Five Pydantic validation bypasses and a quadratic URL check

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

The bypasses touch extra-key handling in JSON models, aliased TypedDict and dataclass fields, and V1 dataclasses; FastAPI meanwhile made OTel setup opt-in and landed three breaking parameter changes.

334 commits 257 PRs merged 47 releases 7 security advisories 29 briefings covered

all fastapi reviews →

← previous month fastapi wire →

Validation bypass of extra data keys in JSON model validation pydantic/pydantic

Model validation against JSON input could let extra keys through instead of rejecting them, depending on which path parsed the payload. If you rely on extra='forbid' as a boundary, that boundary leaked; check your pinned pydantic version rather than assuming the schema was enforced.

Validation bypass of aliased fields in TypedDict and dataclasses allowing extra data pydantic/pydantic

TypedDicts and dataclasses with aliased fields accepted extra data under validation. Aliasing is common when mapping external payloads, so this is the one to audit first if you feed third-party JSON into either construct.

Validation bypass of Pydantic V1 dataclasses allowing extra data pydantic/pydantic

The V1 dataclass path has the same class of gap for anyone still running pydantic.v1 shims. Same guidance: pin to a patched release, and confirm upstream actually tags it before you claim the fix.

0.143.0 fastapi/fastapi

by github-actions[bot]

FastAPI no longer configures OTel exporters from OTEL_* environment variables on its own. Set FASTAPI_OTEL_AUTO_CONFIGURE=true or pass FastAPI(telemetry={"auto_configure": True}) to keep the previous behavior. And when auto-configuration fails, startup now proceeds instead of dying, which is the reason the switch moved: instrumentation problems should not be able to take your app down.

0.155.0 fastapi/fastapi

by github-actions[bot]

Path, Query, Header, Cookie, Body, Form and File no longer swallow unknown keyword arguments. Anything you passed as Query(custom="value") now raises TypeError at import time, which makes it a fast failure; move those to json_schema_extra. This is the breaking change most likely to greet you after an upgrade.

v2.14.0 2026-10-08 pydantic/pydantic

by Viicos

Pydantic 2.14 shipped with validation tightened around timedelta, Decimal, TypedDict inheritance, a Python 3.10.0 ForwardRef crash, and a JSON Schema cache key mismatch. The maintainers categorize several changes as non-breaking under their versioning policy, so read the list if you compare serialized schemas across versions.

0.160.0 fastapi/fastapi

by github-actions[bot]

Parameter-model extra configuration now applies to every field submitted in that location, including fields from other models, standalone parameters, and dependencies. Code that counted on those fields escaping the model's extra policy will now see it applied, so test your query and form models together rather than in isolation.

0.162.0 fastapi/fastapi

by github-actions[bot]

An omitted bool form field no longer becomes False. It takes its declared default or produces a missing-field error, matching how every other field type behaves. Checkbox-style endpoints that relied on the old inference need explicit defaults.

$ ls fastapi/month/ # the briefings behind this review

Thu Oct 1 FastAPI survives an OpenTelemetry failure, pydantic adds create_model namespace Fri Oct 2 Pydantic survives ZoneInfo OS errors, FastAPI’s bothousekeeping continues Sat Oct 3 FastAPI absorbs a 14-package dependency bump, docs translations land in four languages Mon Oct 5 Pydantic clears lazy import xfails, enables frame pointers Tue Oct 6 Pydantic clears two test blockers, SQLModel bumps its whole Python stack Wed Oct 7 SQLModel ships 0.0.48 with SQLAlchemy 2.1 support Thu Oct 8 FastAPI isolates telemetry for excluded requests, Pydantic prepares 2.14.0 Fri Oct 9 FastAPI 0.143.0 makes OTel auto-setup opt-in, Pydantic 2.14 lands Sat Oct 10 Pydantic restores TypedDict inheritance, patches a Python 3.10.0 ForwardRef crash Sun Oct 11 Pydantic tightens timedelta and Decimal validation Mon Oct 12 Pydantic fixes JSON Schema cache key mismatch Tue Oct 13 Pydantic revises Logfire description in README Wed Oct 14 Pydantic README rewrites the Logfire pitch Thu Oct 15 pydantic-core GC traversal and unpickling fixes land Fri Oct 16 FastAPI fixes blocking frontend fallback checks Sat Oct 17 FastAPI 0.143.3 fixes non-finite floats in JSONL and SSE streams Sun Oct 18 FastAPI 0.143.4 ships with httpx2 added to optional dependencies Mon Oct 19 FastAPI deprecates root_path and drops openapi_prefix Tue Oct 20 FastAPI 0.150.0 treats empty file inputs as missing Wed Oct 21 FastAPI 0.155.0 removes the deprecated **extra escape hatch Thu Oct 22 Optional parameter models for query, header, cookie, and form params Fri Oct 23 FastAPI 0.160.0 widens the blast radius of parameter model extras Sat Oct 24 FastAPI stops inferring False for omitted boolean form fields Mon Oct 26 FastAPI's dependency bots move; Pydantic fixes its CI cache keys Tue Oct 27 Lazy reprs in nested union serialization, and a dependency train Wed Oct 28 Pydantic aligns JSON validate-by-iteration with Python Thu Oct 29 Pydantic writes down its threat model and starts enforcing mapping max_length Fri Oct 30 Five Pydantic validation bypasses and a quadratic URL check Sat Oct 31 model_fields_set moves to a bitset; real-world model corpora enter the benchmark suite

all fastapi reviews →

← previous month fastapi wire →