights
- Security patch for MCP telemetry exposure (GHSA-xv4x-g8mx-ch56)
- Mitigation requires restricting access to historical traces and rotating exposed credentials
Full Release Notes
> This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. ## What's Changed ### 🛡️ Security * **Medium — MCP request telemetry:** [GHSA-xv4x-g8mx-ch56](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-xv4x-g8mx-ch56). Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with `include_content=False`. URL-based `MCP` capabilities could also expose a credential embedded in the URL-derived identifier. Fixed in v2.58.0 and v1.107.8. Restrict access to historical traces and rotate exposed credentials. **Temporal mitigation:** URL-based `MCP` activity names remain unchanged to preserve in-flight workflows. With Temporal tracing enabled, also pass an explicit `id=` to `MCP` once in-flight workflows complete; changing it renames the activities. **Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.107.7...v1.107.8
Related Repositories
public-apis/public-apis★ 491,190
A collective list of free APIs
NousResearch/hermes-agent★ 256,046
The agent that grows with you
yt-dlp/yt-dlp★ 200,215
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,539
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.