PydanticAI v2.44.0 修复四个安全问题

AI 摘要

PydanticAI 发布 v2.44.0，修复了四个安全问题，均通过 web_fetch_tool 或 OpenTelemetry 埋点触发，包括 IPv6 zone identifier 绕过云元数据与私有 IP 黑名单、web_fetch 处理响应时间超线性导致事件循环阻塞、域名黑名单比较方式不一致可被绕过，以及 InstrumentationSettings(include_content=False) 下 span 仍泄露异常与指令内容。补丁已在 2.44.0（v2）和 1.107.6（v1）中发布。此外该版本还包含兼容性调整、新功能与多项 bug 修复。

正文节选

### 🛡️ Security This release fixes four security issues, all of them reached through `web_fetch_tool` or OpenTelemetry instrumentation. See each advisory for full details and affected versions. - **[GHSA-vmxc-h2x2-jmf3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3)** (moderate): the cloud-metadata and private-IP blocklists could be bypassed with an IPv6 zone identifier on a URL opted into local network access, via `FileUrl(force_download='allow-local')` or `w

发布时间：2026-09-17 12:03

抓取时间：2026-09-19 18:03

来源机构：Pydantic