koxudaxi/datamodel-code-generator 0.73.0 on GitHub

Breaking Changes

Additional imports are now validated as Python import paths - Values passed via --additional-imports, the Python config API (GenerateConfig, JSONSchemaParserConfig, etc.), or --extra-template-data must now be dotted sequences of Python identifiers. Previously any value was accepted and split on commas without validation; now inputs that are not valid import paths (e.g. containing newlines, semicolons, or non-identifier syntax) raise an Error and abort generation instead of being emitted into the generated output. Valid dotted paths (optionally whitespace-padded) continue to work unchanged. (#3763)

additional_imports must be a Python import path composed of identifiers: 'collections.deque\nINJECTION_MARKER = 1'

Reserved template keys in --extra-template-data now raise an error for built-in templates - When rendering a built-in (project-owned) template, supplying any generator-reserved key through --extra-template-data (or the extra_template_data API argument) now raises an Error and aborts generation instead of injecting the value. The reserved keys are class_body_lines, config_items, schema_runtime_validation, schema_runtime_validation_base_class_name, schema_runtime_validation_use_base, sequence_base_class, sequence_item_type, sequence_slice_type, _safe_config_items, typed_dict_kwargs, and typed_dict_kwargs_suffix. To inject raw code via these keys you must now use a custom root template through --custom-template-dir. (#3765)
Stricter extra_template_data validation - extra_template_data that is not a dictionary, contains non-string keys, or contains duplicate (normalized) keys now raises an Error rather than being silently accepted. (#3765)

Built-in templates now serialize extra_template_data values as non-executing literals - For built-in templates, user-supplied values that were previously emitted as raw Python source are now serialized as quoted, non-executing literals. This affects GraphQL scalar py_type, TypedDict additionalPropertiesType, ConfigDict values, msgspec base_class_kwargs, and comments. Only bare or dotted identifiers (e.g. datetime.date) are still emitted unquoted; more complex expressions become string literals. For example, a scalar py_type supplied as a type expression is now rendered as:

Evil = TypeAliasType("Evil", "__import__('os').system('id') or str")

Trusted custom root templates (--custom-template-dir providing the root template) keep the previous unrestricted raw behavior. (#3765)

Include-only custom template directories no longer receive raw built-in context - "Custom root" detection changed from template_file_path.is_absolute() to _uses_custom_root_template. A --custom-template-dir that only supplies include/partial templates (not the model's root template) no longer opts the built-in root into the unrestricted raw-context path; its extra_template_data is now treated with the hardened built-in rules (and reserved keys raise an error). (#3765)

Full Changelog: 0.72.4...0.73.0