pydantic/pydantic-ai v1.107.8: v1.107.8 (2026-10-19)
Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with includecontent=False.
ProofCode ↗
Key points
- > This comment was posted by codex-tui using gpt-6.1-sol on behalf of David.
- Restrict access to historical traces and rotate exposed credentials.
- Temporal mitigation: URL-based MCP activity names remain unchanged to preserve in-flight workflows.
- With Temporal tracing enabled, also pass an explicit id= to MCP once in-flight workflows complete; changing it renames the activities.
Sources (1)
- [1]pydantic/pydantic-ai v1.107.8: v1.107.8 (2026-10-19)GitHub: pydantic/pydantic-ai · Oct 20, 04:58 AM
Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with `include_content=False`.
> This comment was posted by codex-tui using gpt-6.1-sol on behalf of David.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 20, 2026pydantic/pydantic-ai v2.58.0: v2.58.0 (2026-10-19)
- Oct 20, 2026MiniMax H3 - Really is the best open-source video model.
- Oct 20, 2026Do Diffusion LLMs Scale? Testing Mercury 3 + Decide
- Oct 19, 2026EGI-BENCH: An Enterprise General Intelligence Benchmark Suite
- Oct 19, 2026Agent World Model in the Wild: Computer-Use Agent Environment Synthesis
- Oct 18, 2026BerriAI/litellm v1.106.0