Pydantic AI v2.44.0 patches four web_fetch and OTel security holes
Pydantic AI
Pydantic AI v2.44.0 (Sep 16, with v1.107.6 backporting the same fixes) fixes four advisories reachable through web_fetch_tool or OpenTelemetry instrumentation: IPv6 zone-identifier bypass of SSRF blocklists, a superlinear web_fetch response path that could stall every agent in a process, blocklist bypass via alternate domain spellings, and OTel spans leaking exceptions and instructions despite include_content=False.
Why it matters
Every agent framework ships the same web-fetch surface; these are concrete SSRF/DoS/silent-data-leak bugs that other frameworks likely still carry.
Importance: 3/5
Security release fixing four advisories in a widely used agent framework