Pydantic Some properties do not remain private after

The Fix

pip install pydantic==1.10.14

Based on closed pydantic/pydantic issue #8523 · PR/commit linked

Jump to Verify Open PR/Commit

@@ -1184,14 +1184,14 @@ files = [
 [[package]]
 name = "pydantic-extra-types"
-version = "2.1.0"
-requires_python = ">=3.7"
+version = "2.4.0"

repro.py

pydantic version: 2.5.3
        pydantic-core version: 2.14.6
          pydantic-core build: profile=release pgo=true
                 install path: C:\code\bug_pydantic\venv\Lib\site-packages\pydantic
               python version: 3.11.4 (tags/v3.11.4:d2340ef, Jun  7 2023, 05:45:37) [MSC v.1934 64 bit (AMD64)]
                     platform: Windows-10-10.0.19045-SP0
             related packages: email-validator-2.1.0.post1 typing_extensions-4.9.0

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install pydantic==1.10.14\nWhen NOT to use: Do not apply this fix if the model's private attributes are intentionally meant to be public.\n\n

Why This Fix Works in Production

Trigger: **tl;dr** the penultimate line should not fail
Mechanism: The issue arises from the model_construct logic failing to maintain private attributes
Why the fix works: Adds more support for private attributes in the model_construct call, addressing the issue where some properties do not remain private after constructing a serialized model. (first fixed release: 1.10.14).

Production impact:

If left unfixed, this can cause silent data inconsistencies that propagate (bad cache entries, incorrect downstream decisions).

Why This Breaks in Prod

The issue arises from the model_construct logic failing to maintain private attributes
Production symptom (often without a traceback): **tl;dr** the penultimate line should not fail

Proof / Evidence

GitHub issue: #8523
Fix PR: https://github.com/pydantic/pydantic/pull/8525
First fixed release: 1.10.14
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.65

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“@danielniccoli, Thanks for reporting this bug. Looks to be an issue specifically with the model_construct logic. We'll dig into this and come up with a…”

@sydney-runkle · 2024-01-09 · source

Failure Signature (Search String)

**tl;dr** the penultimate line should not fail
hide_input_errors=True,

Copy-friendly signature

signature.txt

Failure Signature
-----------------
**tl;dr** the penultimate line should not fail
hide_input_errors=True,

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
**tl;dr** the penultimate line should not fail
hide_input_errors=True,

Minimal Reproduction

repro.py

pydantic version: 2.5.3
        pydantic-core version: 2.14.6
          pydantic-core build: profile=release pgo=true
                 install path: C:\code\bug_pydantic\venv\Lib\site-packages\pydantic
               python version: 3.11.4 (tags/v3.11.4:d2340ef, Jun  7 2023, 05:45:37) [MSC v.1934 64 bit (AMD64)]
                     platform: Windows-10-10.0.19045-SP0
             related packages: email-validator-2.1.0.post1 typing_extensions-4.9.0

Environment

Pydantic: 2

What Broke

Private properties become public after model serialization, exposing sensitive data.

Why It Broke

The issue arises from the model_construct logic failing to maintain private attributes

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install pydantic==1.10.14

When NOT to use: Do not apply this fix if the model's private attributes are intentionally meant to be public.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/pydantic/pydantic/pull/8525

First fixed release: 1.10.14

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not apply this fix if the model's private attributes are intentionally meant to be public.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.

Version Compatibility Table

Version	Status
1.10.14	Fixed

Related Issues

No related fixes found.

Cluster: pydantic:data-consistency Pydantic hub Pydantic best practices All hubs All clusters

Related clusters: Configuration error OpenAPI schema Serialization

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

Pydantic Some properties do not remain private after constructing a serialised model (Fix)