pydantic-ai 2.28.0 · web UI CSRF fix — from issue No. 007nofeed.dev
No Feed
Issue No. 007 · 12 August 2026
Use it

pydantic-ai 2.28.0 · web UI CSRF fix

High-severity fix for Agent.to_web() / clai web: the chat endpoint ignored content type, so a cross-origin page in the developer's browser could trigger the local agent and its tools without a CORS preflight. Now requires Content-Type: application/json. Patched in 2.28.0 and 1.107.3.4

MATTERS TO · anyone who runs the pydantic-ai dev web chat on a workstation
WHAT THE VERDICT MEANS
Available, works, worth your time today.
Sources for this entry01 x.ai — Introducing Grok Bot (2026-08-12) · 02 testingcatalog — Cursor Origin / Review tabs (2026-08-12) · 03 github — openai-python v3.0.0 (2026-08-12) · 04 github — pydantic-ai v2.28.0 (2026-08-12) · 05 github — ollama v0.32.9 (2026-08-12) · 06 github changelog — MAI-Code-1.1-Flash (2026-08-12) · 07 github changelog — MAI-Code-1-Flash deprecation (2026-08-12) · 08 github changelog — Copilot JetBrains memory/Ollama (2026-08-12) · 09 reddit pulse — LocalLLaMA / ClaudeAI / cursor (12 Aug) (2026-08-12)

Also in this issue

read the whole thing →
Breakingopenai-python 3.0.0 · HTTPX2 default
Use itOllama 0.32.9 · Nemotron 3.5 Lightning
WaitCopilot · MAI-Code-1.1-Flash in, 1-Flash out 10 Sept
Use itCopilot for JetBrains · memory + Ollama BYOK

Get it by email.

One issue every weekday. The whole thing, not a teaser.

Or RSS, if you would rather we never had your address.