pydantic/pydantic-ai v2.58.0: v2.58.0 (2026-10-19)
Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with includecontent=False.
ProofCode ↗
Key points
- > This comment was posted by codex-tui using gpt-6.1-sol on behalf of David.
- <!-- Release notes generated using configuration in .github/release.yml at b40096c4c91e4db361ee3f23b0e3f6b85569faa2 -->
- Restrict access to historical traces and rotate exposed credentials.
- Temporal mitigation: URL-based MCP activity names remain unchanged to preserve in-flight workflows.
Sources (1)
- [1]pydantic/pydantic-ai v2.58.0: v2.58.0 (2026-10-19)GitHub: pydantic/pydantic-ai · Oct 20, 04:58 AM
Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with `include_content=False`.
> This comment was posted by codex-tui using gpt-6.1-sol on behalf of David.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 20, 2026Do Diffusion LLMs Scale? Testing Mercury 3 + Decide
- Oct 20, 2026AnyLanguageModel 1.0: One Year of Local Models on Apple Platforms
- Oct 19, 2026Structured outputs for Anthropic Claude models on Amazon Bedrock
- Oct 19, 2026MiniMax M3.1 Flash shows China's AI price race has no floor in sight
- Oct 19, 2026Advancing Coding in Low-Resource Programming Languages
- Oct 18, 2026BerriAI/litellm v1.106.0