$ the-wire · showcase
Pydantic writes down its threat model and starts enforcing mapping max_length
By RepoJournal · Filed · About FastAPI & Pydantic · Composed from the cited sources · methodology
2 people shipped this
Pydantic published a security policy and threat model alongside a validation change that now checks the max_length constraint on mappings, so constraints that were previously accepted on dict fields are no longer inert.
Check mapping `max_length` constraint during validation pydantic/pydantic
Mappings now have their max_length constraint checked during validation rather than being carried without enforcement; the same change documents the hash collision behavior of sets and dictionaries. If you put max_length on a dict-typed field, expect validation errors on inputs that previously passed.
Add security policy and threat model pydantic/pydantic
Viicos added a security policy and a threat model to the repository, giving reporters and auditors a stated scope for what pydantic does and does not defend against.
Correct pickle output example in serialization docs (#14094) pydantic/pydantic
The serialization docs had a pickle output example that did not match what pydantic actually emits, and adarrevah corrected it.
