pydantic-ai

v1.107.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 16d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agent-framework genai llm pydantic python

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

Version v1.107.1 patches GHSA-jpr8-2v3g-wgf9 by fixing sanitize_messages tail handling in pydantic‑ai.

Why it matters: Patches CVE GHSA-jpr8-2v3g-wgf9 (severity 70) affecting `Agent.to_ag_ui()` and `AGUIAdapter` paths; upgrade to v1.107.1 immediately if using those APIs.

Summary

AI summary

Updates https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9, v2, and 🐛 Bug Fixes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Patches GHSA-jpr8-2v3g-wgf9 vulnerability in sanitize_messages tail handling. Patches GHSA-jpr8-2v3g-wgf9 vulnerability in sanitize_messages tail handling. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes sanitize_messages tail handling when a trailing client message is dropped. Fixes sanitize_messages tail handling when a trailing client message is dropped. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

What's Changed

🛡️ Security

This release patches GHSA-jpr8-2v3g-wgf9 (moderate, CWE-863) on the v1 line. On the AG-UI serving path (Agent.to_ag_ui() / AGUIAdapter), UIAdapter.sanitize_messages anchored its dangling-tool-call strip to an index computed before sanitization. When a trailing client message was dropped during sanitization (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call could be re-exposed as the new tail and executed with client-chosen arguments.

Affected: pydantic-ai / pydantic-ai-slim >= 1.88.0, < 1.107.1 (v1) and >= 2.0.0, < 2.5.0 (v2)
Patched: 1.107.1 (v1) and 2.5.0 (v2)
Not affected if every sensitive tool uses requires_approval=True / ApprovalRequiredToolset, or if your tool handlers validate their arguments and enforce authorization themselves.

See the advisory for details and workarounds.

🐛 Bug Fixes

Fix sanitize_messages tail handling when a trailing client message is dropped by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/6407

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v1.107.0...v1.107.1

Security Fixes

GHSA-jpr8-2v3g-wgf9 — moderate (CWE-863) fixed in pydantic‑ai v1.107.1 and v2.5.0; sanitization tail handling corrected

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pydantic-ai

Get notified when new releases ship.

About pydantic-ai

AI Agent Framework, the Pydantic way

All releases →

Related context

Related tools

Earlier breaking changes

v1.95.0 rename ‘built-in tools’ to ‘native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]