chore(deps): update dependency pydantic-settings to v2.14.2 - autoclosed #123

Closed

renovate-bot wants to merge 1 commit from renovate/pydantic-settings-2.x into main

renovate-bot commented

2026-06-19 16:31:40 +02:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
pydantic-settings (changelog)	`==2.14.1` → `==2.14.2`

Release Notes

pydantic/pydantic-settings (pydantic-settings)

`v2.14.2`

Compare Source

What's Changed

This is a security patch release.

Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @hramezani in #889
Prepare release 2.14.2 by @hramezani in #890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pydantic-settings](https://github.com/pydantic/pydantic-settings) ([changelog](https://github.com/pydantic/pydantic-settings/releases)) | `==2.14.1` → `==2.14.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pydantic-settings/2.14.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pydantic-settings/2.14.1/2.14.2?slim=true) | --- ### Release Notes <details> <summary>pydantic/pydantic-settings (pydantic-settings)</summary> ### [`v2.14.2`](https://github.com/pydantic/pydantic-settings/releases/tag/v2.14.2) [Compare Source](https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2) #### What's Changed This is a security patch release. - Prevent `NestedSecretsSettingsSource` from following symlinks outside `secrets_dir` by [@hramezani](https://github.com/hramezani) in [#889](https://github.com/pydantic/pydantic-settings/pull/889) - Prepare release 2.14.2 by [@hramezani](https://github.com/hramezani) in [#890](https://github.com/pydantic/pydantic-settings/pull/890) ##### Security Fixes [GHSA-4xgf-cpjx-pc3j](https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j): `NestedSecretsSettingsSource` with `secrets_nested_subdir=True` could follow a symbolic link inside `secrets_dir` pointing outside it, reading out-of-tree files into settings values and bypassing the `secrets_dir_max_size` cap. Affected versions: `>= 2.12.0, < 2.14.2`. **Full Changelog**: <https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added the

dependencies

label 2026-06-19 16:31:40 +02:00

renovate-bot added 1 commit 2026-06-19 16:31:41 +02:00

chore(deps): update dependency pydantic-settings to v2.14.2

PR Tests / test (pull_request) Successful in 1m17s

Details

NYX Security Scan / nyx-scan (pull_request) Successful in 6m55s

Details

66801a2217

renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-06-19 16:31:47 +02:00

renovate-bot changed title from ~~chore(deps): update dependency pydantic-settings to v2.14.2~~ to chore(deps): update dependency pydantic-settings to v2.14.2 - autoclosed

2026-06-20 03:32:35 +02:00

renovate-bot closed this pull request

2026-06-20 03:32:36 +02:00