build(deps): bump pydantic from 1.8.1 to 1.8.2
Metadata
Current evaluation
Merged PR #348 upgraded Pydantic 1.8.1 to 1.8.2, fixing CVE-2021-29510's infinite loop in date/datetime parsing.
Resolution: closed resolved
Reason: PR #348 was merged via commit d6d56357; repository history identifies f3ca6433 as the dependency-bump commit applying the Pydantic 1.8.2 security fix.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [pydantic](https://github.com/samuelcolvin/pydantic) from 1.8.1 to 1.8.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/samuelcolvin/pydantic/releases">pydantic's releases</a>.</em></p>
<blockquote>
<h2>v1.8.2 (2021-05-11)</h2>
<p>See <a href="https://pydantic-docs.helpmanual.io/changelog/">Changelog</a>.</p>
<h2>Warning</h2>
<p>A security vulnerability, level "moderate" is fixed in v1.8.2. Please upgrade <strong>ASAP</strong>. See security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a>.</p>
<h2>Changes</h2>
<ul>
<li><strong>Security fix:</strong> Fix <code>date</code> and <code>datetime</code> parsing so passing either <code>'infinity'</code> or <code>float('inf')</code>
(or their negative values) does not cause an infinite loop,
see security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a></li>
<li>fix schema generation with Enum by generating a valid name, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2575">#2575</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
<li>fix JSON schema generation with a <code>Literal</code> of an enum member, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2536">#2536</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
<li>Fix bug with configurations declarations that are passed as
keyword arguments during class creation, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2532">#2532</a> by <a href="https://github.com/uriyyo"><code>@uriyyo</code></a></li>
<li>Allow passing <code>json_encoders</code> in class kwargs, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2521">#2521</a> by <a href="https://github.com/layday"><code>@layday</code></a></li>
<li>support arbitrary types with custom <code>__eq__</code>, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
<li>support <code>Annotated</code> in <code>validate_arguments</code> and in generic models with python 3.9, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/samuelcolvin/pydantic/blob/master/HISTORY.md">pydantic's changelog</a>.</em></p>
<blockquote>
<h2>v1.8.2 (2021-05-11)</h2>
<p>!!! warning
A security vulnerability, level "moderate" is fixed in v1.8.2. Please upgrade <strong>ASAP</strong>.
See security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a></p>
<ul>
<li><strong>Security fix:</strong> Fix <code>date</code> and <code>datetime</code> parsing so passing either <code>'infinity'</code> or <code>float('inf')</code>
(or their negative values) does not cause an infinite loop,
see security advisory <a href="https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh">CVE-2021-29510</a></li>
<li>fix schema generation with Enum by generating a valid name, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2575">#2575</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
<li>fix JSON schema generation with a <code>Literal</code> of an enum member, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2536">#2536</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
<li>Fix bug with configurations declarations that are passed as
keyword arguments during class creation, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2532">#2532</a> by <a href="https://github.com/uriyyo"><code>@uriyyo</code></a></li>
<li>Allow passing <code>json_encoders</code> in class kwargs, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2521">#2521</a> by <a href="https://github.com/layday"><code>@layday</code></a></li>
<li>support arbitrary types with custom <code>__eq__</code>, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
<li>support <code>Annotated</code> in <code>validate_arguments</code> and in generic models with python 3.9, <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2483">#2483</a> by <a href="https://github.com/PrettyWood"><code>@PrettyWood</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/a84cfacf9caf08bef8edca076c3325c3cf49475d"><code>a84cfac</code></a> v1.6.2 and v1.7.4 to history</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/d209e13fcfb872643a987f0a2d8f4ee73b724d2b"><code>d209e13</code></a> fix warning</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/2d925585d54030d0d28e3e9999d03ad47fcc08e2"><code>2d92558</code></a> remove CI branch change</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/ccdf4726bdd9ef28b8c7af24065dd58606a07965"><code>ccdf472</code></a> add <a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2465">#2465</a> to history</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/2bff0bf9b66405d108a0346ee40e4721b9871d24"><code>2bff0bf</code></a> Support user defined generic field types in generic models. (<a href="https://github-redirect.dependabot.com/samuelcolvin/pydantic/issues/2554">#2554</a>)</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/870cb6e38f3990f73c7fbe6d527671a489d0b2db"><code>870cb6e</code></a> fix mypy</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/9131d2dd01fc9aaccd6f555d189335807da7bdf9"><code>9131d2d</code></a> update linting requirements</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/e2a44f79bb7cedd7e379d3d6865c2606731f962a"><code>e2a44f7</code></a> try and get tests to run</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/d3ad4e15762e8f19aa5bb66f8d565d6797de6000"><code>d3ad4e1</code></a> bump</li>
<li><a href="https://github.com/samuelcolvin/pydantic/commit/92c52ae531a55a300ae1f083ce76878adb31de53"><code>92c52ae</code></a> add change log for v1.8.2</li>
<li>Additional commits viewable in <a href="https://github.com/samuelcolvin/pydantic/compare/v1.8.1...v1.8.2">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/charmcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #348 upgraded Pydantic 1.8.1 to 1.8.2, fixing CVE-2021-29510's infinite loop in date/datetime parsing. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #348 (commit d6d56357), upgrading pydantic from 1.8.1 to 1.8.2 and fixing CVE-2021-29510, an infinite-loop vulnerability in date/datetime parsing. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a Dependabot PR upgrading pydantic from 1.8.1 to 1.8.2. The update patches CVE-2021-29510, fixing an infinite loop bug in date parsing, alongside other schema and configuration fixes. Approved and merged successfully. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot dependency update upgrading pydantic from 1.8.1 to 1.8.2. The release resolves CVE-2021-29510, a moderate security vulnerability causing infinite loops on datetime parsing, plus schema and configuration bug fixes. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #48 build(deps): bump pydantic from 1.8.1 to 1.8.2 | craft-providers | closed | Superseded by merged PR canonical/craft-providers#49, which re-froze requirements and upgraded pydantic from 1.8.1 to 1.8.2. | |
| #2000 build(deps): update dependency pydantic to v1.10.19 (hotfix/2.7) | charmcraft | merged | Merged PR #2000 into hotfix/2.7, updating pinned pydantic from 1.10.14 to 1.10.19 in two files. | |
| #5173 build(deps): update pydantic etc. (main) | snapcraft | merged | Merged #5173 via commit 2973439a0, updating pydantic 2.9.2→2.10.3 and pydantic-core 2.23.4→2.27.1. | |
| #193 build(deps)!: update to pydantic 2 | craft-store | merged | Merged the breaking Pydantic 2 upgrade in #193 (commit 026b78d), updating dependencies and model code across 21 files (+135/-90). | |
| #451 build(deps): bump pydantic to v2 | craft-providers | merged | Merged PR #451 upgraded craft-providers to Pydantic v2 for 2.0; current project metadata requires pydantic~=2.4. | |
| #1999 build(deps): update pydantic etc. (main) | charmcraft | closed | Renovate PR #1999 proposed Pydantic 2.10.2 and pydantic-core 2.27.1, but was closed unmerged after 664 days of inactivity; neither version landed. | |
| #2314 build(deps): update dependency pydantic to ~=2.11,<2.12 (main) - autoclosed | charmcraft | closed | Renovate PR #2314 was autoclosed unmerged after 471 days; the Pydantic 2.11 update was not shipped, with snap-build, snap tests, and diff-schema failing. | |
| #658 build(deps): update bugfixes | craft-providers | merged | Renovate PR #658 merged, updating pyright 1.1.380→1.1.381, sphinx-autobuild 2024.9.3→2024.9.19, and types-PyYAML 20240808→20240917 in commit 2500672. | |
| #209 build(deps): update bugfixes | craft-store | merged | Renovate PR merged as commit eeba1be, bumping mypy to 1.11.2, pyright 1.1.380, pytest 8.3.3 and tox-gh 1.3.3 in craft-store build config. | |
| #582 [EXPERIMENTAL] build(deps): use pydantic 2 | craft-parts | closed | Closed unmerged in Aug 2024 by @lengau as superseded; the Pydantic 2 migration landed later via merged PR #771 (commit 6b155294) plus follow-ups #776, #778, #794, #811. |