Bump pydantic-settings from 2.14.1 to 2.14.2 - #54
Conversation
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.14.1 to 2.14.2. - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.1...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine dependabot patch bump of pydantic-settings (2.14.1 → 2.14.2), lockfile-only change.
Extended reasoning...
Overview
This PR is an automated Dependabot update bumping pydantic-settings from 2.14.1 to 2.14.2 in uv.lock only. No application code, container registrations, or environment variable handling is touched.
Security risks
The version bump itself is a security fix upstream (GHSA-4xgf-cpjx-pc3j, symlink traversal in NestedSecretsSettingsSource), so this PR reduces risk rather than introducing it. No new dependency is added — pydantic-settings is already an existing, approved dependency — so no Tech Design Review is needed.
Level of scrutiny
Minimal scrutiny is appropriate: this is a lockfile-only patch version bump with no source code changes, following the standard Dependabot workflow used throughout this org.
Other factors
No outstanding review comments exist on this PR, and the diff is fully mechanical (hash/version metadata only).
1 participant
Bumps pydantic-settings from 2.14.1 to 2.14.2.
Release notes
Sourced from pydantic-settings's releases.
Commits
d703bd7Prepare release 2.14.2 (#890)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.