← Back to issue list

build(deps): bump pydantic from 1.8.1 to 1.8.2

View original Github issue

Metadata

Project
charmcraft
Number
#348
Type
pull request
State
merged
Author
dependabot[bot]
Labels
Created
Updated
Closed

Current evaluation

Merged a Dependabot PR upgrading pydantic from 1.8.1 to 1.8.2. The update patches CVE-2021-29510, fixing an infinite loop bug in date parsing, alongside other schema and configuration fixes. Approved and merged successfully.

Suggested action:

No scores available.

Issue body

Bumps [pydantic](https://github.com/samuelcolvin/pydantic) from 1.8.1 to 1.8.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/samuelcolvin/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v1.8.2 (2021-05-11)</h2> <p>See <a href="https://pydantic-docs.helpmanual.io/changelog/">Changelog</a>.</p> <h2>Warning</h2> <p>A security vulnerability, level &quot;moderate&quot; is fixed in v1.8.2. Please upgrade <strong>ASAP</strong>. See security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a>.</p> <h2>Changes</h2> <ul> <li><strong>Security fix:</strong> Fix <code>date</code> and <code>datetime</code> parsing so passing either <code>'infinity'</code> or <code>float('inf')</code> (or their negative values) does not cause an infinite loop, see security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a></li> <li>fix schema generation with Enum by generating a valid name, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2575">#2575</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> <li>fix JSON schema generation with a <code>Literal</code> of an enum member, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2536">#2536</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> <li>Fix bug with configurations declarations that are passed as keyword arguments during class creation, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2532">#2532</a> by <a href="https://github.com/uriyyo"><code>@​uriyyo</code></a></li> <li>Allow passing <code>json_encoders</code> in class kwargs, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2521">#2521</a> by <a href="https://github.com/layday"><code>@​layday</code></a></li> <li>support arbitrary types with custom <code>__eq__</code>, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> <li>support <code>Annotated</code> in <code>validate_arguments</code> and in generic models with python 3.9, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/samuelcolvin/pydantic/blob/master/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v1.8.2 (2021-05-11)</h2> <p>!!! warning A security vulnerability, level &quot;moderate&quot; is fixed in v1.8.2. Please upgrade <strong>ASAP</strong>. See security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a></p> <ul> <li><strong>Security fix:</strong> Fix <code>date</code> and <code>datetime</code> parsing so passing either <code>'infinity'</code> or <code>float('inf')</code> (or their negative values) does not cause an infinite loop, see security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a></li> <li>fix schema generation with Enum by generating a valid name, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2575">#2575</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> <li>fix JSON schema generation with a <code>Literal</code> of an enum member, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2536">#2536</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> <li>Fix bug with configurations declarations that are passed as keyword arguments during class creation, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2532">#2532</a> by <a href="https://github.com/uriyyo"><code>@​uriyyo</code></a></li> <li>Allow passing <code>json_encoders</code> in class kwargs, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2521">#2521</a> by <a href="https://github.com/layday"><code>@​layday</code></a></li> <li>support arbitrary types with custom <code>__eq__</code>, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> <li>support <code>Annotated</code> in <code>validate_arguments</code> and in generic models with python 3.9, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@​PrettyWood</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/samuelcolvin/pydantic/commit/a84cfacf9caf08bef8edca076c3325c3cf49475d"><code>a84cfac</code></a> v1.6.2 and v1.7.4 to history</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/d209e13fcfb872643a987f0a2d8f4ee73b724d2b"><code>d209e13</code></a> fix warning</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/2d925585d54030d0d28e3e9999d03ad47fcc08e2"><code>2d92558</code></a> remove CI branch change</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/ccdf4726bdd9ef28b8c7af24065dd58606a07965"><code>ccdf472</code></a> add <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2465">#2465</a> to history</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/2bff0bf9b66405d108a0346ee40e4721b9871d24"><code>2bff0bf</code></a> Support user defined generic field types in generic models. (<a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2554">#2554</a>)</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/870cb6e38f3990f73c7fbe6d527671a489d0b2db"><code>870cb6e</code></a> fix mypy</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/9131d2dd01fc9aaccd6f555d189335807da7bdf9"><code>9131d2d</code></a> update linting requirements</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/e2a44f79bb7cedd7e379d3d6865c2606731f962a"><code>e2a44f7</code></a> try and get tests to run</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/d3ad4e15762e8f19aa5bb66f8d565d6797de6000"><code>d3ad4e1</code></a> bump</li> <li><a href="https://github.com/samuelcolvin/pydantic/commit/92c52ae531a55a300ae1f083ce76878adb31de53"><code>92c52ae</code></a> add change log for v1.8.2</li> <li>Additional commits viewable in <a href="https://github.com/samuelcolvin/pydantic/compare/v1.8.1...v1.8.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pydantic&package-manager=pip&previous-version=1.8.1&new-version=1.8.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/charmcraft/network/alerts). </details>

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b Merged a Dependabot PR upgrading pydantic from 1.8.1 to 1.8.2. The update patches CVE-2021-29510, fixing an infinite loop bug in date parsing, alongside other schema and configuration fixes. Approved and merged successfully.
qwen3.6-35b-a3b-mtp-q6 Merged Dependabot dependency update upgrading pydantic from 1.8.1 to 1.8.2. The release resolves CVE-2021-29510, a moderate security vulnerability causing infinite loops on datetime parsing, plus schema and configuration bug fixes.
qwen3.6-35b-a3b-mtp-q6 Merged Dependabot update bumping pydantic from 1.8.1 to 1.8.2. The upgrade resolves CVE-2021-29510, preventing infinite loops during datetime parsing with infinity values, and applies minor schema and configuration fixes.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#2000 build(deps): update dependency pydantic to v1.10.19 (hotfix/2.7) charmcraft merged Merged automated dependency update upgrading pydantic from v1.10.14 to v1.10.19 on the hotfix/2.7 branch. Renovate auto-merged after CI and approvals, applying upstream bug fixes and deprecation resolutions.
79%
#5173 build(deps): update pydantic etc. (main) snapcraft merged Merged automated dependency update upgrading pydantic to 2.10.3 and pydantic-core to 2.27.1. Approved by two reviewers, passed CI, and merged into main.
77%
#193 build(deps)!: update to pydantic 2 craft-store merged Merged to upgrade the project to pydantic 2. Approved by two reviewers, the update modified 21 files with 135 additions and 90 deletions.
75%
#1009 build(deps): update bugfixes (main) craft-parts merged Merged automated dependency updates for pydantic (2.10.4 to 2.10.6) and starlette (0.45.2 to 0.45.3). Approved by two reviewers, passed CI, and merged into main.
75%
#1777 feat(deps)!: switch to pydantic 2 charmcraft merged Merged pydantic 2 upgrade, incorporating #1776. Approved by two reviewers, the update modified 81 files with a net reduction of over 15,000 lines, completing the major version migration.
75%
#174 build(deps): update bugfixes imagecraft merged Merged automated dependency updates for ruff-pre-commit and pydantic-kitbash. Approved by reviewers and passing CI checks, the changes were successfully integrated into the main branch.
72%
#4335 build(deps-dev): bump pyramid from 2.0.1 to 2.0.2 snapcraft merged Merged Dependabot PR updating pyramid from 2.0.1 to 2.0.2. The update patches a security vulnerability involving null-bytes in static view paths. Approved by three reviewers and passed CI.
72%
#1014 build(deps): update dependency pydantic-kitbash to v1 (main) craft-application merged Merged automated dependency update for pydantic-kitbash from v0.1.1 to v1.0.1. Approved by two reviewers, passed all CI checks, and merged into the main branch.
72%
#6127 build(deps): bump requests from 2.32.5 to 2.33.0 snapcraft merged Merged Dependabot PR bumping requests from 2.32.5 to 2.33.0. The update addresses CVE-2026-25645, migrates to PEP 517, and drops Python 3.9 support. Approved by reviewers and merged after CI checks.
71%
#419 deps: loosen pydantic dependency craft-parts merged Merged after approval and passing CI. Loosened the pydantic dependency constraint, removing the previous freeze at version 1.9 now that the upstream pydantic-yaml compatibility issue is resolved.
71%