You can restrict form fields to only include those declared in a Pydantic model and forbid any extra field sent in the request using Pydantic's model_config = {"extra": "forbid"}:
from typing import Annotated
from fastapi import FastAPI, Form
from pydantic import BaseModel
app = FastAPI()
class FormData(BaseModel):
username: str
password: str
model_config = {"extra": "forbid"}
@app.post("/login/")
async def login(data: Annotated[FormData, Form()]):
return data
Removed ChatMessage.to_openai_format method. Use haystack.components.generators.openai_utils._convert_message_to_openai_format instead.
Removed unused debug parameter from Pipeline.run method.
Removed deprecated SentenceWindowRetrieval. Use SentenceWindowRetriever instead.
🚀 New Features
Added the unsafe argument to enable behavior that could lead to remote code execution in ConditionalRouter and OutputAdapter. By default, unsafe behavior is disabled, and users must explicitly set unsafe=True to enable it. When unsafe is enabled, types such as ChatMessage, Document, and Answer can be used as output types. We recommend enabling unsafe behavior only when the Jinja template source is trusted. For more information, see the documentation for ConditionalRouter and OutputAdapter.
⚡️ Enhancement Notes
Adapts how ChatPromptBuilder creates ChatMessages. Messages are deep copied to ensure all meta fields are copied correctly.
The parameter, min_top_k, has been added to the TopPSampler. This parameter sets the minimum number of documents to be returned when the top-p sampling algorithm selects fewer documents than desired. Documents with the next highest scores are added to meet the minimum. This is useful when guaranteeing a set number of documents to pass through while still allowing the Top-P algorithm to determine if more documents should be sent based on scores.
Introduced a utility function to deserialize a generic Document Store from the init_parameters of a serialized component.
Refactor deserialize_document_store_in_init_parameters to clarify that the function operates in place and does not return a value.
The SentenceWindowRetriever now returns context_documents as well as the context_windows for each Document in retrieved_documents . This allows you to get a list of Documents from within the context window for each retrieved document.
⚠️ Deprecation Notes
The default model for OpenAIGenerator and OpenAIChatGenerator, previously 'gpt-3.5-turbo', will be replaced by 'gpt-4o-mini'.
🐛 Bug Fixes
Fixed an issue where page breaks were not being extracted from DOCX files.
Used a forward reference for the Paragraph class in the DOCXToDocument converter to prevent import errors.
The metadata produced by DOCXToDocument component is now JSON serializable. Previously, it contained datetime objects automatically extracted from DOCX files, which are not JSON serializable. These datetime objects are now converted to strings.
Starting from haystack-ai==2.4.0, Haystack is compatible with sentence-transformers>=3.0.0; earlier versions of sentence-transformers are not supported. We have updated the test dependencies and LazyImport messages to reflect this change.
For components that support multiple Document Stores, prioritize using the specific from_dict class method for deserialization when available. Otherwise, fall back to the generic default_from_dict method. This impacts the following generic components: CacheChecker, DocumentWriter, FilterRetriever, and SentenceWindowRetriever.
v2.5.0-rc3
Release Notes
Enhancement Notes
Adapts how ChatPromptBuilder creates ChatMessages. Messages are deep copied to ensure all meta fields are copied correctly.
v2.5.0-rc2
Release Notes
Upgrade Notes
Remove ChatMessage.to_openai_format method. Use haystack.components.generators.openai_utils._convert_message_to_openai_format instead.
Remove unused debug parameter from Pipeline.run method.
Removing deprecated SentenceWindowRetrieval, replaced by SentenceWindowRetriever
New "compact" option for formatter. If set, the formatter tries to produce
a more compact output by avoiding some line breaks (issue783).
Bug Fixes
The strip comments filter was a bit greedy and removed too much
whitespace (issue772).
Note: In some cases you might want to add strip_whitespace=True where you
previously used just strip_comments=True. strip_comments did some of the
work that strip_whitespace should do.
Fix error when splitting statements that contain multiple CASE clauses
within a BEGIN block (issue784).
Fix whitespace removal with nested expressions (issue782).
Fix parsing and formatting of ORDER clauses containing NULLS FIRST or
NULLS LAST (issue532).
Bumps the all group in /wren-ai-service with 24 updates:
0.109.20.114.00.30.10.30.62.4.02.5.01.30.11.44.04.1.25.0.04.66.44.66.50.5.00.5.13.10.33.10.71.69.01.75.13.10.23.10.50.0.61.0.02.43.32.47.10.2.10.3.225.18.025.20.13.7.13.8.01.37.01.38.04.0.04.0.20.13.00.13.21.0.61.1.62.32.22.32.32.28.02.31.58.2.08.3.24.1.05.0.00.23.80.24.0Updates
fastapifrom 0.109.2 to 0.114.0Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
bde12fa🔖 Release version 0.114.074842f0📝 Update release notese68d8c6📝 Update release notes4ff22a0📝 Update docs, Form Models section title, to match config name (#12152)a11e392📝 Update release notes4633b1b✨ Add support for forbidding extra form fields with Pydantic models (#12134)1b06b53📝 Update release notesc411b81✅ Update internal tests for latest Pydantic, including CI tweaks to install t...d86f660🔖 Release version 0.113.0179f838📝 Update release notesUpdates
uvicornfrom 0.30.1 to 0.30.6Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
7dc027dVersion 0.30.6 (#2428)587a1ccfix: upgrade is not websocket and dependencies are installed, should not warn...cee31a6test(signal): add sleep to ensure shutdown completion (#2427)eba64efci: timeout for test suite runs to 30 minutes (#2426)0f513d2Remove signal testing order dependency (#2382)ff54b02Version 0.30.5 (#2409)2f25107Fix 0.30.4 issue with connection close header (#2408)8efa41cVersion 0.30.4 (#2403)b492349Addpragma: full coveragetoProcess.is_alive(#2402)ce999aaclose request connection if h11 sets client state as MUST_CLOSE (#2375)Updates
haystack-aifrom 2.4.0 to 2.5.0Release notes
Sourced from haystack-ai's releases.
... (truncated)
Commits
e6e588cbump version to v2.5.08b5ad39bump version to v2.5.0-rc393afb22feat:ChatPromptBuildercopies entireChatMessagerather than copying con...a9cd91bbump version to 2.5.0-rc211b3d69Fix error in release notes84f6e48bump version to 2.5.0-rc13e3f79bfeat: Addunsafeinit arg inConditionalRouterandOutputAdapterto ena...e614fa0refactor: Rename deserialize_document_store_in_init_parameters (#8302)7dbc51adoc: warning added for deprectaion ofgpt-3.5as default model for OpenAI g...51180e0chore: Remove emojis from release notes config (#8305)Updates
openaifrom 1.30.1 to 1.44.0Release notes
Sourced from openai's releases.
... (truncated)
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
93aa548release: 1.44.0f161000feat(vector store): improve chunking strategy type names (#1690)b2f58cbrelease: 1.43.19850c16release: 1.43.05d3111afeat(api): add file search result details to run steps (#1681)05fa732release: 1.42.0ecd6e92feat(parsing): add support for pydantic dataclasses (#1655)e8c28f2chore(ci): also run pydantic v1 tests (#1666)3d780f2release: 1.41.1fb5e53echore(client): fix parsing union responses when non-json is returned (#1665)Updates
qdrant-haystackfrom 4.1.2 to 5.0.0Commits
5f49297Fix type errors on QdrantDocumentStore (#1041)e1c0fc3fix: chat roles for model responses in chat generators (#1030)81f66c8chore(deps): bump orhun/git-cliff-action from 3 to 4 (#1028)a902ae5Update the changelog88f9506Update the changelog52da6c7fix: convertingPineconemetadata fields from float back to int (#1034)32f3ffbdocs: Update opensearch retriever docstrings (#1035)73b74a8Update the changeloge49f4e1fix: remove the use of deprecated gemini models (#1032)50352b9docs: Update Nvidia API docs (#1031)Updates
tqdmfrom 4.66.4 to 4.66.5Release notes
Sourced from tqdm's releases.
Commits
951a2baMerge pull request #1595 from hroncok/py3.13-await-aclose2fbad6aAvoid Python 3.13+ RuntimeWarning: coroutine method 'aclose' of 'acount' was ...0254345Merge pull request #1594 from mgorny/py313-docstring43230f6slight lint5ba6595cli: Fix docstring processing with Python 3.13+448946aMerge pull request #1602 from tqdm/devel46cd395add py3.12 supportd8ac656ncols: support FreeBSD4f66276bump deps & linters54796ccdocs: bump versionsUpdates
sqlparsefrom 0.5.0 to 0.5.1Changelog
Sourced from sqlparse's changelog.
Commits
2664c9eBump version.b126ba5Fix tokenization of order keywords (fixes #532).0c4902fDescend into subgroups when removing whitespace (fixes #782).a8de06eRevert "Add regression test (#780)."b253bb1Add regression test (#780).791e25dFix error when splitting statements that contain multiple CASE clauses within...073099dUpdatecompactoption to improve formatting3ea660eCode cleanup.974617dAdd shortcut for running flake8 and pytest.bf74d8bAdd compact option to force a more compact formatting (fixes #783).Updates
orjsonfrom 3.10.3 to 3.10.7Release notes
Sourced from orjson's releases.
Changelog
Sourced from orjson's changelog.
Commits
5b951e83.10.7d18f26csse2 stable implbd9dca5cargo update, misc4c05bfaUpdate benchmarks for 3.10.6c24e4ab3.10.6c369ea4str various refactor and perf9382058xxh3_64()95c86e5cargo update, build misc7b081e13.10.56b626c9dict, list full implUpdates
sf-hamiltonfrom 1.69.0 to 1.75.1Release notes
Sourced from sf-hamilton's releases.
... (truncated)
Commits
004ac5eBumps version to push out 1.75.16f2376dHandles partials in source code hash (#1116)d90212fUpdate type parameter names and protocol comments9716e95Fix formatting errors70585a0Change Parallelizable and Collect to structural subtypes01233d9Gets rid of ruff type-checking block hint for first-class imports2726190Fixes issue in future annotationsb686179Update README.md (#1112)8fbc1f8Fixes polars hist test599bc0cBumps SDK version to 0.7.0Updates
aiohttpfrom 3.10.2 to 3.10.5Release notes
Sourced from aiohttp's releases.
... (truncated)
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
ec453baRelease 3.10.5 (#8754)5953df1[PR #8749/5e30b49 backport][3.10] Bump cffi to 1.17.0 (#8752)83bd239[PR #8747/e97b17a6 backport][3.10] Make MESSAGE_TYPES_WITH_CONTENT a frozense...c7ff47b[PR #8742/b4f9cb35 backport][3.10] Fix status not being set when ClientRespon...fbfedd6[PR #8736/1b88af2 backport][3.10] Improve performance of WebSocketReader (#8743)dba2605[3.10] Bump pypa/cibuildwheel to v2.20.0 (#8740)92dc91bBump version to 3.10.5.dev08dcd3a4Release 3.10.4 (Attempt 2) (#8732)f4d4f2aRelease 3.10.4 (#8731)0f1a008[PR #8685/e7c02ca4 backport][3.10] Fix exceptions from WebSocket ping task no...Updates
ollama-haystackfrom 0.0.6 to 1.0.0Commits
Updates
langfusefrom 2.43.3 to 2.47.1Release notes
Sourced from langfuse's releases.
... (truncated)
Commits
Updates
ollamafrom 0.2.1 to 0.3.2Release notes
Sourced from ollama's releases.
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml