pydantic-ai

v1.102.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agent-framework genai llm pydantic python

Affected surfaces

rce_ssrf

ReleasePort's take

Light signal

editorial:auto 11d

The release expands IPv6 transition‑form handling in URL validation to block SSRF cloud‑metadata bypass.

Why it matters: Blocks a class of SSRF attacks exploiting cloud metadata via malformed IPv6 URLs; upgrade to v1.102.0 immediately if your services perform URL validation.

Summary

AI summary

Updates 🛡️ Security, 🐛 Bug Fixes, and bedrock across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Expand IPv6 transition-form handling in URL validation to block SSRF cloud-metadata bypass. Expand IPv6 transition-form handling in URL validation to block SSRF cloud-metadata bypass. Source: llm_adapter@2026-05-23 Confidence: low	—
Bugfix
Bugfix	Medium	Don't auto-promote `strict=None` tools to strict mode with Bedrock and skip `strict` field when `botocore` is too old. Don't auto-promote `strict=None` tools to strict mode with Bedrock and skip `strict` field when `botocore` is too old. Source: llm_adapter@2026-05-23 Confidence: high	—
Bugfix	Medium	Prevent false positive `variable_instructions` span attribute in instrumentation. Prevent false positive `variable_instructions` span attribute in instrumentation. Source: llm_adapter@2026-05-23 Confidence: high	—
Bugfix	Medium	Normalize trailing dot and case in `WebFetchTool` domain matching. Normalize trailing dot and case in `WebFetchTool` domain matching. Source: llm_adapter@2026-05-23 Confidence: high	—
Bugfix	Medium	Disable Opus 4.7 native structured output in Bedrock fix. Disable Opus 4.7 native structured output in Bedrock fix. Source: llm_adapter@2026-05-23 Confidence: low	—
Bugfix	Medium	Allow `VercelAIAdapter` to accept `providerExecuted` and `title` on dynamic-tool message parts. Allow `VercelAIAdapter` to accept `providerExecuted` and `title` on dynamic-tool message parts. Source: llm_adapter@2026-05-23 Confidence: low	—

Full changelog

What's Changed

🛡️ Security

Expand IPv6 transition-form handling in URL validation by @DouweM in https://github.com/pydantic/pydantic-ai/pull/5596
- Security advisory: SSRF cloud-metadata blocklist bypass via additional IPv6 transition forms https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59
- You are affected only if your application explicitly opts a FileUrl into force_download='allow-local' on a URL that is, or could be, influenced by untrusted input, AND runs on a NAT64- or ISATAP-configured network (e.g. some IPv6-only or dual-stack-with-NAT64 Kubernetes setups).
- You are not affected if you run on a standard dual-stack cloud VM or container, which does not route these forms in practice.
- You are not affected if you use any of the bundled integrations to ingest user input: Agent.to_web / clai web; VercelAIAdapter; AGUIAdapter / Agent.to_ag_ui

🐛 Bug Fixes

Don't auto-promote strict=None tools to strict mode with Bedrock, and skip strict field when botocore is too old by @shailendher in https://github.com/pydantic/pydantic-ai/pull/5580
fix(bedrock): Disable Opus 4.7 native structured output by @cosmopolitan033 in https://github.com/pydantic/pydantic-ai/pull/5582
fix(instrumentation): Prevent false positive variable_instructions span attribute by @madanlalit in https://github.com/pydantic/pydantic-ai/pull/5487
Fix: VercelAIAdapter now accepts providerExecuted / title on dynamic-tool message parts by @he-yufeng in https://github.com/pydantic/pydantic-ai/pull/5474
Normalize trailing dot and case in WebFetchTool domain matching by @DouweM in https://github.com/pydantic/pydantic-ai/pull/5592

New Contributors

@cosmopolitan033 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5582
@he-yufeng made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5474

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v1.101.0...v1.102.0

Security Fixes

GHSA-cg7w-rg45-pc59 — SSRF cloud‑metadata blocklist bypass via additional IPv6 transition forms

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pydantic-ai

Get notified when new releases ship.

About pydantic-ai

AI Agent Framework, the Pydantic way

All releases →

Related context

Related tools

Earlier breaking changes

v1.95.0 rename ‘built-in tools’ to ‘native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]