Who contributed to FastAPI & Pydantic on July 5, 2026?

3 developers shipped this update, including tiangolo, Viicos, and dhruvatr.

What were the notable FastAPI & Pydantic updates?

👷 Fix notify translations checkout target, 👷 Fix latest-changes checkout target, and 👷 Fix latest-changes checkout target.

FastAPI & Pydantic

FastAPI and the Pydantic + SQLModel async-Python stack

Pick a date

Topics: Python Full archive →

The Wire · Showcase

FASTAPI AND SQLMODEL PATCH CRITICAL GITHUB ACTIONS FLAW ACROSS THE STACK

By RepoJournal · Filed 06:03 UTC on July 5, 2026 · About FastAPI & Pydantic

3 people shipped this

tiangolo @tiangolo 3 cited

Viicos @Viicos 1 cited

dhruvatr @dhruvatr 1 cited

Both FastAPI and SQLModel just closed a privilege escalation hole in their CI/CD pipelines where fork pull requests could execute untrusted code in trusted contexts.

The vulnerability sits in GitHub Actions checkout configurations [1] [2] [3]. When `actions/checkout@v7` runs in `pull_request_target` contexts, it was pulling fork code instead of the base repository's trusted code, creating a window for attackers to inject malicious workflows. FastAPI fixed this across two critical workflows , and SQLModel deployed the same fix . This matters because `pull_request_target` is the exact context where you run sensitive operations like release automation and notification systems. Meanwhile, Pydantic is shipping a performance win: caching the `ModelPrivateAttr.default_factory_takes_validated_data` property [4] [6] to eliminate redundant checks during model initialization. The team also clarified YAML example documentation [5] [7] to mention PyYAML as an explicit dependency rather than burying it in prose.

Action items

→ Review your GitHub Actions workflows for pull_request_target checkout configurations - patch immediately if found fastapi/fastapi [immediate]
→ Upgrade Pydantic if you're doing heavy private attribute factory validation pydantic/pydantic [plan]
→ Audit SQLModel CI/CD if you maintain a fork with custom workflows tiangolo/sqlmodel [plan]

References

[1] 👷 Fix notify translations checkout target ↗ fastapi/fastapi
[2] 👷 Fix latest-changes checkout target ↗ fastapi/fastapi
[3] 👷 Fix latest-changes checkout target ↗ tiangolo/sqlmodel
[4] Cache `ModelPrivateAttr.default_factory_takes_validated_data` property ↗ pydantic/pydantic
[5] Mention PyYAML installation for YAML example ↗ pydantic/pydantic
[6] Cache `ModelPrivateAttr.default_factory_takes_validated_data` property (#13390) pydantic/pydantic
[7] Mention PyYAML installation for YAML example (#13400) pydantic/pydantic

Quick answers

What shipped in FastAPI & Pydantic on July 5, 2026?: Both FastAPI and SQLModel just closed a privilege escalation hole in their CI/CD pipelines where fork pull requests could execute untrusted code in trusted contexts. In total, 6 commits and 6 pull requests landed.
Who contributed to FastAPI & Pydantic on July 5, 2026?: 3 developers shipped this update, including tiangolo, Viicos, and dhruvatr.
What were the notable FastAPI & Pydantic updates?: 👷 Fix notify translations checkout target, 👷 Fix latest-changes checkout target, and 👷 Fix latest-changes checkout target.

FASTAPI 0.140.0 CUTS MEMORY OVERHEAD IN DEPENDENCIES

FastAPI shipped a memory optimization that simplifies how dependencies are processed, backed by months of community analysis and benchmarking.

python 9 shipped 1-min read

FastAPI & Pydantic 4 days ago

FASTAPI AND SQLMODEL STANDARDIZE ON UV, PYDANTIC DOCS BLOCKED ON SETTINGS DRIFT

Tiangolo shipped Library Skills documentation across FastAPI and SQLModel while pivoting both projects toward uv as the default package manager, but Pydantic's docs build is failing due to version mismatch in pydantic-settings.

python 10 shipped 1-min read

FastAPI & Pydantic 5 days ago

SQLMODEL FIXES TERMYNAL SCROLL JAR ACROSS DOCS

Interactive code examples in SQLModel documentation no longer hijack your scroll position when you click the restart or fast-forward controls.

python 2 shipped 1-min read

FastAPI & Pydantic 6 days ago

FASTAPI AND PYDANTIC SHIFT TO UV FOR DOCS AND DEPENDENCIES

FastAPI's documentation is standardizing on uv project templates, signaling a broader ecosystem shift toward Python's fastest-growing package manager.

python 7 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.