Bump pydantic-ai-slim from 1.106.0 to 1.107.7 - #2115

Sourced from pydantic-ai-slim's releases.

v1.107.7 (2026-09-29)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backport of the security fix released in 2.52.0. See the advisory for full details and affected versions.

• GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @​SounLabs. (#8985)

Patched in 1.107.7; also patched on the v2 line in 2.52.0.

What's Changed

🐛 Bug Fixes

• Cap genai-prices below 0.1 to keep token usage extraction and limits working by @​pydanty in pydantic/pydantic-ai#8842

Full Changelog: pydantic/pydantic-ai@v1.107.6...v1.107.7

v1.107.6 (2026-09-16)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in 2.44.0. See each advisory for full details and affected versions.

• GHSA-vmxc-h2x2-jmf3 (moderate): cloud-metadata and private-IP blocklist bypass via an IPv6 zone identifier, on a URL opted into local network access. Reported by @​euriconicacio. (#8402)
• GHSA-fpf4-vwcp-v4hp (moderate): superlinear response processing in web_fetch, in both the HTML conversion and the charset decode, blocking the event loop. Reported by @​BrianWillows. (#8399, #8434)
• GHSA-22h6-qm39-v87j (low): web_fetch_tool domain lists compared as written rather than in the form the resolver uses. (#8409)
• GHSA-4x9p-g9wm-8q7f (low): OpenTelemetry spans carrying exceptions, error statuses, instructions and the output template under include_content=False. Reported by @​BrianWillows. (#8404, #8422, #8429)

Also carried over: credentials are now dropped on a safe_download redirect whenever the full origin changes, not only the hostname (#8410). This was fixed on the v2 line some time ago and had never been backported.

Patched in 1.107.6; all four are also patched on the v2 line in 2.44.0.

What's Changed

Every code change in this release is one of the security fixes above. Maintenance alongside them:

• Repair v1 CI and its mcp, anthropic, and duckduckgo extras (v1 backport) by @​DouweM in pydantic/pydantic-ai#8406
• Pin FastA2A below 1 in the a2a extra (v1) by @​DouweM in pydantic/pydantic-ai#8412

Full Changelog: pydantic/pydantic-ai@v1.107.5...v1.107.6

v1.107.5 (2026-08-13)

What's Changed

🛡️ Security

• GHSA-q2xc-rrxj-58x9: the local dev web chat UI (Agent.to_web(), clai web) didn't validate the Host header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in pydantic-ai/pydantic-ai-slim 1.107.5 by validating Host against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new allowed_hosts setting. Backport of allowed_hosts by @​DouweM in pydantic/pydantic-ai#7438

Full Changelog: pydantic/pydantic-ai@v1.107.4...v1.107.5

v1.107.4 (2026-08-11)

... (truncated)

• 2fd3879 Backport bounded web_fetch HTML conversion to v1 (#8985)
• ff899b4 Cap genai-prices below 0.1 to keep token usage extraction and limits workin...
• 6022411 Remove stale harness-compat.yml from v1 (#9074)
• 7ee27e3 Close two include_content redaction bypasses and make the content sweep pro...
• 2faa618 Decode web_fetch response bodies in a worker thread and treat non-text char...
• 6b22270 Check include_content=False over every content channel at once (v1 backport...
• a9dab92 Compare web_fetch_tool domain lists in the form the resolver uses (v1 backp...
• a93ea52 Extract the web_fetch page title with a linear scan and convert HTML in lin...
• 963dec5 Share exception recording between the agent run, tool and model request spans...
• 84d67aa Pin FastA2A below 1 in the a2a extra (v1) (#8412)
• Additional commits viewable in compare view