# What changed in dynaconf

> 13 changes in dynaconf 3 from its official release notes, upgrade guides and advisories: 1 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/dynaconf/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## dynaconf 3

### Security

- dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver (3.2.13) — [security advisory](https://github.com/advisories/GHSA-PXRR-HQ57-Q35P)

### Fixes and other changes

- DataDict adds __deepcopy__ to match DataList. (3.3.5) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.5)
- Dotted keys no longer stop working after the first call. (3.3.5) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.5)
- Dotted keys no longer stop working after the first call. (3.3.5) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.5)
- The history_limit argument is now respected. (3.3.5) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.5)
- Key casing resolution now skips non-string keys. (3.3.5) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.5)
- A regression in override precedence is fixed, with proper dynaconf-token cleanup. (3.3.5) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.5)
- Container subclasses are converted. (3.3.4) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.4)
- A bug in the Django early validation integration code is fixed. (3.3.4) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.4)
- Sibling keys that share a dotted path leaf name are preserved. (3.3.4) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.4)
- Passing a list of values for env during Dynaconf initialization no longer raises an error. (3.3.4) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.4)
- Nested dynaconf_merge tokens are cleaned up when the parent key is new. (3.3.4) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.4)
- Fixed a regression in lazy evaluation when dynaboxify is False. (3.3.3) — [release notes](https://github.com/dynaconf/dynaconf/releases/tag/3.3.3)