Glitchy-Sheep/boosty-downloader

Fork 0

mirror of https://github.com/Glitchy-Sheep/boosty-downloader.git synced 2026-10-14 21:33:23 +00:00

[PR #108] [MERGED] Update dependency pydantic-settings to v2.14.2 [SECURITY] #113

New issue

Closed

opened 2026-10-13 19:47:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:47:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/108
Author: @renovate[bot]
Created: 6/24/2026
Status: ✅ Merged
Merged: 8/7/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: renovate/pypi-pydantic-settings-vulnerability

📝 Commits (1)

cb87595 Update dependency pydantic-settings to v2.14.2 [SECURITY]

📊 Changes

1 file changed (+4 additions, -4 deletions)

View changed files

📝 poetry.lock (+4 -4)

📄 Description

This PR contains the following updates:

Package	Change	Age	Confidence
pydantic-settings (changelog)	`2.12.0` → `2.14.2`

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

GHSA-4xgf-cpjx-pc3j

More information

Details

Summary

NestedSecretsSettingsSource reads secret values from files in a configured secrets_dir. When secrets_nested_subdir=True, a directory entry inside secrets_dir that is a symbolic link pointing outside secrets_dir is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented secrets_dir_max_size protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This report does not claim network reachability by itself.

Details

NestedSecretsSettingsSource performed two passes over secrets_dir using two different, inconsistent directory-traversal implementations:

The size check in validate_secrets_path() used Path.glob('**/*'), which does not descend into a symbolically-linked directory.
The loader in load_secrets() used glob.iglob(f'{path}/**/*', recursive=True) followed by read_text(), which does follow symlinked directories and reads through the link target.

Because the two passes disagreed on symlinks, a symlinked directory inside secrets_dir whose target lives elsewhere was invisible to the size accounting (counted as 0 bytes) while still being fully read by the loader. This produces two distinct problems:

Out-of-tree read (CWE-22 / CWE-59). A symlinked directory (or file) inside secrets_dir that resolves outside it is followed, and the external file's contents are loaded into the corresponding settings field.
secrets_dir_max_size bypass (CWE-400). The size check never sees the out-of-tree content, so the documented size cap is neither respected nor able to reject the oversized external file. A related amplification exists for cyclic in-tree symlinks, which glob.iglob(recursive=True) re-traverses, inflating the size accounting and the number of loaded secrets.

Reproduction

In a clean Linux container, with a secrets_dir containing a symlink secrets/db -> /path/outside and an outside/passwd file of 512 bytes, while secrets_dir_max_size=100:

from pydantic import BaseModel
from pydantic_settings import (
    BaseSettings,
    SettingsConfigDict,
    NestedSecretsSettingsSource,
)

class Db(BaseModel):
    passwd: str | None = None

class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        secrets_dir='secrets',
        secrets_nested_subdir=True,
        secrets_dir_max_size=100,  # outside/passwd is 512 bytes
    )
    db: Db = Db()

    @classmethod
    def settings_customise_sources(
        cls, settings_cls, init_settings, env_settings, dotenv_settings, file_secret_settings
    ):
        return (NestedSecretsSettingsSource(file_secret_settings),)

On affected versions, Settings().db.passwd is populated with the 512-byte out-of-tree file and no SettingsError is raised, even though the file exceeds secrets_dir_max_size.

Impact

Applications that opt into NestedSecretsSettingsSource with secrets_nested_subdir=True and load secrets from a directory whose entries can be influenced by an attacker or a lower-privileged component (for example, a writable or shared secrets mount, or a secrets directory partially populated from untrusted input) are affected. The impact is:

Confidentiality: files outside the configured secrets_dir can be read into settings values (local file read).
Integrity / availability of the safeguard: the advertised secrets_dir_max_size cap can be bypassed, and cyclic symlinks can inflate resource usage during loading.

The vulnerability requires the ability to place a symbolic link inside the configured secrets directory; it is not remotely reachable on its own. Applications that do not use NestedSecretsSettingsSource, or that point secrets_dir at a directory fully under the application's control, are not affected.

Mitigation

Upgrade to pydantic-settings 2.14.2, which:

walks the secrets directory explicitly and only descends into directories whose resolved path stays within secrets_dir, so symlinked directories pointing outside are never followed;
uses a single, cycle-safe iterator for both the size check and the loader, so the size accounting and the loaded set are always consistent and each real directory is visited at most once;
skips any file whose resolved path escapes secrets_dir, as defense in depth.

If upgrading is not immediately possible, ensure the configured secrets_dir is fully owned and controlled by the application (no writable or attacker-influenced entries), or avoid secrets_nested_subdir=True.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pydantic/pydantic-settings (pydantic-settings)

`v2.14.2`

Compare Source

`v2.14.1`

Compare Source

What's Changed

Bump the python-packages group with 4 updates by @dependabot[bot] in #850
Bump the python-packages group with 5 updates by @dependabot[bot] in #854
Bump the github-actions group with 3 updates by @dependabot[bot] in #853
Bump the python-packages group with 2 updates by @dependabot[bot] in #856
Fix field named cls conflicting with classmethod parameter by @hramezani in #858
Prepare release 2.14.1 by @hramezani in #859

Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1

`v2.14.0`

Compare Source

What's Changed

Fix parsing env vars into Optional Strict types by @hramezani in #792
Fix RecursionError with mutually recursive models in CLI by @hramezani in #794
Fix env_file from model_config ignored in CliApp.run() (#795) by @hramezani in #796
Update dependencies by @hramezani in #798
Add Dependabot configuration by @hramezani in #801
Bump samuelcolvin/check-python-version from 4.1 to 5 by @dependabot[bot] in #802
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #803
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #804
Bump astral-sh/setup-uv from 5 to 7 by @dependabot[bot] in #805
Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #806
Ignore chardet and group GitHub Actions in Dependabot by @hramezani in #808
Bump actions/download-artifact from 4 to 8 in the github-actions group by @dependabot[bot] in #809
Bump the python-packages group with 2 updates by @dependabot[bot] in #810
Support reading .env files from FIFOs (e.g. 1Password Environments) by @JacobHayes in #776
Fix AliasChoices ignored when changing provider priority by @hramezani in #813
fix: resolve KeyError in run_subcommand for underscore field names by @bradykieffer in #799
Bump the python-packages group with 3 updates by @dependabot[bot] in #814
Fix Literal[numeric Enum] coercion for CLI and env vars by @m9810223 in #811
Fix nested discriminated unions not discovered by env/CLI providers by @hramezani in #816
Bump the python-packages group with 3 updates by @dependabot[bot] in #820
CLI ensure env nested max split internally. by @kschwab in #821
Bump the python-packages group with 4 updates by @dependabot[bot] in #824
Migrate boto3-stubs to types-boto3 by @hramezani in #831
Fix CLI not recognizing field name with validate_by_name and AliasChoices by @hramezani in #826
Allow customisation of the dotevn setting source to filter variables by @CaselIT in #832
Bump the python-packages group with 3 updates by @dependabot[bot] in #833
Introduce yamlfmt by @Viicos in #836
Bump boto3 from 1.42.82 to 1.42.83 in the python-packages group by @dependabot[bot] in #837
Introduce zizmor by @Viicos in #838
Fix CliPositionalArg[list[CustomType]] crash for custom types by @hramezani in #839
Add note about Mypy plugin for BaseSettings.__init__() by @Viicos in #842
Fix cli_ignore_unknown_args=True not working on subcommands by @hramezani in #844
Bump the python-packages group with 4 updates by @dependabot[bot] in #847
Fix CLI descriptions lost under python -OO by falling back to json_schema_extra by @hramezani in #843
Prepare release 2.14.0 by @hramezani in #848

New Contributors

@dependabot[bot] made their first contribution in #802
@JacobHayes made their first contribution in #776
@bradykieffer made their first contribution in #799
@CaselIT made their first contribution in #832

Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0

`v2.13.1`

Compare Source

`v2.13.0`

Compare Source

What's Changed

fix: Deterministic alias selection when using validate_by_name by @chbndrhnns in #707
add deep merge functionality to config file sources by @pmeier in #698
Add support for AWS Secrets Manager VersionId parameter by @jcyamacho in #708
bugfix: Return None for inaccessible GCP Secret Manager secrets by @zaphod72 in #712
Bugfix for cli_kebab_case="all" and CliImplicitFlag[bool] by @Digity101 in #702
Unpack type alisases when looking for NoDecode by @tselepakis in #695
CliToggleFlag and CliDualFlag by @kschwab in #717
Fix for CLI duplicate enum field values. by @kschwab in #722
fixed load nested config from env by @Sube-py in #723
Add non-Path files support (for example Traversable) and open files using Path.open method by @mahenzon in #724
add one more traversable test by @mahenzon in #725
CLI fix fox external list args. by @kschwab in #727
fix: handle case-insensitive retrieval in GoogleSecretManagerSettingsSource by @ezwiefel in #730
CLI test fixes for help text formatting. by @kschwab in #735
Avoid conflicts with the NAME environment variable in WSL by @kzrnm in #747
fix: When restoring init kwargs, use deterministic order by @chbndrhnns in #746
Add env_prefix_target by @kzrnm in #749
Remove (default: …) in the help message for CliToggleFlag by @kzrnm in #740
Add support for CLI serialize styles. by @kschwab in #755
Add support for overriding default help on CLI internal parser. by @kschwab in #758
CLI format_help method support by @kschwab in #759
feat(gcp): support SecretVersion annotation for per-field secret versioning by @ezwiefel in #763
Allow snake_case_conversion with env_prefix for Azure Key Vault source by @cstarkers in #762
fix: Only override preferred_key when no value was found by @chbndrhnns in #767
Update deps by @hramezani in #768
CLI coerce numeric types. by @kschwab in #769
CLI Union Discriminator Choices in Help by @kschwab in #764
Add nested path support for yaml_config_section (fixes #772) by @hugo-romero-mm in #773
Prepare release 2.13.0 by @hramezani in #777

New Contributors

@pmeier made their first contribution in #698
@jcyamacho made their first contribution in #708
@zaphod72 made their first contribution in #712
@Digity101 made their first contribution in #702
@Sube-py made their first contribution in #723
@mahenzon made their first contribution in #724
@kzrnm made their first contribution in #747
@cstarkers made their first contribution in #762
@hugo-romero-mm made their first contribution in #773

Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.12.0...v2.13.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/108 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 6/24/2026 **Status:** ✅ Merged **Merged:** 8/7/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `renovate/pypi-pydantic-settings-vulnerability` --- ### 📝 Commits (1) - [`cb87595`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/cb8759577d8f4498b3375de65b6be720ae0f30d8) Update dependency pydantic-settings to v2.14.2 [SECURITY] ### 📊 Changes **1 file changed** (+4 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `poetry.lock` (+4 -4) </details> ### 📄 Description This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pydantic-settings](https://redirect.github.com/pydantic/pydantic-settings) ([changelog](https://redirect.github.com/pydantic/pydantic-settings/releases)) | `2.12.0` → `2.14.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pydantic-settings/2.14.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pydantic-settings/2.12.0/2.14.2?slim=true) | --- ### pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size [GHSA-4xgf-cpjx-pc3j](https://redirect.github.com/advisories/GHSA-4xgf-cpjx-pc3j) <details> <summary>More information</summary> #### Details ##### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing **outside** `secrets_dir` is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented `secrets_dir_max_size` protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This report does not claim network reachability by itself. ##### Details `NestedSecretsSettingsSource` performed two passes over `secrets_dir` using two different, inconsistent directory-traversal implementations: * The size check in `validate_secrets_path()` used `Path.glob('**/*')`, which does **not** descend into a symbolically-linked directory. * The loader in `load_secrets()` used `glob.iglob(f'{path}/**/*', recursive=True)` followed by `read_text()`, which **does** follow symlinked directories and reads through the link target. Because the two passes disagreed on symlinks, a symlinked directory inside `secrets_dir` whose target lives elsewhere was invisible to the size accounting (counted as 0 bytes) while still being fully read by the loader. This produces two distinct problems: 1. **Out-of-tree read (CWE-22 / CWE-59).** A symlinked directory (or file) inside `secrets_dir` that resolves outside it is followed, and the external file's contents are loaded into the corresponding settings field. 2. **`secrets_dir_max_size` bypass (CWE-400).** The size check never sees the out-of-tree content, so the documented size cap is neither respected nor able to reject the oversized external file. A related amplification exists for cyclic in-tree symlinks, which `glob.iglob(recursive=True)` re-traverses, inflating the size accounting and the number of loaded secrets. ##### Reproduction In a clean Linux container, with a `secrets_dir` containing a symlink `secrets/db -> /path/outside` and an `outside/passwd` file of 512 bytes, while `secrets_dir_max_size=100`: ```python from pydantic import BaseModel from pydantic_settings import ( BaseSettings, SettingsConfigDict, NestedSecretsSettingsSource, ) class Db(BaseModel): passwd: str | None = None class Settings(BaseSettings): model_config = SettingsConfigDict( secrets_dir='secrets', secrets_nested_subdir=True, secrets_dir_max_size=100, # outside/passwd is 512 bytes ) db: Db = Db() @classmethod def settings_customise_sources( cls, settings_cls, init_settings, env_settings, dotenv_settings, file_secret_settings ): return (NestedSecretsSettingsSource(file_secret_settings),) ``` On affected versions, `Settings().db.passwd` is populated with the 512-byte out-of-tree file and **no** `SettingsError` is raised, even though the file exceeds `secrets_dir_max_size`. ##### Impact Applications that opt into `NestedSecretsSettingsSource` with `secrets_nested_subdir=True` and load secrets from a directory whose entries can be influenced by an attacker or a lower-privileged component (for example, a writable or shared secrets mount, or a secrets directory partially populated from untrusted input) are affected. The impact is: * **Confidentiality:** files outside the configured `secrets_dir` can be read into settings values (local file read). * **Integrity / availability of the safeguard:** the advertised `secrets_dir_max_size` cap can be bypassed, and cyclic symlinks can inflate resource usage during loading. The vulnerability requires the ability to place a symbolic link inside the configured secrets directory; it is not remotely reachable on its own. Applications that do not use `NestedSecretsSettingsSource`, or that point `secrets_dir` at a directory fully under the application's control, are not affected. ##### Mitigation Upgrade to **pydantic-settings 2.14.2**, which: * walks the secrets directory explicitly and only descends into directories whose resolved path stays within `secrets_dir`, so symlinked directories pointing outside are never followed; * uses a single, cycle-safe iterator for both the size check and the loader, so the size accounting and the loaded set are always consistent and each real directory is visited at most once; * skips any file whose resolved path escapes `secrets_dir`, as defense in depth. If upgrading is not immediately possible, ensure the configured `secrets_dir` is fully owned and controlled by the application (no writable or attacker-influenced entries), or avoid `secrets_nested_subdir=True`. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` #### References - [https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j](https://redirect.github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j) - [https://github.com/advisories/GHSA-4xgf-cpjx-pc3j](https://redirect.github.com/advisories/GHSA-4xgf-cpjx-pc3j) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-4xgf-cpjx-pc3j) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>pydantic/pydantic-settings (pydantic-settings)</summary> ### [`v2.14.2`](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2) [Compare Source](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2) ### [`v2.14.1`](https://redirect.github.com/pydantic/pydantic-settings/releases/tag/v2.14.1) [Compare Source](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1) #### What's Changed - Bump the python-packages group with 4 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#850](https://redirect.github.com/pydantic/pydantic-settings/pull/850) - Bump the python-packages group with 5 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#854](https://redirect.github.com/pydantic/pydantic-settings/pull/854) - Bump the github-actions group with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#853](https://redirect.github.com/pydantic/pydantic-settings/pull/853) - Bump the python-packages group with 2 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#856](https://redirect.github.com/pydantic/pydantic-settings/pull/856) - Fix field named `cls` conflicting with classmethod parameter by [@hramezani](https://redirect.github.com/hramezani) in [#858](https://redirect.github.com/pydantic/pydantic-settings/pull/858) - Prepare release 2.14.1 by [@hramezani](https://redirect.github.com/hramezani) in [#859](https://redirect.github.com/pydantic/pydantic-settings/pull/859) **Full Changelog**: <https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1> ### [`v2.14.0`](https://redirect.github.com/pydantic/pydantic-settings/releases/tag/v2.14.0) [Compare Source](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0) #### What's Changed - Fix parsing env vars into Optional Strict types by [@hramezani](https://redirect.github.com/hramezani) in [#792](https://redirect.github.com/pydantic/pydantic-settings/pull/792) - Fix RecursionError with mutually recursive models in CLI by [@hramezani](https://redirect.github.com/hramezani) in [#794](https://redirect.github.com/pydantic/pydantic-settings/pull/794) - Fix env\_file from model\_config ignored in CliApp.run() ([#795](https://redirect.github.com/pydantic/pydantic-settings/issues/795)) by [@hramezani](https://redirect.github.com/hramezani) in [#796](https://redirect.github.com/pydantic/pydantic-settings/pull/796) - Update dependencies by [@hramezani](https://redirect.github.com/hramezani) in [#798](https://redirect.github.com/pydantic/pydantic-settings/pull/798) - Add Dependabot configuration by [@hramezani](https://redirect.github.com/hramezani) in [#801](https://redirect.github.com/pydantic/pydantic-settings/pull/801) - Bump samuelcolvin/check-python-version from 4.1 to 5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#802](https://redirect.github.com/pydantic/pydantic-settings/pull/802) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#803](https://redirect.github.com/pydantic/pydantic-settings/pull/803) - Bump actions/checkout from 4 to 6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#804](https://redirect.github.com/pydantic/pydantic-settings/pull/804) - Bump astral-sh/setup-uv from 5 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#805](https://redirect.github.com/pydantic/pydantic-settings/pull/805) - Bump actions/setup-python from 5 to 6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#806](https://redirect.github.com/pydantic/pydantic-settings/pull/806) - Ignore chardet and group GitHub Actions in Dependabot by [@hramezani](https://redirect.github.com/hramezani) in [#808](https://redirect.github.com/pydantic/pydantic-settings/pull/808) - Bump actions/download-artifact from 4 to 8 in the github-actions group by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#809](https://redirect.github.com/pydantic/pydantic-settings/pull/809) - Bump the python-packages group with 2 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#810](https://redirect.github.com/pydantic/pydantic-settings/pull/810) - Support reading .env files from FIFOs (e.g. 1Password Environments) by [@JacobHayes](https://redirect.github.com/JacobHayes) in [#776](https://redirect.github.com/pydantic/pydantic-settings/pull/776) - Fix AliasChoices ignored when changing provider priority by [@hramezani](https://redirect.github.com/hramezani) in [#813](https://redirect.github.com/pydantic/pydantic-settings/pull/813) - fix: resolve KeyError in run\_subcommand for underscore field names by [@bradykieffer](https://redirect.github.com/bradykieffer) in [#799](https://redirect.github.com/pydantic/pydantic-settings/pull/799) - Bump the python-packages group with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#814](https://redirect.github.com/pydantic/pydantic-settings/pull/814) - Fix `Literal[numeric Enum]` coercion for CLI and env vars by [@m9810223](https://redirect.github.com/m9810223) in [#811](https://redirect.github.com/pydantic/pydantic-settings/pull/811) - Fix nested discriminated unions not discovered by env/CLI providers by [@hramezani](https://redirect.github.com/hramezani) in [#816](https://redirect.github.com/pydantic/pydantic-settings/pull/816) - Bump the python-packages group with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#820](https://redirect.github.com/pydantic/pydantic-settings/pull/820) - CLI ensure env nested max split internally. by [@kschwab](https://redirect.github.com/kschwab) in [#821](https://redirect.github.com/pydantic/pydantic-settings/pull/821) - Bump the python-packages group with 4 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#824](https://redirect.github.com/pydantic/pydantic-settings/pull/824) - Migrate `boto3-stubs` to `types-boto3` by [@hramezani](https://redirect.github.com/hramezani) in [#831](https://redirect.github.com/pydantic/pydantic-settings/pull/831) - Fix CLI not recognizing field name with validate\_by\_name and AliasChoices by [@hramezani](https://redirect.github.com/hramezani) in [#826](https://redirect.github.com/pydantic/pydantic-settings/pull/826) - Allow customisation of the dotevn setting source to filter variables by [@CaselIT](https://redirect.github.com/CaselIT) in [#832](https://redirect.github.com/pydantic/pydantic-settings/pull/832) - Bump the python-packages group with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#833](https://redirect.github.com/pydantic/pydantic-settings/pull/833) - Introduce yamlfmt by [@Viicos](https://redirect.github.com/Viicos) in [#836](https://redirect.github.com/pydantic/pydantic-settings/pull/836) - Bump boto3 from 1.42.82 to 1.42.83 in the python-packages group by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#837](https://redirect.github.com/pydantic/pydantic-settings/pull/837) - Introduce zizmor by [@Viicos](https://redirect.github.com/Viicos) in [#838](https://redirect.github.com/pydantic/pydantic-settings/pull/838) - Fix CliPositionalArg\[list\[CustomType]] crash for custom types by [@hramezani](https://redirect.github.com/hramezani) in [#839](https://redirect.github.com/pydantic/pydantic-settings/pull/839) - Add note about Mypy plugin for `BaseSettings.__init__()` by [@Viicos](https://redirect.github.com/Viicos) in [#842](https://redirect.github.com/pydantic/pydantic-settings/pull/842) - Fix `cli_ignore_unknown_args=True` not working on subcommands by [@hramezani](https://redirect.github.com/hramezani) in [#844](https://redirect.github.com/pydantic/pydantic-settings/pull/844) - Bump the python-packages group with 4 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#847](https://redirect.github.com/pydantic/pydantic-settings/pull/847) - Fix CLI descriptions lost under `python -OO` by falling back to `json_schema_extra` by [@hramezani](https://redirect.github.com/hramezani) in [#843](https://redirect.github.com/pydantic/pydantic-settings/pull/843) - Prepare release 2.14.0 by [@hramezani](https://redirect.github.com/hramezani) in [#848](https://redirect.github.com/pydantic/pydantic-settings/pull/848) #### New Contributors - [@dependabot](https://redirect.github.com/dependabot)\[bot] made their first contribution in [#802](https://redirect.github.com/pydantic/pydantic-settings/pull/802) - [@JacobHayes](https://redirect.github.com/JacobHayes) made their first contribution in [#776](https://redirect.github.com/pydantic/pydantic-settings/pull/776) - [@bradykieffer](https://redirect.github.com/bradykieffer) made their first contribution in [#799](https://redirect.github.com/pydantic/pydantic-settings/pull/799) - [@CaselIT](https://redirect.github.com/CaselIT) made their first contribution in [#832](https://redirect.github.com/pydantic/pydantic-settings/pull/832) **Full Changelog**: <https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0> ### [`v2.13.1`](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.13.0...v2.13.1) [Compare Source](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.13.0...v2.13.1) ### [`v2.13.0`](https://redirect.github.com/pydantic/pydantic-settings/releases/tag/v2.13.0) [Compare Source](https://redirect.github.com/pydantic/pydantic-settings/compare/v2.12.0...v2.13.0) #### What's Changed - fix: Deterministic alias selection when using validate\_by\_name by [@chbndrhnns](https://redirect.github.com/chbndrhnns) in [#707](https://redirect.github.com/pydantic/pydantic-settings/pull/707) - add deep merge functionality to config file sources by [@pmeier](https://redirect.github.com/pmeier) in [#698](https://redirect.github.com/pydantic/pydantic-settings/pull/698) - Add support for AWS Secrets Manager VersionId parameter by [@jcyamacho](https://redirect.github.com/jcyamacho) in [#708](https://redirect.github.com/pydantic/pydantic-settings/pull/708) - bugfix: Return `None` for inaccessible GCP Secret Manager secrets by [@zaphod72](https://redirect.github.com/zaphod72) in [#712](https://redirect.github.com/pydantic/pydantic-settings/pull/712) - Bugfix for cli\_kebab\_case="all" and CliImplicitFlag\[bool] by [@Digity101](https://redirect.github.com/Digity101) in [#702](https://redirect.github.com/pydantic/pydantic-settings/pull/702) - Unpack type alisases when looking for `NoDecode` by [@tselepakis](https://redirect.github.com/tselepakis) in [#695](https://redirect.github.com/pydantic/pydantic-settings/pull/695) - CliToggleFlag and CliDualFlag by [@kschwab](https://redirect.github.com/kschwab) in [#717](https://redirect.github.com/pydantic/pydantic-settings/pull/717) - Fix for CLI duplicate enum field values. by [@kschwab](https://redirect.github.com/kschwab) in [#722](https://redirect.github.com/pydantic/pydantic-settings/pull/722) - fixed load nested config from env by [@Sube-py](https://redirect.github.com/Sube-py) in [#723](https://redirect.github.com/pydantic/pydantic-settings/pull/723) - Add non-Path files support (for example Traversable) and open files using Path.open method by [@mahenzon](https://redirect.github.com/mahenzon) in [#724](https://redirect.github.com/pydantic/pydantic-settings/pull/724) - add one more traversable test by [@mahenzon](https://redirect.github.com/mahenzon) in [#725](https://redirect.github.com/pydantic/pydantic-settings/pull/725) - CLI fix fox external list args. by [@kschwab](https://redirect.github.com/kschwab) in [#727](https://redirect.github.com/pydantic/pydantic-settings/pull/727) - fix: handle case-insensitive retrieval in GoogleSecretManagerSettingsSource by [@ezwiefel](https://redirect.github.com/ezwiefel) in [#730](https://redirect.github.com/pydantic/pydantic-settings/pull/730) - CLI test fixes for help text formatting. by [@kschwab](https://redirect.github.com/kschwab) in [#735](https://redirect.github.com/pydantic/pydantic-settings/pull/735) - Avoid conflicts with the `NAME` environment variable in WSL by [@kzrnm](https://redirect.github.com/kzrnm) in [#747](https://redirect.github.com/pydantic/pydantic-settings/pull/747) - fix: When restoring init kwargs, use deterministic order by [@chbndrhnns](https://redirect.github.com/chbndrhnns) in [#746](https://redirect.github.com/pydantic/pydantic-settings/pull/746) - Add env\_prefix\_target by [@kzrnm](https://redirect.github.com/kzrnm) in [#749](https://redirect.github.com/pydantic/pydantic-settings/pull/749) - Remove `(default: …)` in the help message for `CliToggleFlag` by [@kzrnm](https://redirect.github.com/kzrnm) in [#740](https://redirect.github.com/pydantic/pydantic-settings/pull/740) - Add support for CLI serialize styles. by [@kschwab](https://redirect.github.com/kschwab) in [#755](https://redirect.github.com/pydantic/pydantic-settings/pull/755) - Add support for overriding default help on CLI internal parser. by [@kschwab](https://redirect.github.com/kschwab) in [#758](https://redirect.github.com/pydantic/pydantic-settings/pull/758) - CLI format\_help method support by [@kschwab](https://redirect.github.com/kschwab) in [#759](https://redirect.github.com/pydantic/pydantic-settings/pull/759) - feat(gcp): support SecretVersion annotation for per-field secret versioning by [@ezwiefel](https://redirect.github.com/ezwiefel) in [#763](https://redirect.github.com/pydantic/pydantic-settings/pull/763) - Allow `snake_case_conversion` with `env_prefix` for Azure Key Vault source by [@cstarkers](https://redirect.github.com/cstarkers) in [#762](https://redirect.github.com/pydantic/pydantic-settings/pull/762) - fix: Only override preferred\_key when no value was found by [@chbndrhnns](https://redirect.github.com/chbndrhnns) in [#767](https://redirect.github.com/pydantic/pydantic-settings/pull/767) - Update deps by [@hramezani](https://redirect.github.com/hramezani) in [#768](https://redirect.github.com/pydantic/pydantic-settings/pull/768) - CLI coerce numeric types. by [@kschwab](https://redirect.github.com/kschwab) in [#769](https://redirect.github.com/pydantic/pydantic-settings/pull/769) - CLI Union Discriminator Choices in Help by [@kschwab](https://redirect.github.com/kschwab) in [#764](https://redirect.github.com/pydantic/pydantic-settings/pull/764) - Add nested path support for yaml\_config\_section (fixes [#772](https://redirect.github.com/pydantic/pydantic-settings/issues/772)) by [@hugo-romero-mm](https://redirect.github.com/hugo-romero-mm) in [#773](https://redirect.github.com/pydantic/pydantic-settings/pull/773) - Prepare release 2.13.0 by [@hramezani](https://redirect.github.com/hramezani) in [#777](https://redirect.github.com/pydantic/pydantic-settings/pull/777) #### New Contributors - [@pmeier](https://redirect.github.com/pmeier) made their first contribution in [#698](https://redirect.github.com/pydantic/pydantic-settings/pull/698) - [@jcyamacho](https://redirect.github.com/jcyamacho) made their first contribution in [#708](https://redirect.github.com/pydantic/pydantic-settings/pull/708) - [@zaphod72](https://redirect.github.com/zaphod72) made their first contribution in [#712](https://redirect.github.com/pydantic/pydantic-settings/pull/712) - [@Digity101](https://redirect.github.com/Digity101) made their first contribution in [#702](https://redirect.github.com/pydantic/pydantic-settings/pull/702) - [@Sube-py](https://redirect.github.com/Sube-py) made their first contribution in [#723](https://redirect.github.com/pydantic/pydantic-settings/pull/723) - [@mahenzon](https://redirect.github.com/mahenzon) made their first contribution in [#724](https://redirect.github.com/pydantic/pydantic-settings/pull/724) - [@kzrnm](https://redirect.github.com/kzrnm) made their first contribution in [#747](https://redirect.github.com/pydantic/pydantic-settings/pull/747) - [@cstarkers](https://redirect.github.com/cstarkers) made their first contribution in [#762](https://redirect.github.com/pydantic/pydantic-settings/pull/762) - [@hugo-romero-mm](https://redirect.github.com/hugo-romero-mm) made their first contribution in [#773](https://redirect.github.com/pydantic/pydantic-settings/pull/773) **Full Changelog**: <https://github.com/pydantic/pydantic-settings/compare/v2.12.0...v2.13.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Glitchy-Sheep/boosty-downloader).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 19:47:29 +00:00