Pydantic patches five validation bypasses in one week

Validation bypass of extra data keys in JSON model validation pydantic/pydantic

Extra keys could pass JSON model validation, so a payload carrying fields your model does not declare could survive a check that was supposed to drop it. Anyone validating untrusted JSON with extra keys set to ignore or forbid should retest on the patched release.

Validation bypass of aliased fields in TypedDict and dataclasses allowing extra data pydantic/pydantic

The same class of hole showed up in TypedDict and dataclasses when a field carried an alias: aliased input could bring extra data through with it. If you validate typed dicts or dataclasses built from external payloads, those models are in scope.

Validation bypass of Pydantic V1 dataclasses allowing extra data pydantic/pydantic

The V1 compatibility path had its own variant, with Pydantic V1 dataclasses accepting extra data. Models still running on the V1 shim keep inheriting these fixes, which matters given the V1 escape hatch was deleted the same week.

Quadratic time and memory multi-host URL validation pydantic/pydantic

Multi-host URL validation ran in quadratic time and memory, which hands an attacker a cheap way to make a single URL string expensive to check. Treat any endpoint that validates user-supplied URLs as the affected surface.

Unbounded exponent in Fraction validation pydantic/pydantic

Fraction validation accepted an unbounded exponent, so a short string could drive arithmetic far past what the input size suggests. Both of these are parsing-cost issues, not just correctness ones, and both are flagged breaking.

Add security policy and threat model pydantic/pydantic

by Viicos

The project wrote down its threat model and security policy, the first explicit statement of what validation is and is not expected to defend against. Read it before assuming a validator boundary is a trust boundary.

Check mapping `max_length` constraint during validation pydantic/pydantic

by Viicos

Mapping max_length constraints are now checked during validation rather than assumed, and the docs spell out the hash collision behavior of sets and dictionaries. Constraints you declared on dict-typed fields may start rejecting input they previously passed.

Improve performance of `model_fields_set` pydantic/pydantic

by Viicos

model_fields_set moved to a bitset, addressing memory issues tracked on the core side, and frozen model corpora from MCP and AI SDKs joined the CodSpeed CPU-simulation benchmarks. Alongside: JSON validate-by-iteration now matches the Python path on extra ordering, lazy reprs in nested union serialization, PyPy 8.0 wheels, and uv cache keys fixed for pydantic-core.