Pydantic AI v1.107.7 patches local web_fetch issue and adjusts genai-prices
Pydantic AI says v1.107.7 patches a moderate local web_fetch resource-consumption issue involving deeply nested, attacker-controlled HTML. It also caps genai-prices below 0.1 for token-usage extraction and limits. The full affected-version range and installation details are not present in the supplied release record. [1]
This edition passed Imananq's enhanced publication checks. Some material claims remain explicitly attributed to official or company sources because no independent source is currently bound to this edition. The engine continues checking approved sources and will add corroboration only through a new edition that passes the full gate.
Pydantic AI v1.107.7 is a maintenance update for the v1 line. The project records that it patches a moderate resource-consumption issue in the local web_fetch tool and constrains genai-prices below version 0.1 to preserve token-usage extraction and limits. [1]
01
What we know now
- 01
[1] Pydantic AI, v1.107.7 official release record: https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7.
- 02
The release record states that v1.107.7 backports the v2.52.0 security fix, patches GHSA-v36g-jcw9-x7cw in local web_fetch, and caps genai-prices below 0.1.
02
v1 patch version recorded by the project
The release record identifies v1.107.7 as the v1 patch for the reported local web_fetch issue.Related v2 version named in the release
The project says the same fix was released on the v2 line in v2.52.0.Issue severity recorded in the release
The release labels GHSA-v36g-jcw9-x7cw as moderate.Fetching mode stated as unaffected
The release distinguishes provider-native web fetching from the affected local web_fetch tool.Release-record summary; scope and severity are first-party statements.
03
Local web_fetch patch
This release backports to the v1 line a security fix that the project says was released in v2.52.0. The stated scenario is specifically the conversion of attacker-controlled HTML with deeply nested elements using the local web_fetch tool. [1]
The supplied release record does not specify which earlier v1 versions are affected. Maintainers should therefore consult the linked advisory for full details and affected versions, rather than infer the complete exposure range from this note alone. [1]
- The project describes GHSA-v36g-jcw9-x7cw as a moderate issue. [1]
- According to the release record, deeply nested, attacker-controlled HTML processed through local web_fetch could consume excessive CPU and memory. [1]
- The project states that provider-native web fetching is not affected. [1]
- The record says the issue is patched in v1.107.7 and was also patched in v2.52.0. [1]
04
Dependency compatibility adjustment
Alongside the patch, Pydantic AI records a dependency constraint on genai-prices. This is a relevant compatibility change for v1 users relying on token accounting or configured limits. [1]
The release note does not explain the exact behavior that occurred before the cap, nor does it provide package-resolution details. Test affected workflows after applying the update. [1]
05
Source and remaining unknowns
The primary source is Pydantic AI's official v1.107.7 release record: https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7. It is the basis for the patch, scope, severity, and dependency statements in this brief. [1]
The supplied material does not include the advisory's full text, standard installation instructions, or confirmation of distribution availability. Those details remain unknown from this evidence packet. [1]
06
What maintainers can do
Review v1 deployments that use the local web_fetch tool with untrusted HTML and plan an update to v1.107.7. Check dependency resolution for the genai-prices constraint if token-usage extraction or limits are part of the deployment. [1]
- 01
Update the maintained v1 line to v1.107.7 where the local web_fetch tool processes attacker-controlled HTML. [1]
- 02
Verify that dependency resolution accepts genai-prices below 0.1 and test token-usage extraction and limits after updating. [1]
- 03
Consult the linked advisory for full details and affected versions. [1]
07
Limits of this edition
The supplied release record does not give the full affected-version range or detailed remediation steps; it directs readers to the linked advisory. [1]
The supplied evidence does not establish package-distribution availability or provide installation instructions.
The release notes do not describe the exact previous failure mode addressed by the genai-prices cap.
Severity, affected scope, and patch status are reported by the project in its release record and are not independently verified here. [1]
SRC
Source desk
Direct links to the material behind this selection. Seeing the source matters as much as reading the synthesis.
Keep exploring
23 Aug 2026
Ollama v0.32.0 reports a new agent workflow and integration updates
Ollama’s v0.32.0 release notes report an interactive agent launched by running `ollama`, a renamed ChatGPT integration, a simplified integration menu, and pre-launch warnings for specified older agent-model families.
30 Aug 2026
Node.js v26.5.1 records 10 CVE-tagged security changes
Node.js records v26.5.1 as a security release with ten CVE-tagged changes: two High, five Medium and three Low by the project's own ratings. The note includes concise patch descriptions across HTTP/2, HTTPS, permissions, SQLite, DNS, zlib and HTTP, plus llhttp 9.4.3 and undici 8.9.0 updates. It does not specify affected versions, vulnerability impact, exploitability, mitigations or upgrade guidance. [1]
22 Aug 2026
Node.js v26.7.0: documented changes for developers
Node.js v26.7.0 is identified in the supplied official record as the Current release. Its highlighted changes cover private-key loading through STORE loaders, root certificates updated to NSS 3.125, Perfetto support, Symbol.dispose in ModuleHooks, and a test-runner coverage option. [1]