Skip to content

build(deps-dev): bump datamodel-code-generator from 0.25.9 to 0.73.0 - #289

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/datamodel-code-generator-0.73.0
Open

build(deps-dev): bump datamodel-code-generator from 0.25.9 to 0.73.0#289
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/datamodel-code-generator-0.73.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor

Bumps datamodel-code-generator from 0.25.9 to 0.73.0.

Release notes

Sourced from datamodel-code-generator's releases.

0.73.0

Breaking Changes

Error Handling Changes

  • Additional imports are now validated as Python import paths - Values passed via --additional-imports, the Python config API (GenerateConfig, JSONSchemaParserConfig, etc.), or --extra-template-data must now be dotted sequences of Python identifiers. Previously any value was accepted and split on commas without validation; now inputs that are not valid import paths (e.g. containing newlines, semicolons, or non-identifier syntax) raise an Error and abort generation instead of being emitted into the generated output. Valid dotted paths (optionally whitespace-padded) continue to work unchanged. (#3763)
additional_imports must be a Python import path composed of identifiers: 'collections.deque\nINJECTION_MARKER = 1'

Default Behavior Changes

  • Reserved template keys in --extra-template-data now raise an error for built-in templates - When rendering a built-in (project-owned) template, supplying any generator-reserved key through --extra-template-data (or the extra_template_data API argument) now raises an Error and aborts generation instead of injecting the value. The reserved keys are class_body_lines, config_items, schema_runtime_validation, schema_runtime_validation_base_class_name, schema_runtime_validation_use_base, sequence_base_class, sequence_item_type, sequence_slice_type, _safe_config_items, typed_dict_kwargs, and typed_dict_kwargs_suffix. To inject raw code via these keys you must now use a custom root template through --custom-template-dir. (#3765)
  • Stricter extra_template_data validation - extra_template_data that is not a dictionary, contains non-string keys, or contains duplicate (normalized) keys now raises an Error rather than being silently accepted. (#3765)

Code Generation Changes

  • Built-in templates now serialize extra_template_data values as non-executing literals - For built-in templates, user-supplied values that were previously emitted as raw Python source are now serialized as quoted, non-executing literals. This affects GraphQL scalar py_type, TypedDict additionalPropertiesType, ConfigDict values, msgspec base_class_kwargs, and comments. Only bare or dotted identifiers (e.g. datetime.date) are still emitted unquoted; more complex expressions become string literals. For example, a scalar py_type supplied as a type expression is now rendered as:
Evil = TypeAliasType("Evil", "__import__('os').system('id') or str")

Trusted custom root templates (--custom-template-dir providing the root template) keep the previous unrestricted raw behavior. (#3765)

  • Include-only custom template directories no longer receive raw built-in context - "Custom root" detection changed from template_file_path.is_absolute() to _uses_custom_root_template. A --custom-template-dir that only supplies include/partial templates (not the model's root template) no longer opts the built-in root into the unrestricted raw-context path; its extra_template_data is now treated with the hardened built-in rules (and reserved keys raise an error). (#3765)

What's Changed

Full Changelog: koxudaxi/datamodel-code-generator@0.72.4...0.73.0

0.72.3

What's Changed

... (truncated)

Changelog

Sourced from datamodel-code-generator's changelog.

0.73.0 - 2026-08-15

Breaking Changes

Error Handling Changes

  • Additional imports are now validated as Python import paths - Values passed via --additional-imports, the Python config API (GenerateConfig, JSONSchemaParserConfig, etc.), or --extra-template-data must now be dotted sequences of Python identifiers. Previously any value was accepted and split on commas without validation; now inputs that are not valid import paths (e.g. containing newlines, semicolons, or non-identifier syntax) raise an Error and abort generation instead of being emitted into the generated output. Valid dotted paths (optionally whitespace-padded) continue to work unchanged. (#3763)
additional_imports must be a Python import path composed of identifiers: 'collections.deque\nINJECTION_MARKER = 1'

Default Behavior Changes

  • Reserved template keys in --extra-template-data now raise an error for built-in templates - When rendering a built-in (project-owned) template, supplying any generator-reserved key through --extra-template-data (or the extra_template_data API argument) now raises an Error and aborts generation instead of injecting the value. The reserved keys are class_body_lines, config_items, schema_runtime_validation, schema_runtime_validation_base_class_name, schema_runtime_validation_use_base, sequence_base_class, sequence_item_type, sequence_slice_type, _safe_config_items, typed_dict_kwargs, and typed_dict_kwargs_suffix. To inject raw code via these keys you must now use a custom root template through --custom-template-dir. (#3765)
  • Stricter extra_template_data validation - extra_template_data that is not a dictionary, contains non-string keys, or contains duplicate (normalized) keys now raises an Error rather than being silently accepted. (#3765)

Code Generation Changes

  • Built-in templates now serialize extra_template_data values as non-executing literals - For built-in templates, user-supplied values that were previously emitted as raw Python source are now serialized as quoted, non-executing literals. This affects GraphQL scalar py_type, TypedDict additionalPropertiesType, ConfigDict values, msgspec base_class_kwargs, and comments. Only bare or dotted identifiers (e.g. datetime.date) are still emitted unquoted; more complex expressions become string literals. For example, a scalar py_type supplied as a type expression is now rendered as:
Evil = TypeAliasType("Evil", "__import__('os').system('id') or str")

Trusted custom root templates (--custom-template-dir providing the root template) keep the previous unrestricted raw behavior. (#3765)

  • Include-only custom template directories no longer receive raw built-in context - "Custom root" detection changed from template_file_path.is_absolute() to _uses_custom_root_template. A --custom-template-dir that only supplies include/partial templates (not the model's root template) no longer opts the built-in root into the unrestricted raw-context path; its extra_template_data is now treated with the hardened built-in rules (and reserved keys raise an error). (#3765)

What's Changed

Full Changelog: koxudaxi/datamodel-code-generator@0.72.4...0.73.0

0.72.4 - 2026-08-12

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps-dev): bump datamodel-code-generator from 0.25.9 to 0.73.0
e487fc0 
Bumps [datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator) from 0.25.9 to 0.73.0.
- [Release notes](https://github.com/koxudaxi/datamodel-code-generator/releases)
- [Changelog](https://github.com/koxudaxi/datamodel-code-generator/blob/main/CHANGELOG.md)
- [Commits](koxudaxi/datamodel-code-generator@0.25.9...0.73.0)

---
updated-dependencies:
- dependency-name: datamodel-code-generator
  dependency-version: 0.73.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 18, 2026
@dependabot dependabot Bot mentioned this pull request Aug 18, 2026
Closed
@github-actions
github-actions Bot enabled auto-merge (squash) August 18, 2026 14:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants