pydantic-ai 2.30.0 / 1.107.5 · Host-header fix on local web UI — from issue No. 009nofeed.dev
No Feed
Issue No. 009 · 14 August 2026
Use it

pydantic-ai 2.30.0 / 1.107.5 · Host-header fix on local web UI

Second security patch this week for Agent.to_web() / clai web: no Host validation meant DNS rebinding from a page you visit could reach the local agent and its tools. Fixed by allowing localhost/loopback/LAN by default; real hostnames need allowed_hosts. GHSA-q2xc-rrxj-58x9.4

MATTERS TO · anyone who runs the pydantic-ai dev web chat on a workstation
WHAT THE VERDICT MEANS
Available, works, worth your time today.
Sources for this entry01 Claude Code docs — permission modes (auto default 14 Aug) (2026-08-14) · 02 github — claude-code v2.1.232 (2026-08-14) · 03 DeepSeek docs — Models & Pricing (peak/off-peak) (2026-08-14) · 04 github — pydantic-ai v2.30.0 (GHSA-q2xc-rrxj-58x9) (2026-08-14) · 05 GitHub changelog — Gemini 3.7 Flash in Copilot (2026-08-14) · 06 github — google-adk v2.7.0 (2026-08-14) · 07 OpenAI — Previewing Ultrafast mode (2026-08-14) · 08 Cerebras — Accelerating GPT-5.6 Sol Ultrafast (2026-08-14) · 09 HN — Accelerating GPT-5.6 Sol Ultrafast (2026-08-14) · 10 X — @trq212 auto mode field note (13 Aug accounts digest) (2026-08-14)

Also in this issue

read the whole thing →
BreakingDeepSeek API · peak/off-peak prices from 16 Aug 16:00 UTC
WaitGitHub Copilot · Gemini 3.7 Flash rolling out
Use itgoogle-adk 2.7.0 · model-declared capabilities + media tools

Get it by email.

One issue every weekday. The whole thing, not a teaser.

Or RSS, if you would rather we never had your address.