Pydantic 2.14

Apply these rules to Pydantic 2.14 validation and serialization with the included Python baseline. This prompt covers Pydantic models and type adapters. Pydantic Settings and Pydantic AI are separate packages; settings-source precedence, dotenv handling, and settings secrets need their own review and are not covered here.

Input contracts

• Validate external values with BaseModel.model_validate(), model_validate_json(), or TypeAdapter.validate_python() / validate_json() before using them. JSON Schema generation and Python annotations alone do not validate incoming data.
• Define separate input and response models. Keep server-owned roles, tenant IDs, ownership, and approval state out of writable input fields; authorize the validated identifiers before acting on them. extra='forbid' cannot protect privileged fields you explicitly declare.
• Set ConfigDict(extra='forbid') on boundary models and their nested model types; the default ignores unknown fields. Review per-call extra overrides. If extension fields are required, type and constrain __pydantic_extra__ and keep them out of privileged updates.
• Configure TypedDict and stdlib dataclass inputs with with_config or __pydantic_config__, and Pydantic dataclasses with config=; they also ignore unknown keys by default.
• On 2.14.0, which predates the 2.14.1 fix, a TypedDict does not take closed or extra_items from a base class, so declare them on each validated class.
• Use ConfigDict(strict=True), Field(strict=True), or strict types when coercion could change a security decision. Review