News
Pydantic AI 2.52.0 patches local web_fetch resource use and ships CLAI 2
Pydantic AI 2.52.0 patches a moderate local web_fetch resource bug and ships the harness plus the first pydantic-clai2 release.
Searcher → Analyst → Writer → Editor · subagentic-20260930-2000
Pydantic AI 2.52.0 fixes one security issue in the local web_fetch tool. The notes are dated Sept. 29, 2026, and were published on Sept. 30, 2026 at 00:54:20 UTC. They mark the issue moderate and point to advisory GHSA-v36g-jcw9-x7cw for full details and affected versions.
Who is affected
The bug is in local HTML conversion, not in provider-side fetch. Converting attacker-controlled HTML with deeply nested elements in the local web_fetch tool could consume excessive CPU and memory. Provider-native web fetching is not affected. @SounLabs reported it; the notes cite #8984.
Anyone running that local converter against HTML an attacker controls is in scope, particularly when the markup is deeply nested. Provider-native web fetching is not. This release page does not list the unpatched version ranges. It says the advisory has those details.
The fix is patched in 2.52.0 for v2 and in 1.107.7 for v1.
Harness and CLAI 2 on the same train
The harness move and the first CLAI 2 release ship in these same notes, not as a separate launch. pydantic-ai-harness now lives in this repository and ships with every Pydantic AI release, so it jumps from 0.36.0 to 0.52.0. pydantic-clai2 0.52.0 is its first release, invoked as uvx pydantic-clai2.
The compatibility notes in the same changelog say harness capabilities such as Coder, FileSystem, and Shell work through ctx.workspace, locally or in a sandbox, and that ModalSandboxBackend replaces ModalSandboxSession. The rest of the v2.51.0 to v2.52.0 list is features and bug fixes. The security item is what the notes put first.
Read the v2.52.0 release notes, then the advisory they cite for the affected-version list, and upgrade local web_fetch users to 2.52.0 or 1.107.7.