Skip to content

Bump pydantic-ai-slim from 1.106.0 to 1.107.7 in the uv group across 1 directory - #168

Merged
amrit110 merged 1 commit into
mainfrom
dependabot/uv/uv-578706b8aa
Oct 15, 2026
Merged

amrit110 merged 1 commit into
mainfrom
dependabot/uv/uv-578706b8aa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 1 update in the / directory: pydantic-ai-slim.

Updates pydantic-ai-slim from 1.106.0 to 1.107.7

Release notes

Sourced from pydantic-ai-slim's releases.

v1.107.7 (2026-09-29)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backport of the security fix released in 2.52.0. See the advisory for full details and affected versions.

  • GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @​SounLabs. (#8985)

Patched in 1.107.7; also patched on the v2 line in 2.52.0.

What's Changed

🐛 Bug Fixes

Full Changelog: pydantic/pydantic-ai@v1.107.6...v1.107.7

v1.107.6 (2026-09-16)

🛡️ Security

A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in 2.44.0. See each advisory for full details and affected versions.

Also carried over: credentials are now dropped on a safe_download redirect whenever the full origin changes, not only the hostname (#8410). This was fixed on the v2 line some time ago and had never been backported.

Patched in 1.107.6; all four are also patched on the v2 line in 2.44.0.

What's Changed

Every code change in this release is one of the security fixes above. Maintenance alongside them:

Full Changelog: pydantic/pydantic-ai@v1.107.5...v1.107.6

v1.107.5 (2026-08-13)

What's Changed

🛡️ Security

  • GHSA-q2xc-rrxj-58x9: the local dev web chat UI (Agent.to_web(), clai web) didn't validate the Host header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in pydantic-ai/pydantic-ai-slim 1.107.5 by validating Host against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new allowed_hosts setting. Backport of allowed_hosts by @​DouweM in pydantic/pydantic-ai#7438

Full Changelog: pydantic/pydantic-ai@v1.107.4...v1.107.5

v1.107.4 (2026-08-11)

... (truncated)

Commits
  • 2fd3879 Backport bounded web_fetch HTML conversion to v1 (#8985)
  • ff899b4 Cap genai-prices below 0.1 to keep token usage extraction and limits workin...
  • 6022411 Remove stale harness-compat.yml from v1 (#9074)
  • 7ee27e3 Close two include_content redaction bypasses and make the content sweep pro...
  • 2faa618 Decode web_fetch response bodies in a worker thread and treat non-text char...
  • 6b22270 Check include_content=False over every content channel at once (v1 backport...
  • a9dab92 Compare web_fetch_tool domain lists in the form the resolver uses (v1 backp...
  • a93ea52 Extract the web_fetch page title with a linear scan and convert HTML in lin...
  • 963dec5 Share exception recording between the agent run, tool and model request spans...
  • 84d67aa Pin FastA2A below 1 in the a2a extra (v1) (#8412)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the uv group with 1 update in the / directory: [pydantic-ai-slim](https://github.com/pydantic/pydantic-ai).


Updates `pydantic-ai-slim` from 1.106.0 to 1.107.7
- [Release notes](https://github.com/pydantic/pydantic-ai/releases)
- [Changelog](https://github.com/pydantic/pydantic-ai/blob/main/docs/changelog.md)
- [Commits](pydantic/pydantic-ai@v1.106.0...v1.107.7)

---
updated-dependencies:
- dependency-name: pydantic-ai-slim
  dependency-version: 1.107.7
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 14, 2026
@amrit110
amrit110 merged commit 00529f9 into main Oct 15, 2026
4 checks passed
@amrit110
amrit110 deleted the dependabot/uv/uv-578706b8aa branch October 15, 2026 00:40
@amrit110

Copy link
Copy Markdown
Member

Automated fix applied and PR merged

The agentic fix loop successfully fixed this PR and merged it.

✓ Successfully fixed merge_only failures - Modified 0 files - Executed 123 agent actions - (84 info, 19 tool_call, 1 error, 15 tool_result, 4 reasoning)

View PR history on dashboard

AI Engineering Maintenance Bot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant