Qeravio
Canonical AI event

Security fix for HTML processing in v1.107.7

A security fix in v1.107.7 addresses excessive CPU and memory use in the local web_fetch tool. The bug was reported by @SounLabs.

30 Sept 20261 verified claims1 sources1 observations
What happened

The official source reports this update: v1.107.7 (2026-09-29). 🛡️ Security A maintenance release for the v1 line, carrying the v1 backport of the security fix released in 2.52.0 . See the advisory for full details and affected versions. GHSA-v36g-jcw9-x7cw (moderate): converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. Reported by @SounLabs . ( #8985 ) Patched in 1.107.7 ; also patched on the v2 line in 2.52.0 .

Why it matters

This official update documents a development concerning v1.107.7 (2026-09-29). Its practical significance depends on the scope and evidence stated by the source.

What to watch next

Read the official source update and verify its stated scope, evidence and timing before acting on it.

Connected knowledge

Entities affected by this event

Pydantic Aisubject
Continue this topic
agents-softwarePydantic AI 2.52.0 fixes web_fetch CPU and memory issue.30 Sept 2026agents-softwareGemini 3.1 Flash Live and 3.8 Live reject google_affective_dialog on connect26 Sept 2026agents-softwareDecisionModel routing now supports named routes with labels.25 Sept 2026agents-softwareNew GitHubCopilotOAuthFlow added for device authorization.24 Sept 2026agents-softwareSoftware Adds Support for New OpenAI and Claude Models23 Sept 2026agents-softwareTypeSafeModel now names None output routes in v2.47.022 Sept 2026
Evidence trail

Sources behind the event

Pydantic AI official releasesv1.107.7 (2026-09-29)
Editorial presentation

Read the public story

Open story