Pydantic AI 2.58–2.61 closes telemetry, tool and guardrail gaps
Pydantic AI's 2.58–2.61 patch train closes a telemetry leak of MCP URLs, tokens and headers; a UI-adapter path that could execute client-chosen tool arguments without a model request; attacker-controlled HTML conversion that could delay unrelated work; and later fail-open InputGuardrail, BrowserUse secret-redaction and capability-manifest persistence gaps.
Why it matters: The affected paths cross credentials, client-supplied history, web content, browser tools and guardrails—the exact places teams often assume the framework has already enforced a boundary. Fixing the code does not remove secrets from historical traces or…