unstale

pypi / dynaconf

dynaconf

What changed in dynaconf 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.

1 security12 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.7 on npm

dynaconf 313 changes

Security 1

  • dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

    3.2.13security advisory

Fixes and other changes 12

  • DataDict adds __deepcopy__ to match DataList.

    3.3.5release notes

  • Dotted keys no longer stop working after the first call.

    3.3.5release notes

  • Dotted keys no longer stop working after the first call.

    3.3.5release notes

  • The history_limit argument is now respected.

    3.3.5release notes

  • Key casing resolution now skips non-string keys.

    3.3.5release notes

  • A regression in override precedence is fixed, with proper dynaconf-token cleanup.

    3.3.5release notes

  • Container subclasses are converted.

    3.3.4release notes

  • A bug in the Django early validation integration code is fixed.

    3.3.4release notes

  • Sibling keys that share a dotted path leaf name are preserved.

    3.3.4release notes

  • Passing a list of values for env during Dynaconf initialization no longer raises an error.

    3.3.4release notes

  • Nested dynaconf_merge tokens are cleaned up when the parent key is new.

    3.3.4release notes

  • Fixed a regression in lazy evaluation when dynaboxify is False.

    3.3.3release notes