This repository was archived by the owner on Nov 11, 2024. It is now read-only.
Update dependency pydantic to v1.10.13 [SECURITY] - #23
Closed
DorskFR wants to merge 1 commit into
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.8.2->==1.10.13Pydantic regular expression denial of service
CVE-2024-3772 / GHSA-mr82-8j83-vxmv
More information
Details
Regular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
pydantic/pydantic (pydantic)
v1.10.13Compare Source
pydantic.validate_email, #7673 by @hramezaniv1.10.12Compare Source
maxlenproperty being dropped ondequevalidation. Happened only if the deque item has been typed. Changes the_validate_sequence_likefunc, #6581 by @maciekglowkav1.10.11Compare Source
v1.10.10Compare Source
Jsonfield support to settings management, #6250 by @hramezaniv1.10.9Compare Source
v1.10.8Compare Source
Literalusage withtyping-extension==4.6.0, #5826 by @hramezaniAnyClassMethodfor changes in python/typeshed#9771, #5505 by @ITProKylev1.10.7Compare Source
ConstrainedStrwithregexas dict key, #5223 by @matejetzfrom_ormin their own classes, #5187 by @dmontaguInitVarusage with pydantic dataclasses, mypy version1.1.1and the custom mypy plugin, #5162 by @cdce8pv1.10.6Compare Source
functools.partialandfunctools.partialmethodwhen checking the signature, #5126 by @JensHeinrichdataclass_transformdecorator for pydantic dataclasses, #5111 by @cdce8pValidationError, notConfigError, when a discriminator value is unhashable, #4773 by @kurtmckeev1.10.5Compare Source
GenericModels with complex sets of models, #5052 by @MarkusSintonenRecursionErrorwhen deep-copying dataclass types wrapped by pydantic, #4949 by @mbillingrX | Yunion syntax breakingGenericModel, #4146 by @thenxv1.10.4Compare Source
typing-extensions>=4.2.0, #4885 by @samuelcolvinv1.10.3Compare Source
NOTE: v1.10.3 was "yanked" from PyPI due to #4885 which is fixed in v1.10.4
schemaandschema_jsonon models where a model instance is a one of default values, #4781 by @BobroniumDataclassProxy, #4695 by @PrettyWoodpostgresql+psycopgas allowed scheme forPostgreDsnto make it usable with SQLAlchemy 2, #4689 by @morianpatternPropertiesandadditionalProperties, #4641 by @jpariseunique_items, #4568 by @mfulgoGenericModelwithCallableparam raising aTypeError, #4551 by @mfulgoStrictStrtype annotation, #4538 by @sispdataclass_transformkeyword argument name fromfield_descriptorstofield_specifiers, #4500 by @samuelcolvin__post_init__when dataclasses are inherited, #4487 by @PrettyWoodv1.10.2Compare Source
4_300) strings/bytes as input to int fields, seepython/cpython#95778 and
CVE-2020-10735, #1477 by @samuelcolvin
tomllibon Python 3.11 when parsingmypyconfiguration, #4476 by @hauntsaninjaGenericModelcache to detect order of arguments inUnionmodels, #4474 by @sveinugulistanddictasdefault_factory, #4457 by @samuelcolvinv1.10.1Compare Source
v1namespace to fix typing and object resolution in python>3.11 by @exs-dwoodward in https://github.com/pydantic/pydantic/pull/9660v1.10.0Compare Source
dataclassdecorator to really act like its standard lib equivalent.It hence keeps
__eq__,__hash__, ... and makes comparison with its non-validated version possible.It also fixes usage of
frozendataclasses in fields and usage ofdefault_factoryin nested dataclasses.The support of
Config.extrahas been added.Finally, config customization directly via a
dictis now possible, #2557 by @PrettyWoodBREAKING CHANGES:
compiledboolean (whether pydantic is compiled with cython) has been moved frommain.pytoversion.pyConfig.extrais supported,dataclassignores by default extra arguments (likeBaseModel)__set_name__protocol inBaseModelfor PrivateAttrs, #4407 by @tlambert03parse_env_varinConfig, #4406 by @acmiyaguchimastertomain, #4405 by @hramezaniStrictStrdoes not raiseValidationErrorwhenmax_lengthis present inField, #4388 by @hramezaniSecretStrandSecretByteshashable, #4387 by @chbndrhnnsStrictBytesdoes not raiseValidationErrorwhenmax_lengthis present inField, #4380 by @JeanArhancettype, #4375 by @hramezanire.Pattern, #4366 by @hramezani__post_init_post_parse__is incorrectly passed keyword arguments when no__post_init__is defined, #4361 by @hramezaniForwardRefandCallablefrompydantic.typinginstead oftypingand also exposeMappingIntStrAny, #4358 by @aminalaeeAnytypes from thedataclassdecorator so it can be used with thedisallow_any_exprmypy option, #4356 by @DetachHeadpydantic/pydantic, #4348 by @yezz123Extra.forbidis validated multiple times, #4343 by @detachheadoneOfinstead ofanyOfwhen generating OpenAPI schema definitions, #4335 by @MaxwellPayneJsontype.Json[list[str]]will be now inferred aslist[str],Json[Any]should be used instead of plainJson.Runtime behaviour is not changed, #4332 by @Bobronium
alias is not Nonecheck, rather thanbool(alias), #4253 by @sergeytsaplinForwardRefs inField.outer_type_, #4249 by @JacobHayes__dataclass_transform__has been replaced bytyping_extensions.dataclass_transform, which is the preferred way to mark pydantic models as a dataclass under PEP 681, #4241 by @multimericConfigwhen validating nestedNamedTuplefields, #4219 by @synekBaseModel.constructto work with aliased Fields, #4192 by @kylebamossmart_deepcopyand revert todeepcopyif so, #4184 by @coneybeareConfig.anystr_upperandto_upperkwarg to constr and conbytes, #4165 by @sathelersetandfrozensetwhen they include default values, #4155 by @aminalaee@validatorare classmethods, #4102 by @DMRobertsonType[]in schema, #4051 by @aminalaeedefaultvalue in JSON Schema whenconst=True, #4031 by @aminalaeeallow_inf_nan, #3994 by @tiangoloenv_prefixhad characters in common withenv_nested_delimiter, #3975 by @arsenroncreate_model, #3945 by @hot123sBaseModel, #3920 by @irgolicMinus was serialized in incorrect place ("P-1DT23H59M59.888735S" instead of correct "-P1DT23H59M59.888735S"), #3899 by @07pepa
supports the following schemes:
cockroachdb,cockroachdb+psycopg2andcockroachdb+asyncpg, #3839 by @blubber__init__method in models, #3824 by @patrick91BaseModelinstances, #3777 by @PrettyWoodConstrainedDateandcondate, #3740 by @hottwajkw_onlyin dataclasses, #3670 by @detachheadColorclass, #3646 by @aminalaeeto_lower_camel()for "non pascal case" camel case, #3463 by @schlerpdefaultanddefault_factoryarguments in Mypy plugin, #3430 by @klaa97inspect.signatureforBaseModel, #3413 by @fix-inspect-signatureSecretFieldabstract class so that all the current and future secret fields likeSecretStrandSecretByteswill derive from it, #3409 by @expobrainPostgresDsn, #3337 by @rglskSecretsSettingsSourceto respectconfig.case_sensitive, #3273 by @JeanArhancetConfigErrorwhen multiple fields are incorrectly set for a single validator, #3215 by @SunsetOrangeFields insideAnnotatedforTypedDictsrequired, #3133 by @ezegomezint_validator, #3112 by @ojii__rich_repr__method toRepresentationclass which enables pretty printing with Rich, #3099 by @willmcguganAnyUrland descendent types, #3061 by @FaresAhmedbvalidate_argumentsdecorator now supportsalias, #3019 by @MAD-py__dict__and__weakref__attributes inAnyUrland IP address fields, #2890 by @nuno-andreFinalin a field type annotation, #2766 by @uriyyotyping_extensions>=4.1.0to guaranteedataclass_transformis available, #4424 by @commonismcopy_on_model_validationto reflect recent changes, #4369 by @samuelcolvin__slots__is passed tocreate_model,__slots__is then ignored, #4432 by @samuelcolvinBaseSettings.Configto avoid mypy errors, also correct mypy version compatibility notice in docs, #4450 by @samuelcolvinv1.9.2Compare Source
Revert Breaking Change: v1.9.1 introduced a breaking change where model fields were
deep copied by default, this release reverts the default behaviour to match v1.9.0 and before,
while also allow deep-copy behaviour via
copy_on_model_validation = 'deep'. See #4092 for more information.Config.copy_on_model_validationis now a str which must be'none','deep', or'shallow'corresponding to not copying, deep copy & shallow copy; default'shallow',#4093 by @timkpaine
v1.9.1Compare Source
Thank you to pydantic's sponsors:
@tiangolo, @stellargraph, @JonasKs, @grillazz, @Mazyod, @kevinalh, @chdsbd, @povilasb, @povilasb, @jina-ai,
@mainframeindustries, @robusta-dev, @SendCloud, @rszamszur, @jodal, @hardbyte, @corleyma, @daddycocoaman,
@Rehket, @jokull, @reillysiemens, @westonsteimel, @primer-io, @koxudaxi, @browniebroke, @stradivari96,
@adriangb, @kamalgill, @jqueguiner, @dev-zero, @datarootsio, @RedCarpetUp
for their kind support.
generics._generic_types_cacheandgenerics._assigned_parametersto avoid unlimited increase in memory usage, #4083 by @samuelcolvin
__isinstancecheck__on pydantic models when the type is not a model, may also avoid memory "leaks", #4081 by @samuelcolvinFieldInfothat caused problems with PEP 593 type aliases, #4067 by @adriangb__dataclass_transform__when usingpydantic.dataclasses.dataclass, #4006 by @giuliano-oliveiraClassVars in models, #3679 by @samuelcolvinConfig.copy_on_model_validationdoes a deep copy and not a shallow one, #3641 by @PrettyWoodread_text(encoding='utf-8')forsetup.py, #3625 by @hswong3iv1.9.0Compare Source
Thank you to pydantic's sponsors:
@sthagen, @timdrijvers, @toinbis, @koxudaxi, @ginomempin, @primer-io, @and-semakin, @westonsteimel, @reillysiemens,
@es3n1n, @jokull, @JonasKs, @Rehket, @corleyma, @daddycocoaman, @hardbyte, @datarootsio, @jodal, @aminalaee, @rafsaf,
@jqueguiner, @chdsbd, @kevinalh, @Mazyod, @grillazz, @JonasKs, @simw, @leynier, @xfenix
for their kind support.
Highlights
Config.smart_unionfor better union logic, #2092 by @PrettyWoodfoo___bar, #3159 by @Air-Mark__dataclass_transform__, #2721 by @tiangolov1.9.0 (2021-12-31) Changes
update_forward_refstoConfig.json_encodesprevent name clashes in types defined via strings, #3583 by @samuelcolvin0.910,0.920,0.921&0.930, #3573 & #3594 by @PrettyWood, @christianbundy, @samuelcolvinv1.9.0a2 (2021-12-24) Changes
json()by default, #3542 by @PrettyWood__root__attribute fromBaseModel, #3540 by @laydayextrafields with model__repr__, #3234 by @cocolmanConfig.copy_on_model_validationalways have all fields, #3201 by @PrettyWoodv1.9.0a1 (2021-12-18) Changes
Decimal-specific validation configurations inField(), additionally to usingcondecimal(),to allow better support from editors and tooling, #3507 by @tiangolo
arm64binaries suitable for MacOS with an M1 CPU to PyPI, #3498 by @samuelcolvinNonewas considered invalid when using aUniontype containingAnyorobject, #3444 by @tharradinefieldargument (of typepydantic.fields.ModelField) to__modify_schema__()if present, #3434 by @jasujmtyping.ClassVarstring type annotation, #3401 by @uriyyotyping_extensions.TypedDict, #3374 by @BvB93to more accurately describe what the validator is doing; changed from
name_must_contain_spacetovalue_must_equal_bar, #3327 by @michaelrios28AmqpDsnclass, #3254 by @kludexEnumvalue as default in generated JSON schema, #3190 by @joaommartinsvalidate_argumentsnow supportsextracustomization (used to always beExtra.forbid), #3161 by @PrettyWoodpydantic.utils.is_valid_fieldso that it ignores untyped private variables, #3146 by @hi-ogawavalidate_argumentsissue withConfig.validate_all, #3135 by @PrettyWoodobjecttype, #3062 by @PrettyWood_specialproperties on parent classes, #3043 by @zulrangTypedDictclass for error objects, #3038 by @matthewhughes934create_model_from_typeddictmypy compliant, #3008 by @PrettyWoodPrivateAttr, #2989 by @hmvpUniontype with a complex subfield, #2936 by @cbartzStrictStrpermittingEnumvalues where the enum inherits fromstr, #2929 by @samuelcolvinSecretsSettingsSourceparse values being assigned to fields of complex types when sourced from a secrets file,just as when sourced from environment variables, #2917 by @davidmreed
pydantic-mypyplugin compatible withpyproject.tomlconfiguration, consistent withmypychanges.See the doc for more information, #2908 by @jrwalk
Json[T], #2860 by @geekingfrogdespite pydantic being primarily a parsing library, #2855 by @paxcodes
Dequefields, #2810 by @sergejkozinLiteral, #2794 by @PrettyWoodNamedTupleandTypedDictwhen they're used directly as the type of fieldswithin Pydantic models, #2760 by @jameysharp
mypyplugin fails onconstructmethod call forBaseSettingsderived classes, #2753 by @uriyyopydantic.create_modelfunction, #2748 by @uriyyoChanged it to a period, #2733 by @krisaoe
schematoschema_to avoid shadowing of global variable name, #2724 by @shahriyarr__dataclass_transform__, #2721 by @tiangoloBaseConfigand handlemax_length = 0, #2719 by @PrettyWoodorm_modechecking to allow recursive ORM mode parsing with dicts, #2718 by @nuno-andreNamedTupleand has a default value, #2707 by @PrettyWoodEnumfields now properly support extra kwargs in schema generation, #2697 by @sammchardyuniqueItemsoption toConstrainedList, #2618 by @nuno-andre__version__attribute to pydantic module, #2572 by @paxcodespostgresql+asyncpg,postgresql+pg8000,postgresql+psycopg2,postgresql+psycopg2cffi,postgresql+py-postgresqland
postgresql+pygresqlschemes forPostgresDsn, #2567 by @postgres-asyncpgdecimal_placesargument is specified, #2524 by @cwe5590collections.abc.Callableto be used as type in Python 3.9, #2519 by @daviskirksetup.pyto allow for custom CFLAGS when compiling, #2517 by @peterroelants
default_factoryto run it only once even ifConfig.validate_allis set, #2515 by @PrettyWoodAnyUrlhosts. This allows urls with DNS labelslooking like IPs to validate as they are perfectly valid host names, #2512 by @sbv-csis
minItemsandmaxItemsin generated JSON schema for fixed-length tuples, #2497 by @PrettyWoodstrictargument toconbytes, #2489 by @koxudaxiGetterDictto docs, #2463 by @nuno-andreKafkaDsntype,HttpUrlnow has default port 80 for http and 443 for https, #2447 by @MihanixAPastDateandFutureDatetypes, #2425 by @KludexGenericfields with subtypes, #2375 by @maximbergNameEmailto str, #2341 by @alecgeronaConfig.smart_unionto prevent coercion inUnionif possible, seethe doc for more information, #2092 by @PrettyWood
typing.Counteras a model field type, #2060 by @uriyyo__bases__when constructing new parameterised classes, so thatA <: B => A[int] <: B[int], #2007 by @diabolo-danFileUrltype that allows URLs that conform to RFC 8089.Add
host_requiredparameter, which isTrueby default (AnyUrland subclasses),FalseinRedisDsn,FileUrl, #1983 by @vgerakconfrozenset(), analogous toconset()andconlist(), #1897 by @PrettyWoodroot_validatorif overridden, #1895 by @PrettyWoodrepr(defaults toTrue) parameter toField, to hide it from the default representation of theBaseModel, #1831 by @fnepConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.