chore(deps): bump pydantic-settings from 2.12.0 to 2.14.2 in /backend - #244
chore(deps): bump pydantic-settings from 2.12.0 to 2.14.2 in /backend#244dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.12.0 to 2.14.2. - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.12.0...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Approve with suggestions
This PR patches a security vulnerability (GHSA-4xgf-cpjx-pc3j) in pydantic-settings and incorporates several bug fixes, all while maintaining backward compatibility.
🌟 Strengths
- Resolves a symlink-following vulnerability in
NestedSecretsSettingsSource. - CI checks pass and hash consistency is verified in the lock file.
💡 Suggestions (P2)
- backend/pyproject.toml: Version bump includes a security patch and minor improvements; no further action is required.
💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
| "pydantic-extra-types>=2.11.0", | ||
| "pydantic-settings>=2.12.0", | ||
| "pydantic-settings>=2.14.2", | ||
| "python-dotenv>=1.2.2", |
There was a problem hiding this comment.
P2 | Confidence: High
This dependency bump from >=2.12.0 to >=2.14.2 applies a security patch (GHSA-4xgf-cpjx-pc3j) that fixes a symlink-following vulnerability in NestedSecretsSettingsSource when secrets_nested_subdir=True. It also pulls in several bug fixes (e.g., AliasChoices priority handling, cls field-name conflict, Literal[numeric Enum] coercion, nested discriminated unions discovery). No breakage is expected from any of these changes based on the upstream release notes; the vulnerability fix is a pure improvement. The lock-file and requirements hash updates are consistent. CI (CodeQL, Vercel) passed, confirming the resolution. No further action is required.
1 participant
Bumps pydantic-settings from 2.12.0 to 2.14.2.
Release notes
Sourced from pydantic-settings's releases.
... (truncated)
Commits
d703bd7Prepare release 2.14.2 (#890)e95c30bPrepare release 2.14.1 (#859)0c87345Fix field namedclsconflicting with classmethod parameter (#858)7bd0072Bump the python-packages group with 2 updates (#856)b03e573Bump the github-actions group with 3 updates (#853)eaa3b43Bump the python-packages group with 5 updates (#854)9f95615Bump the python-packages group with 4 updates (#850)8916beePrepare release 2.14.0 (#848)39e551cFix CLI descriptions lost underpython -OOby falling back to `json_schema_...9ed7f48Bump the python-packages group with 4 updates (#847)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.