PydanticAI v1.107.8 修复 MCP 遥测凭据泄露漏洞
原标题：v1.107.8 (2026-10-19)
AI 摘要
PydanticAI 发布 v1.107.8 版本，修复了一个中危安全漏洞（GHSA-xv4x-g8mx-ch56）：当启用 OpenTelemetry 请求追踪时，即使设置 include_content=False，provider 原生 MCP 配置仍可能泄露服务器 URL、授权令牌和自定义请求头值，基于 URL 的 MCP 能力也可能暴露 URL 标识符中内嵌的凭据。该漏洞已在 v2.58.0 和 v1.107.8 中修复，官方建议限制历史追踪数据的访问权限并轮换已暴露的凭据。
正文节选
> This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. ## What's Changed ### 🛡️ Security * **Medium — MCP request telemetry:** [GHSA-xv4x-g8mx-ch56](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-xv4x-g8mx-ch56). Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with `include_content=False`. URL-based `MCP` capabilities could also expose a credential embedded in