PydanticAI 发布 v1.107.10 修复 7 个安全漏洞
原标题：v1.107.10 (2026-11-04)
AI 摘要
PydanticAI 发布 v1.107.10（及 v2.66.0），修复了 7 个安全漏洞，其中 1 个高危、5 个中危、1 个低危。高危问题在于 web_fetch_tool 及 WebFetch 本地回退在事件循环上对 JSON 响应重新缩进，深层嵌套文档可膨胀数百倍，导致内存耗尽并阻塞同进程其他任务。其余问题涉及腾讯云元数据地址未纳入云元数据黑名单、OpenTelemetry 嵌入 span 泄露凭据、工具 schema 指数级展开、适配器消息加载平方级耗时、反序列化工具结果被重建为文件类型，以及 allowed_domains 在拒绝前先做 DNS 解析。
正文节选
## What's Changed ### 🛡️ Security * [GHSA-m5vj-8mcw-82qx](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-m5vj-8mcw-82qx) (high): `web_fetch_tool` and the `WebFetch` capability's local fallback re-indented a JSON response on the event loop before applying the returned-content limit, so a deeply nested document within the download size limit could expand to hundreds of times its size, using large amounts of memory and delaying other work in the same process. You are affected if a