Security
Fixes authentication/throttle bypasses on nested routers, introduced in 1.6.0 by the reusable routers change (#1622). All 1.6.x users should upgrade.
api.add_router(prefix, router, auth=..., throttle=...)now applies the override to routers nested inside the mounted router too. Before, if the router set its ownauth(includingauth=None), its nested routers ignored the override.Router.add_router(prefix, child, auth=..., throttle=...)now stores the override for that mount only, instead of writing it ontochild. Before, if the same child router was added under several parents, the last override applied to all of them. For example, adding it to a public parent withauth=Noneremoved authentication from the protected parent's copy. (GHSA-8824-xgqv-rgm4, GHSA-w84h-fgmh-gcg9)
Fixed in #1819
Hotfix release cut from v1.6.3. It contains only the changes above, plus a test-only fix for pydantic 2.14 (#1797).
Full Changelog: v1.6.3...v1.6.4