PydanticAI v2.52.0：修复 web_fetch 安全问题并发布 CLAI 2

AI 摘要

PydanticAI 发布 v2.52.0，修复了本地 web_fetch 工具处理攻击者控制的深层嵌套 HTML 时可能导致 CPU 和内存过度消耗的中危安全问题，v1 分支同步发布 1.107.7 补丁。该版本将 pydantic-ai-harness 并入主仓库并随每次发布更新，同时首次发布 pydantic-clai2 0.52.0。此外新增工作区抽象 ctx.workspace、多种沙箱后端（E2B、Sprites、SSH、Bubblewrap）以及 Claude Sonnet 5.5 等模型支持。

正文节选

### 🛡️ Security This release fixes one security issue in `web_fetch`. See the advisory for full details and affected versions. - **[GHSA-v36g-jcw9-x7cw](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw)** (moderate): converting attacker-controlled HTML with deeply nested elements in the local `web_fetch` tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @SounLabs. (#8984) Patched in `2.52.0` (v2) and `1.107.7`

发布时间：2026-09-30 08:54

抓取时间：2026-09-30 09:05

来源机构：Pydantic