Skip to content

chore(deps): bump pydantic-ai from 1.58.0 to 1.107.7 - #5

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/pydantic-ai-1.107.7
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/pydantic-ai-1.107.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown

Bumps pydantic-ai from 1.58.0 to 1.107.7.

Release notes

Sourced from pydantic-ai's releases.

v1.107.7 (2026-09-29)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backport of the security fix released in 2.52.0. See the advisory for full details and affected versions.

  • GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @​SounLabs. (#8985)

Patched in 1.107.7; also patched on the v2 line in 2.52.0.

What's Changed

🐛 Bug Fixes

Full Changelog: pydantic/pydantic-ai@v1.107.6...v1.107.7

v1.107.6 (2026-09-16)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in 2.44.0. See each advisory for full details and affected versions.

Also carried over: credentials are now dropped on a safe_download redirect whenever the full origin changes, not only the hostname (#8410). This was fixed on the v2 line some time ago and had never been backported.

Patched in 1.107.6; all four are also patched on the v2 line in 2.44.0.

What's Changed

Every code change in this release is one of the security fixes above. Maintenance alongside them:

Full Changelog: pydantic/pydantic-ai@v1.107.5...v1.107.6

v1.107.5 (2026-08-13)

What's Changed

🛡️ Security

  • GHSA-q2xc-rrxj-58x9: the local dev web chat UI (Agent.to_web(), clai web) didn't validate the Host header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in pydantic-ai/pydantic-ai-slim 1.107.5 by validating Host against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new allowed_hosts setting. Backport of allowed_hosts by @​DouweM in pydantic/pydantic-ai#7438

Full Changelog: pydantic/pydantic-ai@v1.107.4...v1.107.5

v1.107.4 (2026-08-11)

... (truncated)

Commits
  • 2fd3879 Backport bounded web_fetch HTML conversion to v1 (#8985)
  • ff899b4 Cap genai-prices below 0.1 to keep token usage extraction and limits workin...
  • 6022411 Remove stale harness-compat.yml from v1 (#9074)
  • 7ee27e3 Close two include_content redaction bypasses and make the content sweep pro...
  • 2faa618 Decode web_fetch response bodies in a worker thread and treat non-text char...
  • 6b22270 Check include_content=False over every content channel at once (v1 backport...
  • a9dab92 Compare web_fetch_tool domain lists in the form the resolver uses (v1 backp...
  • a93ea52 Extract the web_fetch page title with a linear scan and convert HTML in lin...
  • 963dec5 Share exception recording between the agent run, tool and model request spans...
  • 84d67aa Pin FastA2A below 1 in the a2a extra (v1) (#8412)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [pydantic-ai](https://github.com/pydantic/pydantic-ai) from 1.58.0 to 1.107.7.
- [Release notes](https://github.com/pydantic/pydantic-ai/releases)
- [Changelog](https://github.com/pydantic/pydantic-ai/blob/main/docs/changelog.md)
- [Commits](pydantic/pydantic-ai@v1.58.0...v1.107.7)

---
updated-dependencies:
- dependency-name: pydantic-ai
  dependency-version: 1.107.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants