dependabot[bot] opened a new pull request, #17776: URL: https://github.com/apache/iceberg/pull/17776
Bumps [datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator) from 0.72.2 to 0.73.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/koxudaxi/datamodel-code-generator/releases">datamodel-code-generator's releases</a>.</em></p> <blockquote> <h2>0.73.0</h2> <h2>Breaking Changes</h2> <h3>Error Handling Changes</h3> <ul> <li>Additional imports are now validated as Python import paths - Values passed via <code>--additional-imports</code>, the Python config API (<code>GenerateConfig</code>, <code>JSONSchemaParserConfig</code>, etc.), or <code>--extra-template-data</code> must now be dotted sequences of Python identifiers. Previously any value was accepted and split on commas without validation; now inputs that are not valid import paths (e.g. containing newlines, semicolons, or non-identifier syntax) raise an <code>Error</code> and abort generation instead of being emitted into the generated output. Valid dotted paths (optionally whitespace-padded) continue to work unchanged. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3763">#3763</a>)</li> </ul> <pre><code>additional_imports must be a Python import path composed of identifiers: 'collections.deque\nINJECTION_MARKER = 1' </code></pre> <h3>Default Behavior Changes</h3> <ul> <li>Reserved template keys in <code>--extra-template-data</code> now raise an error for built-in templates - When rendering a built-in (project-owned) template, supplying any generator-reserved key through <code>--extra-template-data</code> (or the <code>extra_template_data</code> API argument) now raises an <code>Error</code> and aborts generation instead of injecting the value. The reserved keys are <code>class_body_lines</code>, <code>config_items</code>, <code>schema_runtime_validation</code>, <code>schema_runtime_validation_base_class_name</code>, <code>schema_runtime_validation_use_base</code>, <code>sequence_base_class</code>, <code>sequence_item_type</code>, <code>sequence_slice_type</code>, <code>_safe_config_items</code>, <code>typed_dict_kwargs</code>, and <code>typed_dict_kwargs_suffix</code>. To inject raw code via these keys you must now use a custom root template through <code>--custom-template-dir</code>. (<a href="https://redirect.github.com/koxudaxi/datamodel-cod e-generator/issues/3765">#3765</a>)</li> <li>Stricter <code>extra_template_data</code> validation - <code>extra_template_data</code> that is not a dictionary, contains non-string keys, or contains duplicate (normalized) keys now raises an <code>Error</code> rather than being silently accepted. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</li> </ul> <h3>Code Generation Changes</h3> <ul> <li>Built-in templates now serialize <code>extra_template_data</code> values as non-executing literals - For built-in templates, user-supplied values that were previously emitted as raw Python source are now serialized as quoted, non-executing literals. This affects GraphQL scalar <code>py_type</code>, TypedDict <code>additionalPropertiesType</code>, <code>ConfigDict</code> values, msgspec <code>base_class_kwargs</code>, and comments. Only bare or dotted identifiers (e.g. <code>datetime.date</code>) are still emitted unquoted; more complex expressions become string literals. For example, a scalar <code>py_type</code> supplied as a type expression is now rendered as:</li> </ul> <pre lang="python"><code>Evil = TypeAliasType("Evil", "__import__('os').system('id') or str") </code></pre> <p>Trusted custom root templates (<code>--custom-template-dir</code> providing the root template) keep the previous unrestricted raw behavior. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</p> <ul> <li>Include-only custom template directories no longer receive raw built-in context - "Custom root" detection changed from <code>template_file_path.is_absolute()</code> to <code>_uses_custom_root_template</code>. A <code>--custom-template-dir</code> that only supplies include/partial templates (not the model's root template) no longer opts the built-in root into the unrestricted raw-context path; its <code>extra_template_data</code> is now treated with the hardened built-in rules (and reserved keys raise an error). (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Update CHANGELOG for 0.72.4 by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3736">koxudaxi/datamodel-code-generator#3736</a></li> <li>Update release benchmark data by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3737">koxudaxi/datamodel-code-generator#3737</a></li> <li>Guard refactor contracts by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3739">koxudaxi/datamodel-code-generator#3739</a></li> <li>Tighten generation types by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3740">koxudaxi/datamodel-code-generator#3740</a></li> <li>Simplify generation dispatch by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3741">koxudaxi/datamodel-code-generator#3741</a></li> <li>Simplify parser metadata flow by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3742">koxudaxi/datamodel-code-generator#3742</a></li> <li>Optimize built-in generation performance by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3738">koxudaxi/datamodel-code-generator#3738</a></li> <li>Optimize simple field construction by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3754">koxudaxi/datamodel-code-generator#3754</a></li> <li>Optimize msgspec unset field rendering by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3755">koxudaxi/datamodel-code-generator#3755</a></li> <li>Optimize false reference handling by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3750">koxudaxi/datamodel-code-generator#3750</a></li> <li>Compile built-in templates by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3757">koxudaxi/datamodel-code-generator#3757</a></li> <li>Optimize Pydantic field name resolution by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3758">koxudaxi/datamodel-code-generator#3758</a></li> <li>Avoid Jinja in the playground runtime by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3759">koxudaxi/datamodel-code-generator#3759</a></li> <li>Fix main lint workflow by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3761">koxudaxi/datamodel-code-generator#3761</a></li> <li>Bump the github-actions group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3751">koxudaxi/datamodel-code-generator#3751</a></li> <li>Fix payload runtime validation exclusions by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3764">koxudaxi/datamodel-code-generator#3764</a></li> <li>Validate additional import paths by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3763">koxudaxi/datamodel-code-generator#3763</a></li> <li>Harden built-in template data by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3765">koxudaxi/datamodel-code-generator#3765</a></li> <li>Restrict template source paths by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3766">koxudaxi/datamodel-code-generator#3766</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/koxudaxi/datamodel-code-generator/compare/0.72.4...0.73.0">https://github.com/koxudaxi/datamodel-code-generator/compare/0.72.4...0.73.0</a></p> <h2>0.72.3</h2> <h2>What's Changed</h2> <ul> <li>Update CHANGELOG for 0.72.2 by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3715">koxudaxi/datamodel-code-generator#3715</a></li> <li>Update release benchmark data by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3721">koxudaxi/datamodel-code-generator#3721</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/koxudaxi/datamodel-code-generator/blob/main/CHANGELOG.md">datamodel-code-generator's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.73.0">0.73.0</a> - 2026-08-15</h2> <h2>Breaking Changes</h2> <h3>Error Handling Changes</h3> <ul> <li>Additional imports are now validated as Python import paths - Values passed via <code>--additional-imports</code>, the Python config API (<code>GenerateConfig</code>, <code>JSONSchemaParserConfig</code>, etc.), or <code>--extra-template-data</code> must now be dotted sequences of Python identifiers. Previously any value was accepted and split on commas without validation; now inputs that are not valid import paths (e.g. containing newlines, semicolons, or non-identifier syntax) raise an <code>Error</code> and abort generation instead of being emitted into the generated output. Valid dotted paths (optionally whitespace-padded) continue to work unchanged. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3763">#3763</a>)</li> </ul> <pre><code>additional_imports must be a Python import path composed of identifiers: 'collections.deque\nINJECTION_MARKER = 1' </code></pre> <h3>Default Behavior Changes</h3> <ul> <li>Reserved template keys in <code>--extra-template-data</code> now raise an error for built-in templates - When rendering a built-in (project-owned) template, supplying any generator-reserved key through <code>--extra-template-data</code> (or the <code>extra_template_data</code> API argument) now raises an <code>Error</code> and aborts generation instead of injecting the value. The reserved keys are <code>class_body_lines</code>, <code>config_items</code>, <code>schema_runtime_validation</code>, <code>schema_runtime_validation_base_class_name</code>, <code>schema_runtime_validation_use_base</code>, <code>sequence_base_class</code>, <code>sequence_item_type</code>, <code>sequence_slice_type</code>, <code>_safe_config_items</code>, <code>typed_dict_kwargs</code>, and <code>typed_dict_kwargs_suffix</code>. To inject raw code via these keys you must now use a custom root template through <code>--custom-template-dir</code>. (<a href="https://redirect.github.com/koxudaxi/datamodel-cod e-generator/issues/3765">#3765</a>)</li> <li>Stricter <code>extra_template_data</code> validation - <code>extra_template_data</code> that is not a dictionary, contains non-string keys, or contains duplicate (normalized) keys now raises an <code>Error</code> rather than being silently accepted. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</li> </ul> <h3>Code Generation Changes</h3> <ul> <li>Built-in templates now serialize <code>extra_template_data</code> values as non-executing literals - For built-in templates, user-supplied values that were previously emitted as raw Python source are now serialized as quoted, non-executing literals. This affects GraphQL scalar <code>py_type</code>, TypedDict <code>additionalPropertiesType</code>, <code>ConfigDict</code> values, msgspec <code>base_class_kwargs</code>, and comments. Only bare or dotted identifiers (e.g. <code>datetime.date</code>) are still emitted unquoted; more complex expressions become string literals. For example, a scalar <code>py_type</code> supplied as a type expression is now rendered as:</li> </ul> <pre lang="python"><code>Evil = TypeAliasType("Evil", "__import__('os').system('id') or str") </code></pre> <p>Trusted custom root templates (<code>--custom-template-dir</code> providing the root template) keep the previous unrestricted raw behavior. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</p> <ul> <li>Include-only custom template directories no longer receive raw built-in context - "Custom root" detection changed from <code>template_file_path.is_absolute()</code> to <code>_uses_custom_root_template</code>. A <code>--custom-template-dir</code> that only supplies include/partial templates (not the model's root template) no longer opts the built-in root into the unrestricted raw-context path; its <code>extra_template_data</code> is now treated with the hardened built-in rules (and reserved keys raise an error). (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Update CHANGELOG for 0.72.4 by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3736">koxudaxi/datamodel-code-generator#3736</a></li> <li>Update release benchmark data by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3737">koxudaxi/datamodel-code-generator#3737</a></li> <li>Guard refactor contracts by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3739">koxudaxi/datamodel-code-generator#3739</a></li> <li>Tighten generation types by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3740">koxudaxi/datamodel-code-generator#3740</a></li> <li>Simplify generation dispatch by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3741">koxudaxi/datamodel-code-generator#3741</a></li> <li>Simplify parser metadata flow by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3742">koxudaxi/datamodel-code-generator#3742</a></li> <li>Optimize built-in generation performance by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3738">koxudaxi/datamodel-code-generator#3738</a></li> <li>Optimize simple field construction by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3754">koxudaxi/datamodel-code-generator#3754</a></li> <li>Optimize msgspec unset field rendering by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3755">koxudaxi/datamodel-code-generator#3755</a></li> <li>Optimize false reference handling by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3750">koxudaxi/datamodel-code-generator#3750</a></li> <li>Compile built-in templates by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3757">koxudaxi/datamodel-code-generator#3757</a></li> <li>Optimize Pydantic field name resolution by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3758">koxudaxi/datamodel-code-generator#3758</a></li> <li>Avoid Jinja in the playground runtime by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3759">koxudaxi/datamodel-code-generator#3759</a></li> <li>Fix main lint workflow by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3761">koxudaxi/datamodel-code-generator#3761</a></li> <li>Bump the github-actions group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3751">koxudaxi/datamodel-code-generator#3751</a></li> <li>Fix payload runtime validation exclusions by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3764">koxudaxi/datamodel-code-generator#3764</a></li> <li>Validate additional import paths by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3763">koxudaxi/datamodel-code-generator#3763</a></li> <li>Harden built-in template data by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3765">koxudaxi/datamodel-code-generator#3765</a></li> <li>Restrict template source paths by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3766">koxudaxi/datamodel-code-generator#3766</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/koxudaxi/datamodel-code-generator/compare/0.72.4...0.73.0">https://github.com/koxudaxi/datamodel-code-generator/compare/0.72.4...0.73.0</a></p> <hr /> <h2><a href="https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.72.4">0.72.4</a> - 2026-08-12</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/f503699143c39a3942f2eb68275beaecb47131ef"><code>f503699</code></a> Restrict template source paths (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3766">#3766</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/eaacba0e12888b500f511eea6b507c93b53c01fd"><code>eaacba0</code></a> Harden built-in template data (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3765">#3765</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/203bdedef5cced082c02ec85f2de97114154aeba"><code>203bded</code></a> Merge commit from fork</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/017546447fb78e5372b93ec0ae0382fb8b38810e"><code>0175464</code></a> Validate additional import paths (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3763">#3763</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/df05a935c6f73fa31d3a78005d5ab653db95295c"><code>df05a93</code></a> Fix payload runtime validation exclusions (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3764">#3764</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/9ce6a569b0d6070f9f1549419c11bfa393fd6ad8"><code>9ce6a56</code></a> Bump the github-actions group with 5 updates (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3751">#3751</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/909b8c9d3a2028075f6b22ae7de1371e6d5320c4"><code>909b8c9</code></a> Fix main lint workflow (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3761">#3761</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/6a7377876c9dfecafb23da4b72bdca5e07479836"><code>6a73778</code></a> Avoid Jinja in the playground runtime (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3759">#3759</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/ee44e9c8c0a68bdabe42ebae6add2779a634f6c8"><code>ee44e9c</code></a> Optimize Pydantic field name resolution (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3758">#3758</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/524d3fda6c11200e296ae2e64c190b2d39009d3e"><code>524d3fd</code></a> Compile built-in templates (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3757">#3757</a>)</li> <li>Additional commits viewable in <a href="https://github.com/koxudaxi/datamodel-code-generator/compare/0.72.2...0.73.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
