pypi / datamodel-code-generator

datamodel-code-generator

What changed in datamodel-code-generator 0.60 to 0.86, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

10 breaking13 security1 deprecations4 new APIs and options4 behavior and defaults7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

datamodel-code-generator 0.8616 changes

Mapped format: byte strings with length constraints now generate Annotated bytes using EncodedBytes and Base64Encoder, decoding base64 and checking lengths on the encoded text.
0.86.0release notes
Mapped format: byte fields under strict bytes now decode base64 instead of holding raw text; FastAPI path, query, header, and cookie parameters no longer stop generation with an error.
0.86.0release notes
Mapped format: byte values without constraints now pass through base64 decoding, including byte strings in multi-type schemas.
0.86.0release notes
Integer and subclass enums listing null no longer generate a None member that raises TypeError on import; an enum containing only null becomes RootModel[None].
0.86.0release notes
Optional one-value Literal discriminator tags now default to their sole value instead of None, allowing the discriminated union to import.
0.86.0release notes

The generator warns about msgspec unions containing an Enum alongside another member of the same JSON type.
0.86.0release notes

Adds schema analysis and rule-based recommendations for generation options.
0.86.0release notes
Adds an option to represent single-value enums as constants; nullable unions and mixed-type branches are kept distinct, and nullable single-value enums remain enums that accept null.
0.86.0release notes
Adds an option to use tag values as union variant names; prefixed names of models inside key-named branches no longer repeat the key.
0.86.0release notes

Long Annotated assignments with a None default are wrapped like black; --check with a dated preset using the builtin formatter reports the reformatting.
0.86.0release notes
Warns when keys in the model name map match no generated model.
0.86.0release notes

Number constraints are no longer emitted on generated fields whose types do not take them.
0.86.0release notes
Pydantic discriminator tag fields no longer carry a pattern that every tag value already satisfies, avoiding generated output that fails at import.
0.86.0release notes
Generated msgspec Structs are flattened when their generated bases have conflicting layouts.
0.86.0release notes
A stale name for a renamed type is released from a package __init__ re-import.
0.86.0release notes
Generated code now imports the object that holds enum members used by x-python-type Literals.
0.86.0release notes

Output encoding failures now raise datamodel_code_generator.Error instead of codec exceptions; modular output writes no files if a module cannot be encoded.
0.85.0release notes
Unknown encodings and codecs that are not text encodings are rejected during config preparation, before input is read or output paths are created.
0.85.0release notes
The builtin formatter now classifies standard-library imports using the target Python version; when no target is given, it uses 3.10.
0.85.0release notes
Non-ASCII generated names now follow the target Python version's Unicode rules, which can change field, class, enum member, and module names.
0.85.0release notes
Generation fails if a referenced standard-library type is unavailable in the target Python version.
0.85.0release notes

The builtin formatter now places each module in a multi-module import statement in its own section according to its category.
0.85.0release notes
Explicit names are validated against the target Python version's identifier rules rather than those of the running interpreter.
0.85.0release notes

Model reuse now recognizes references starting with non-ASCII letters, so equivalent models can be reused instead of emitted as duplicates.
0.85.0release notes
Newer typing and collections.abc names requested through overrides or schema import paths are imported from typing_extensions when unavailable in the target Python version.
0.85.0release notes

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
0.81.0security advisory

datamodel-code-generator vulnerable to code injection via x-python-import / customTypePath in generated import statements
0.64.0security advisory

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
0.63.0security advisory
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
0.63.0security advisory

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema $ref (file:// and ../ traversal), bypassing --no-allow-remote-refs
0.62.0security advisory
datamodel-code-generator vulnerable to arbitrary local file read via XSD schemaLocation (xs:include/xs:import) path traversal, with no remote-ref gate
0.62.0security advisory

datamodel-code-generator vulnerable to SSRF via JSON-Schema $ref to HTTP URL (silent by default)
0.61.0security advisory
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
0.61.0security advisory

datamodel-code-generator vulnerable to code execution on import via unescaped validators entries in --extra-template-data
0.60.2security advisory
datamodel-code-generator vulnerable to code execution on import via x-python-type JSON-Schema extension in datamodel-code-generator
0.60.2security advisory
datamodel-code-generator vulnerable to code injection in via attacker-controlled default_factory schema field
0.60.2security advisory
datamodel-code-generator vulnerable to code injection via unescaped carriage return in --extra-template-data comment field
0.60.2security advisory
datamodel-code-generator vulnerable to code injection via unescaped carriage return in GraphQL Union description
0.60.1security advisory