RepoJournal
FastAPI & Pydantic FastAPI & Pydantic
140 wires and counting

$ follow FastAPI & Pydantic

Keep up with FastAPI & Pydantic in about 3 minutes: what actually shipped โ€” the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest โ€” weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-09
stories 28
RSS Archive Reviews

ยฉ 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire ยท showcase

TIANGOLO LOCKS DOWN WORKFLOW TOKENS ACROSS FASTAPI AND SQLMODEL

By RepoJournal ยท Filed ยท About FastAPI & Pydantic ยท Composed from the cited sources ยท methodology

tiangolo dmontagu Viicos latest-changes[bot]
4 people shipped this
tiangolo @tiangolo 6 cited dmontagu @dmontagu 2 cited Viicos @Viicos 2 cited latest-changes[bot] @latest-changes[bot]

FastAPI and SQLModel are ditching long-lived personal access tokens for short-lived OIDC-scoped credentials across all automated workflows, eliminating a persistent supply-chain attack surface.

Tiangolo is systematically replacing hardcoded PATs with ephemeral tokens from GitHub's PR Submit and PR Push apps across both repositories [1][2]. The new approach requests tokens through GitHub OIDC, configures Git authentication via `gh auth setup-git`, and attributes commits to bot identities rather than generic `github-actions[bot]` accounts [3][4][5][6]. All changes have been validated with YAML parsing, git diff checks, and zizmor security audits. On the Pydantic side, a fix landed for callable discriminators with PEP 695 type aliases [7][8], and docs reverting changes from an earlier PR merged cleanly [9][10]. The activity reflects a focused 24-hour push: 18 commits and 10 PRs across three desks, with the token migration dominating both FastAPI and SQLModel.

Action items

References

  1. [1] ๐Ÿ” Use PR Submit for pull requests โ†— fastapi/fastapi
  2. [2] ๐Ÿ” Use PR Submit for pull requests โ†— tiangolo/sqlmodel
  3. [3] ๐Ÿ‘ท Use GitHub CLI for Git authentication โ†— fastapi/fastapi
  4. [4] ๐Ÿ‘ท Use PR Push commit identity โ†— fastapi/fastapi
  5. [5] ๐Ÿ‘ท Use GitHub CLI for Git authentication โ†— tiangolo/sqlmodel
  6. [6] ๐Ÿ‘ท Use PR Push commit identity โ†— tiangolo/sqlmodel
  7. [7] Fix support for callable discriminators with PEP 695 type aliases โ†— pydantic/pydantic
  8. [8] Fix support for callable discriminators with PEP 695 type aliases (#13604) โ†— pydantic/pydantic
  9. [9] Revert some docs changes from #13457 โ†— pydantic/pydantic
  10. [10] Revert some docs changes from #13457 (#13607) โ†— pydantic/pydantic

$ ls fastapi/reviews/ # the step-back reads

the week in review Pydantic drops Python 3.10, then layers serialization fast paths the month in review Five Pydantic validation bypasses and a quadratic URL check
Full archive โ†’ Weekly reviews โ†’

Quick answers

What shipped in FastAPI & Pydantic on August 9, 2026?
FastAPI and SQLModel are ditching long-lived personal access tokens for short-lived OIDC-scoped credentials across all automated workflows, eliminating a persistent supply-chain attack surface. In total, 18 commits and 10 pull requests landed.
Who contributed to FastAPI & Pydantic on August 9, 2026?
4 developers shipped this update, including tiangolo, latest-changes[bot], dmontagu, and Viicos.
What were the notable FastAPI & Pydantic updates?
๐Ÿ” Use PR Submit for pull requests, ๐Ÿ” Use PR Submit for pull requests, and ๐Ÿ‘ท Use GitHub CLI for Git authentication.
โ™ฅ

$ log FastAPI & Pydantic --recent

Pydantic fixes GC tracking in pydantic-core and caches UTC TzInfo 50 shipped Pydantic drops Python 3.10, accepts list and DecimalTuple for Decimal 37 shipped Pydantic reworks `TypeAdapter` call arguments, tightens `Decimal` schemas 13 shipped FastAPI bumps pillow and dnspython, Pydantic corrects arguments JSON Schema 6 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.