-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update dependency pydantic to v1 [SECURITY] #41
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/pypi-pydantic-vulnerability
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.15 [SECURITY]
May 1, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
2 times, most recently
from
May 1, 2024 15:02
8879379
to
9c15c1b
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.15 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
May 1, 2024
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.15 [SECURITY]
May 9, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
2 times, most recently
from
May 9, 2024 13:35
0444049
to
bb61728
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.15 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
May 9, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
May 15, 2024 16:41
bb61728
to
6f49832
Compare
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.15 [SECURITY]
May 15, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
May 16, 2024 00:58
6f49832
to
c147669
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.15 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
May 16, 2024
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.15 [SECURITY]
Jun 4, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
2 times, most recently
from
June 5, 2024 00:19
4cdb87f
to
b48c80e
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.15 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Jun 5, 2024
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.17 [SECURITY]
Jun 27, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
2 times, most recently
from
June 27, 2024 09:30
4a639cc
to
153b80e
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.17 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Jun 27, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
July 14, 2024 11:04
153b80e
to
737d62d
Compare
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.17 [SECURITY]
Jul 14, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
July 14, 2024 14:13
737d62d
to
25a3c73
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.17 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Jul 14, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
July 26, 2024 13:51
25a3c73
to
9559397
Compare
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.17 [SECURITY]
Jul 26, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
July 26, 2024 15:16
9559397
to
1e40ec2
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.17 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Jul 26, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
July 28, 2024 15:42
1e40ec2
to
518fa99
Compare
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.17 [SECURITY]
Jul 28, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
July 28, 2024 20:08
518fa99
to
a034eba
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.17 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Jul 28, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
October 9, 2024 07:24
a034eba
to
21c222d
Compare
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.18 [SECURITY]
Oct 9, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
October 9, 2024 09:35
21c222d
to
c2ef974
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.18 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Oct 9, 2024
renovate
bot
changed the title
Update dependency pydantic to v1 [SECURITY]
Update dependency pydantic to <=1.10.18 [SECURITY]
Oct 28, 2024
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
October 28, 2024 16:22
c2ef974
to
609d11e
Compare
renovate
bot
force-pushed
the
renovate/pypi-pydantic-vulnerability
branch
from
October 28, 2024 18:46
609d11e
to
8cc2430
Compare
renovate
bot
changed the title
Update dependency pydantic to <=1.10.18 [SECURITY]
Update dependency pydantic to v1 [SECURITY]
Oct 28, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
<=1.10.9
-><=1.10.13
GitHub Vulnerability Alerts
CVE-2024-3772
Regular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
Release Notes
pydantic/pydantic (pydantic)
v1.10.13
Compare Source
pydantic.validate_email
, #7673 by @hramezaniv1.10.12
Compare Source
maxlen
property being dropped ondeque
validation. Happened only if the deque item has been typed. Changes the_validate_sequence_like
func, #6581 by @maciekglowkav1.10.11
Compare Source
v1.10.10
Compare Source
Json
field support to settings management, #6250 by @hramezaniv1.10.9
Compare Source
v1.10.8
Compare Source
Literal
usage withtyping-extension==4.6.0
, #5826 by @hramezaniAnyClassMethod
for changes in python/typeshed#9771, #5505 by @ITProKylev1.10.7
Compare Source
ConstrainedStr
withregex
as dict key, #5223 by @matejetzfrom_orm
in their own classes, #5187 by @dmontaguInitVar
usage with pydantic dataclasses, mypy version1.1.1
and the custom mypy plugin, #5162 by @cdce8pv1.10.6
Compare Source
functools.partial
andfunctools.partialmethod
when checking the signature, #5126 by @JensHeinrichdataclass_transform
decorator for pydantic dataclasses, #5111 by @cdce8pValidationError
, notConfigError
, when a discriminator value is unhashable, #4773 by @kurtmckeev1.10.5
Compare Source
GenericModel
s with complex sets of models, #5052 by @MarkusSintonenRecursionError
when deep-copying dataclass types wrapped by pydantic, #4949 by @mbillingrX | Y
union syntax breakingGenericModel
, #4146 by @thenxv1.10.4
Compare Source
typing-extensions>=4.2.0
, #4885 by @samuelcolvinv1.10.3
Compare Source
NOTE: v1.10.3 was "yanked" from PyPI due to #4885 which is fixed in v1.10.4
schema
andschema_json
on models where a model instance is a one of default values, #4781 by @BobroniumDataclassProxy
, #4695 by @PrettyWoodpostgresql+psycopg
as allowed scheme forPostgreDsn
to make it usable with SQLAlchemy 2, #4689 by @morianpatternProperties
andadditionalProperties
, #4641 by @jpariseunique_items
, #4568 by @mfulgoGenericModel
withCallable
param raising aTypeError
, #4551 by @mfulgoStrictStr
type annotation, #4538 by @sispdataclass_transform
keyword argument name fromfield_descriptors
tofield_specifiers
, #4500 by @samuelcolvin__post_init__
when dataclasses are inherited, #4487 by @PrettyWoodv1.10.2
Compare Source
4_300
) strings/bytes as input to int fields, seepython/cpython#95778 and
CVE-2020-10735, #1477 by @samuelcolvin
tomllib
on Python 3.11 when parsingmypy
configuration, #4476 by @hauntsaninjaGenericModel
cache to detect order of arguments inUnion
models, #4474 by @sveinugulist
anddict
asdefault_factory
, #4457 by @samuelcolvinv1.10.1
Compare Source
to_lower_camel
to__all__
inutils.py
by @sydney-runkle (direct commit)mypy
v1 plugin for mypy 1.11 release by @flaeppe in https://github.com/pydantic/pydantic/pull/10139.schema(by_alias=False)
by @exs-dwoodward in https://github.com/pydantic/pydantic/pull/10146v1.10.0
Compare Source
dataclass
decorator to really act like its standard lib equivalent.It hence keeps
__eq__
,__hash__
, ... and makes comparison with its non-validated version possible.It also fixes usage of
frozen
dataclasses in fields and usage ofdefault_factory
in nested dataclasses.The support of
Config.extra
has been added.Finally, config customization directly via a
dict
is now possible, #2557 by @PrettyWoodBREAKING CHANGES:
compiled
boolean (whether pydantic is compiled with cython) has been moved frommain.py
toversion.py
Config.extra
is supported,dataclass
ignores by default extra arguments (likeBaseModel
)__set_name__
protocol inBaseModel
for PrivateAttrs, #4407 by @tlambert03parse_env_var
inConfig
, #4406 by @acmiyaguchimaster
tomain
, #4405 by @hramezaniStrictStr
does not raiseValidationError
whenmax_length
is present inField
, #4388 by @hramezaniSecretStr
andSecretBytes
hashable, #4387 by @chbndrhnnsStrictBytes
does not raiseValidationError
whenmax_length
is present inField
, #4380 by @JeanArhancettype
, #4375 by @hramezanire.Pattern
, #4366 by @hramezani__post_init_post_parse__
is incorrectly passed keyword arguments when no__post_init__
is defined, #4361 by @hramezaniForwardRef
andCallable
frompydantic.typing
instead oftyping
and also exposeMappingIntStrAny
, #4358 by @aminalaeeAny
types from thedataclass
decorator so it can be used with thedisallow_any_expr
mypy option, #4356 by @DetachHeadpydantic/pydantic
, #4348 by @yezz123Extra.forbid
is validated multiple times, #4343 by @detachheadoneOf
instead ofanyOf
when generating OpenAPI schema definitions, #4335 by @MaxwellPayneJson
type.Json[list[str]]
will be now inferred aslist[str]
,Json[Any]
should be used instead of plainJson
.Runtime behaviour is not changed, #4332 by @Bobronium
alias is not None
check, rather thanbool(alias)
, #4253 by @sergeytsaplinForwardRef
s inField.outer_type_
, #4249 by @JacobHayes__dataclass_transform__
has been replaced bytyping_extensions.dataclass_transform
, which is the preferred way to mark pydantic models as a dataclass under PEP 681, #4241 by @multimericConfig
when validating nestedNamedTuple
fields, #4219 by @synekBaseModel.construct
to work with aliased Fields, #4192 by @kylebamossmart_deepcopy
and revert todeepcopy
if so, #4184 by @coneybeareConfig.anystr_upper
andto_upper
kwarg to constr and conbytes, #4165 by @sathelerset
andfrozenset
when they include default values, #4155 by @aminalaee@validator
are classmethods, #4102 by @DMRobertsonType[]
in schema, #4051 by @aminalaeedefault
value in JSON Schema whenconst=True
, #4031 by @aminalaeeallow_inf_nan
, #3994 by @tiangoloenv_prefix
had characters in common withenv_nested_delimiter
, #3975 by @arsenroncreate_model
, #3945 by @hot123sBaseModel
, #3920 by @irgolicMinus was serialized in incorrect place ("P-1DT23H59M59.888735S" instead of correct "-P1DT23H59M59.888735S"), #3899 by @07pepa
supports the following schemes:
cockroachdb
,cockroachdb+psycopg2
andcockroachdb+asyncpg
, #3839 by @blubber__init__
method in models, #3824 by @patrick91BaseModel
instances, #3777 by @PrettyWoodConstrainedDate
andcondate
, #3740 by @hottwajkw_only
in dataclasses, #3670 by @detachheadColor
class, #3646 by @aminalaeeto_lower_camel()
for "non pascal case" camel case, #3463 by @schlerpdefault
anddefault_factory
arguments in Mypy plugin, #3430 by @klaa97inspect.signature
forBaseModel
, #3413 by @fix-inspect-signatureSecretField
abstract class so that all the current and future secret fields likeSecretStr
andSecretBytes
will derive from it, #3409 by @expobrainPostgresDsn
, #3337 by @rglskSecretsSettingsSource
to respectconfig.case_sensitive
, #3273 by @JeanArhancetConfigError
when multiple fields are incorrectly set for a single validator, #3215 by @SunsetOrangeField
s insideAnnotated
forTypedDicts
required, #3133 by @ezegomezint_validator
, #3112 by @ojii__rich_repr__
method toRepresentation
class which enables pretty printing with Rich, #3099 by @willmcguganAnyUrl
and descendent types, #3061 by @FaresAhmedbvalidate_arguments
decorator now supportsalias
, #3019 by @MAD-py__dict__
and__weakref__
attributes inAnyUrl
and IP address fields, #2890 by @nuno-andreFinal
in a field type annotation, #2766 by @uriyyotyping_extensions>=4.1.0
to guaranteedataclass_transform
is available, #4424 by @commonismcopy_on_model_validation
to reflect recent changes, #4369 by @samuelcolvin__slots__
is passed tocreate_model
,__slots__
is then ignored, #4432 by @samuelcolvinBaseSettings.Config
to avoid mypy errors, also correct mypy version compatibility notice in docs, #4450 by @samuelcolvinv1.9.2
Compare Source
Revert Breaking Change: v1.9.1 introduced a breaking change where model fields were
deep copied by default, this release reverts the default behaviour to match v1.9.0 and before,
while also allow deep-copy behaviour via
copy_on_model_validation = 'deep'
. See #4092 for more information.Config.copy_on_model_validation
is now a str which must be'none'
,'deep'
, or'shallow'
corresponding to not copying, deep copy & shallow copy; default'shallow'
,#4093 by @timkpaine
v1.9.1
Compare Source
Thank you to pydantic's sponsors:
@tiangolo, @stellargraph, @JonasKs, @grillazz, @Mazyod, @kevinalh, @chdsbd, @povilasb, @povilasb, @jina-ai,
@mainframeindustries, @robusta-dev, @SendCloud, @rszamszur, @jodal, @hardbyte, @corleyma, @daddycocoaman,
@Rehket, @jokull, @reillysiemens, @westonsteimel, @primer-io, @koxudaxi, @browniebroke, @stradivari96,
@adriangb, @kamalgill, @jqueguiner, @dev-zero, @datarootsio, @RedCarpetUp
for their kind support.
generics._generic_types_cache
andgenerics._assigned_parameters
to avoid unlimited increase in memory usage, #4083 by @samuelcolvin
__isinstancecheck__
on pydantic models when the type is not a model, may also avoid memory "leaks", #4081 by @samuelcolvinFieldInfo
that caused problems with PEP 593 type aliases, #4067 by @adriangb__dataclass_transform__
when usingpydantic.dataclasses.dataclass
, #4006 by @giuliano-oliveiraClassVar
s in models, #3679 by @samuelcolvinConfig.copy_on_model_validation
does a deep copy and not a shallow one, #3641 by @PrettyWoodread_text(encoding='utf-8')
forsetup.py
, #3625 by @hswong3iv1.9.0
Compare Source
Thank you to pydantic's sponsors:
@sthagen, @timdrijvers, @toinbis, @koxudaxi, @ginomempin, @primer-io, @and-semakin, @westonsteimel, @reillysiemens,
@es3n1n, @jokull, @JonasKs, @Rehket, @corleyma, @daddycocoaman, @hardbyte, @datarootsio, @jodal, @aminalaee, @rafsaf,
@jqueguiner, @chdsbd, @kevinalh, @Mazyod, @grillazz, @JonasKs, @simw, @leynier, @xfenix
for their kind support.
Highlights
Config.smart_union
for better union logic, #2092 by @PrettyWoodfoo___bar
, #3159 by @Air-Mark__dataclass_transform__
, #2721 by @tiangolov1.9.0 (2021-12-31) Changes
update_forward_refs
toConfig.json_encodes
prevent name clashes in types defined via strings, #3583 by @samuelcolvin0.910
,0.920
,0.921
&0.930
, #3573 & #3594 by @PrettyWood, @christianbundy, @samuelcolvinv1.9.0a2 (2021-12-24) Changes
json()
by default, #3542 by @PrettyWood__root__
attribute fromBaseModel
, #3540 by @laydayextra
fields with model__repr__
, #3234 by @cocolmanConfig.copy_on_model_validation
always have all fields, #3201 by @PrettyWoodv1.9.0a1 (2021-12-18) Changes
Decimal
-specific validation configurations inField()
, additionally to usingcondecimal()
,to allow better support from editors and tooling, #3507 by @tiangolo
arm64
binaries suitable for MacOS with an M1 CPU to PyPI, #3498 by @samuelcolvinNone
was considered invalid when using aUnion
type containingAny
orobject
, #3444 by @tharradinefield
argument (of typepydantic.fields.ModelField
) to__modify_schema__()
if present, #3434 by @jasujmtyping.ClassVar
string type annotation, #3401 by @uriyyotyping_extensions.TypedDict
, #3374 by @BvB93to more accurately describe what the validator is doing; changed from
name_must_contain_space
tovalue_must_equal_bar
, #3327 by @michaelrios28AmqpDsn
class, #3254 by @kludexEnum
value as default in generated JSON schema, #3190 by @joaommartinsvalidate_arguments
now supportsextra
customization (used to always beExtra.forbid
), #3161 by @PrettyWoodpydantic.utils.is_valid_field
so that it ignores untyped private variables, #3146 by @hi-ogawavalidate_arguments
issue withConfig.validate_all
, #3135 by @PrettyWoodobject
type, #3062 by @PrettyWood_special
properties on parent classes, #3043 by @zulrangTypedDict
class for error objects, #3038 by @matthewhughes934create_model_from_typeddict
mypy compliant, #3008 by @PrettyWoodPrivateAttr
, #2989 by @hmvpUnion
type with a complex subfield, #2936 by @cbartzStrictStr
permittingEnum
values where the enum inherits fromstr
, #2929 by @samuelcolvinSecretsSettingsSource
parse values being assigned to fields of complex types when sourced from a secrets file,just as when sourced from environment variables, #2917 by @davidmreed
pydantic-mypy
plugin compatible withpyproject.toml
configuration, consistent withmypy
changes.See the doc for more information, #2908 by @jrwalk
Json[T]
, #2860 by @geekingfrogdespite pydantic being primarily a parsing library, #2855 by @paxcodes
Deque
fields, #2810 by @sergejkozinLiteral
, #2794 by @PrettyWoodNamedTuple
andTypedDict
when they're used directly as the type of fieldswithin Pydantic models, #2760 by @jameysharp
mypy
plugin fails onconstruct
method call forBaseSettings
derived classes, #2753 by @uriyyopydantic.create_model
function, #2748 by @uriyyoChanged it to a period, #2733 by @krisaoe
schema
toschema_
to avoid shadowing of global variable name, #2724 by @shahriyarr__dataclass_transform__
, #2721 by @tiangoloBaseConfig
and handlemax_length = 0
, #2719 by @PrettyWoodorm_mode
checking to allow recursive ORM mode parsing with dicts, #2718 by @nuno-andreNamedTuple
and has a default value, #2707 by @PrettyWoodEnum
fields now properly support extra kwargs in schema generation, #2697 by @sammchardyuniqueItems
option toConstrainedList
, #2618 by @nuno-andre__version__
attribute to pydantic module, #2572 by @paxcodespostgresql+asyncpg
,postgresql+pg8000
,postgresql+psycopg2
,postgresql+psycopg2cffi
,postgresql+py-postgresql
and
postgresql+pygresql
schemes forPostgresDsn
, #2567 by @postgres-asyncpgdecimal_places
argument is specified, #2524 by @cwe5590collections.abc.Callable
to be used as type in Python 3.9, #2519 by @daviskirksetup.py
to allow for custom CFLAGS when compiling, #2517 by @peterroelants
default_factory
to run it only once even ifConfig.validate_all
is set, #2515 by @PrettyWoodAnyUrl
hosts. This allows urls with DNS labelslooking like IPs to validate as they are perfectly valid host names, #2512 by @sbv-csis
minItems
andmaxItems
in generated JSON schema for fixed-length tuples, #2497 by @PrettyWoodstrict
argument toconbytes
, #2489 by @koxudaxiGetterDict
to docs, #2463 by @nuno-andreKafkaDsn
type,HttpUrl
now has default port 80 for http and 443 for https, #2447 by @MihanixAPastDate
andFutureDate
types, #2425 by @KludexGeneric
fields with subtypes, #2375 by @maximbergNameEmail
to str, #2341 by @alecgeronaConfig.smart_union
to prevent coercion inUnion
if possible, seethe doc for more information, #2092 by @PrettyWood
typing.Counter
as a model field type, #2060 by @uriyyo__bases__
when constructing new parameterised classes, so thatA <: B => A[int] <: B[int]
, #2007 by [@diabolo-dan](https://redirect.github.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.