PydanticAI v1.107.7 回移 web_fetch 安全修复

AI 摘要

PydanticAI 发布 v1.107.7 维护版本，将 2.52.0 中的安全修复回移到 v1 分支。该漏洞（GHSA-v36g-jcw9-x7cw，中危）源于本地 web_fetch 工具处理攻击者控制的深层嵌套 HTML 时可能消耗过多 CPU 和内存，由 @SounLabs 报告；使用提供商原生网页抓取的功能不受影响。此外该版本将 genai-prices 依赖限制在 0.1 以下，以保持 token 用量提取与限额功能正常。

正文节选

### 🛡️ Security A maintenance release for the v1 line, carrying the v1 backport of the security fix released in `2.52.0`. See the advisory for full details and affected versions. - **[GHSA-v36g-jcw9-x7cw](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw)** (moderate): converting attacker-controlled HTML with deeply nested elements in the local `web_fetch` tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @SounL

发布时间：2026-09-30 08:54

抓取时间：2026-09-30 09:05

来源机构：Pydantic