{
  "schema": "https://agentsnacks.ai/api/schema.json",
  "schema_version": "1.0",
  "generated": "2026-10-16",
  "publisher": "Agent Snacks",
  "tool": "pydantic-ai",
  "items": [
    {
      "id": "pack-002-5",
      "type": "weekly",
      "date": "2026-10-22",
      "tool": "pydantic-ai",
      "title": "Pydantic AI keeps MCP tokens out of traces",
      "summary": "Pydantic AI users, update now: two Medium security fixes are out, one for MCP credentials that could reach OpenTelemetry traces and one for the Vercel AI and AG-UI adapters. Upgrade to 2.58.0, or 1.107.8 on v1, then restrict access to old traces and rotate any credentials they exposed.",
      "spice": 3,
      "source_url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0",
      "source_urls": [
        "https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0"
      ],
      "shipped": null,
      "source_checked": true,
      "verified": true,
      "url": "https://agentsnacks.ai/packs/002/#pack-002-5",
      "issue": 2,
      "anchor": "pack-002-5",
      "emailed": "2026-10-22",
      "backfill": false,
      "category": null,
      "media": null,
      "teaser": "Pydantic AI users, update now: two Medium security fixes are out, one for MCP credentials that could reach OpenTelemetry traces and one for the Vercel AI and AG-UI adapters.",
      "also_in": [
        "daily-2026-10-20-pydantic-ai-mcp-trace-fix"
      ],
      "share_url": "https://agentsnacks.ai/s/pack-002-5/",
      "published_at": "2026-10-22T07:00:00-04:00"
    },
    {
      "id": "pack-002-3",
      "type": "weekly",
      "date": "2026-10-22",
      "tool": "pydantic-ai",
      "title": "Pydantic AI patches a High web_fetch bug",
      "summary": "Pydantic AI users, update now: a High-severity fix stops crafted web pages from tying up your app. When web_fetch_tool fetched attacker-controlled HTML with many elements, converting it could delay unrelated work in the same process. The maintainers published the fix on Oct 21, 2026: upgrade to 2.59.0, or 1.107.9 on v1.",
      "spice": 3,
      "source_url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4whf-38hw-pxxh",
      "source_urls": [
        "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4whf-38hw-pxxh"
      ],
      "shipped": null,
      "source_checked": true,
      "verified": true,
      "url": "https://agentsnacks.ai/packs/002/#pack-002-3",
      "issue": 2,
      "anchor": "pack-002-3",
      "emailed": "2026-10-22",
      "backfill": false,
      "category": null,
      "media": null,
      "teaser": "Pydantic AI users, update now: a High-severity fix stops crafted web pages from tying up your app.",
      "also_in": [
        "daily-2026-10-21-pydantic-ai-web-fetch-fix"
      ],
      "share_url": "https://agentsnacks.ai/s/pack-002-3/",
      "published_at": "2026-10-22T07:00:00-04:00"
    },
    {
      "id": "daily-2026-10-21-pydantic-ai-web-fetch-fix",
      "type": "daily",
      "date": "2026-10-21",
      "tool": "pydantic-ai",
      "title": "Pydantic AI patches a High web_fetch bug",
      "summary": "Pydantic AI users, update now: a High-severity fix stops crafted web pages from tying up your app. When web_fetch_tool fetched attacker-controlled HTML with many elements, converting it could delay unrelated work in the same process. The maintainers published the fix on Oct 21, 2026: upgrade to 2.59.0, or 1.107.9 on v1.",
      "spice": 3,
      "source_url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4whf-38hw-pxxh",
      "source_urls": [
        "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4whf-38hw-pxxh",
        "https://github.com/pydantic/pydantic-ai/releases/tag/v2.59.0",
        "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.9"
      ],
      "shipped": "2026-10-21",
      "source_checked": true,
      "verified": true,
      "url": "https://agentsnacks.ai/daily/2026-10-21-pydantic-ai-web-fetch-fix/",
      "issue": null,
      "backfilled": false,
      "backfill": false,
      "category": null,
      "media": null,
      "teaser": "Pydantic AI users, update now: a High-severity fix stops crafted web pages from tying up your app.",
      "also_in": [
        "pack-002-3"
      ],
      "share_url": "https://agentsnacks.ai/s/daily-2026-10-21-pydantic-ai-web-fetch-fix/",
      "published_at": "2026-10-21T07:00:00-04:00",
      "shipped_at": "2026-10-21T07:00:00-04:00"
    },
    {
      "id": "daily-2026-10-20-pydantic-ai-mcp-trace-fix",
      "type": "daily",
      "date": "2026-10-20",
      "tool": "pydantic-ai",
      "title": "Pydantic AI keeps MCP tokens out of traces",
      "summary": "Pydantic AI users, update now: two Medium security fixes are out, one for MCP credentials that could reach OpenTelemetry traces and one for the Vercel AI and AG-UI adapters. Upgrade to 2.58.0, or 1.107.8 on v1, then restrict access to old traces and rotate any credentials they exposed.",
      "spice": 3,
      "source_url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0",
      "source_urls": [
        "https://github.com/pydantic/pydantic-ai/releases/tag/v2.58.0"
      ],
      "shipped": "2026-10-20",
      "source_checked": true,
      "verified": true,
      "url": "https://agentsnacks.ai/daily/2026-10-20-pydantic-ai-mcp-trace-fix/",
      "issue": null,
      "backfilled": false,
      "backfill": false,
      "category": null,
      "media": null,
      "teaser": "Pydantic AI users, update now: two Medium security fixes are out, one for MCP credentials that could reach OpenTelemetry traces and one for the Vercel AI and AG-UI adapters.",
      "also_in": [
        "pack-002-5"
      ],
      "share_url": "https://agentsnacks.ai/s/daily-2026-10-20-pydantic-ai-mcp-trace-fix/",
      "published_at": "2026-10-20T07:00:00-04:00",
      "shipped_at": "2026-10-20T07:00:00-04:00"
    }
  ]
}