# What changed in datamodel-code-generator > 39 changes in datamodel-code-generator 0.60 to 0.86 from its official release notes, upgrade guides and advisories: 10 breaking, 1 deprecations, 13 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/datamodel-code-generator/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## datamodel-code-generator 0.86 ### Breaking changes - Mapped format: byte strings with length constraints now generate Annotated bytes using EncodedBytes and Base64Encoder, decoding base64 and checking lengths on the encoded text. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Mapped format: byte fields under strict bytes now decode base64 instead of holding raw text; FastAPI path, query, header, and cookie parameters no longer stop generation with an error. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Mapped format: byte values without constraints now pass through base64 decoding, including byte strings in multi-type schemas. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Integer and subclass enums listing null no longer generate a None member that raises TypeError on import; an enum containing only null becomes RootModel[None]. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Optional one-value Literal discriminator tags now default to their sole value instead of None, allowing the discriminated union to import. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) ### Deprecations - The generator warns about msgspec unions containing an Enum alongside another member of the same JSON type. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) ### New APIs and options - Adds schema analysis and rule-based recommendations for generation options. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Adds an option to represent single-value enums as constants; nullable unions and mixed-type branches are kept distinct, and nullable single-value enums remain enums that accept null. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Adds an option to use tag values as union variant names; prefixed names of models inside key-named branches no longer repeat the key. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) ### Behavior and default changes - Long Annotated assignments with a None default are wrapped like black; --check with a dated preset using the builtin formatter reports the reformatting. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Warns when keys in the model name map match no generated model. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) ### Fixes and other changes - Number constraints are no longer emitted on generated fields whose types do not take them. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Pydantic discriminator tag fields no longer carry a pattern that every tag value already satisfies, avoiding generated output that fails at import. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Generated msgspec Structs are flattened when their generated bases have conflicting layouts. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - A stale name for a renamed type is released from a package __init__ re-import. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) - Generated code now imports the object that holds enum members used by x-python-type Literals. (0.86.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.86.0) ## datamodel-code-generator 0.85 ### Breaking changes - Output encoding failures now raise datamodel_code_generator.Error instead of codec exceptions; modular output writes no files if a module cannot be encoded. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) - Unknown encodings and codecs that are not text encodings are rejected during config preparation, before input is read or output paths are created. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) - The builtin formatter now classifies standard-library imports using the target Python version; when no target is given, it uses 3.10. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) - Non-ASCII generated names now follow the target Python version's Unicode rules, which can change field, class, enum member, and module names. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) - Generation fails if a referenced standard-library type is unavailable in the target Python version. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) ### New APIs and options - Python 3.15 is now available as a target version. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) ### Behavior and default changes - The builtin formatter now places each module in a multi-module import statement in its own section according to its category. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) - Explicit names are validated against the target Python version's identifier rules rather than those of the running interpreter. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) ### Fixes and other changes - Model reuse now recognizes references starting with non-ASCII letters, so equivalent models can be reused instead of emitted as duplicates. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) - Newer typing and collections.abc names requested through overrides or schema import paths are imported from typing_extensions when unavailable in the target Python version. (0.85.0) — [release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.85.0) ## datamodel-code-generator 0.81 ### Security - datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory (0.81.0) — [security advisory](https://github.com/advisories/GHSA-77XJ-X4RM-935C) ## datamodel-code-generator 0.64 ### Security - datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements (0.64.0) — [security advisory](https://github.com/advisories/GHSA-5578-W22F-PFX9) ## datamodel-code-generator 0.63 ### Security - datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas (0.63.0) — [security advisory](https://github.com/advisories/GHSA-R5VV-FF45-PRP2) - datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding (0.63.0) — [security advisory](https://github.com/advisories/GHSA-VX7X-VCC2-C44G) ## datamodel-code-generator 0.62 ### Security - datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs` (0.62.0) — [security advisory](https://github.com/advisories/GHSA-8359-H9FX-J6V9) - datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate (0.62.0) — [security advisory](https://github.com/advisories/GHSA-442Q-2J6P-642G) ## datamodel-code-generator 0.61 ### Security - datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default) (0.61.0) — [security advisory](https://github.com/advisories/GHSA-954P-556P-R752) - datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects (0.61.0) — [security advisory](https://github.com/advisories/GHSA-RFR2-MQ9M-X2QX) ## datamodel-code-generator 0.60 ### Security - `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data (0.60.2) — [security advisory](https://github.com/advisories/GHSA-8M8R-38JM-F355) - `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator (0.60.2) — [security advisory](https://github.com/advisories/GHSA-M34R-V34R-RF9Q) - `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field (0.60.2) — [security advisory](https://github.com/advisories/GHSA-386Q-5HP3-95M9) - `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field (0.60.2) — [security advisory](https://github.com/advisories/GHSA-WJV6-JCFJ-MF9R) - `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description (0.60.1) — [security advisory](https://github.com/advisories/GHSA-J884-Q54Q-MMX3)