prefect-client 3.7.5.dev1__tar.gz → 3.7.5.dev3__tar.gz

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prefect-client
-Version: 3.7.5.dev1
+Version: 3.7.5.dev3
 Summary: Workflow orchestration and management.
 Project-URL: Changelog, https://github.com/PrefectHQ/prefect/releases
 Project-URL: Documentation, https://docs.prefect.io

prefect_client-3.7.5.dev3/src/prefect/_build_info.py

@@ -0,0 +1,5 @@
+# Generated by versioningit
+__version__ = "3.7.5.dev3"
+__build_date__ = "2026-06-13 09:10:40.924494+00:00"
+__git_commit__ = "7d7cd722bc2d696ba5b2cb79135f69e8b67811a8"
+__dirty__ = False

prefect_client-3.7.5.dev3/src/prefect/_internal/schemas/_registry.py

@@ -0,0 +1,13 @@
+from referencing import Registry
+
+
+def non_fetching_registry() -> Registry:
+    """An empty `referencing.Registry` that disables remote `$ref` fetching.
+
+    Passing an explicit registry to jsonschema suppresses its default behavior of
+    fetching `$ref` URLs over the network while validating an instance. With an
+    empty registry, external references raise `referencing.exceptions.Unresolvable`
+    without any network request, while in-document references (`#/$defs/...`) still
+    resolve normally.
+    """
+    return Registry()

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/_internal/schemas/validators.py

@@ -21,7 +21,9 @@ from uuid import UUID
 from zoneinfo import ZoneInfo
 
 import jsonschema
+import referencing.exceptions
 
+from prefect._internal.schemas._registry import non_fetching_registry
 from prefect.types._datetime import DateTime, create_datetime_instance, get_timezones
 from prefect.utilities.collections import isiterable
 from prefect.utilities.filesystem import relative_path_to_current_platform
@@ -65,7 +67,9 @@ def validate_values_conform_to_schema(
 
     try:
         if schema is not None and values is not None:
-            jsonschema.validate(values, schema)
+            jsonschema.validate(values, schema, registry=non_fetching_registry())
+    except referencing.exceptions.Unresolvable as exc:
+        raise ValueError(f"Validation failed. Failure reason: {exc}") from exc
     except jsonschema.ValidationError as exc:
         if exc.json_path == "$":
             error_message = "Validation failed."

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/client/schemas/actions.py

@@ -6,6 +6,7 @@ from typing import Annotated, Any, Callable, Optional, TypeVar, Union
 from uuid import UUID, uuid4
 
 import jsonschema
+import referencing.exceptions
 from pydantic import (
     AfterValidator,
     BaseModel,
@@ -18,6 +19,7 @@ from pydantic import (
 import prefect.client.schemas.objects as objects
 from prefect._internal.result_records import ResultRecordMetadata
 from prefect._internal.schema import ParameterSchema
+from prefect._internal.schemas._registry import non_fetching_registry
 from prefect._internal.schemas.bases import ActionBaseModel
 from prefect._internal.schemas.validators import (
     convert_to_strings,
@@ -324,7 +326,14 @@ class DeploymentCreate(ActionBaseModel):
                     if "default" in v and k in required:
                         required.remove(k)
 
-            jsonschema.validate(self.job_variables, variables_schema)
+            try:
+                jsonschema.validate(
+                    self.job_variables,
+                    variables_schema,
+                    registry=non_fetching_registry(),
+                )
+            except referencing.exceptions.Unresolvable as exc:
+                raise jsonschema.ValidationError(str(exc)) from exc
 
 
 class DeploymentUpdate(ActionBaseModel):
@@ -403,7 +412,14 @@ class DeploymentUpdate(ActionBaseModel):
                         required.remove(k)
 
         if variables_schema is not None:
-            jsonschema.validate(self.job_variables, variables_schema)
+            try:
+                jsonschema.validate(
+                    self.job_variables,
+                    variables_schema,
+                    registry=non_fetching_registry(),
+                )
+            except referencing.exceptions.Unresolvable as exc:
+                raise jsonschema.ValidationError(str(exc)) from exc
 
 
 class DeploymentBranch(ActionBaseModel):

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/flows.py

@@ -706,7 +706,11 @@ class Flow(Generic[P, R]):
                 from fastapi.encoders import jsonable_encoder
 
                 serialized_parameters[key] = jsonable_encoder(value)
-            except (TypeError, ValueError):
+            except (TypeError, ValueError, RecursionError):
+                # `jsonable_encoder` recurses into unknown objects with no cycle
+                # or depth limit, so a deeply-nested or self-referential value
+                # raises `RecursionError`. Treat it like any other unserializable
+                # value and fall back to the placeholder below.
                 logger.debug(
                     f"Parameter {key!r} for flow {self.name!r} is unserializable. "
                     f"Type {type(value).__name__!r} and will not be stored "

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/server/api/deployments.py

@@ -311,7 +311,11 @@ async def update_deployment(
             )
             try:
                 deployment.check_valid_configuration(work_pool.base_job_template)
-            except (MissingVariableError, jsonschema.exceptions.ValidationError) as exc:
+            except (
+                MissingVariableError,
+                jsonschema.exceptions.ValidationError,
+                ValidationError,
+            ) as exc:
                 raise HTTPException(
                     status_code=status.HTTP_409_CONFLICT,
                     detail=f"Error creating deployment: {exc!r}",

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/server/api/ui/schemas.py

@@ -10,6 +10,7 @@ from prefect.server.utilities.server import APIRouter
 from prefect.utilities.schema_tools.hydration import HydrationContext, hydrate
 from prefect.utilities.schema_tools.validation import (
     CircularSchemaRefError,
+    ValidationError,
     build_error_obj,
     is_valid_schema,
     preprocess_schema,
@@ -60,6 +61,11 @@ async def validate_obj(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
             detail="Invalid schema: Unable to validate schema with circular references.",
         )
+    except ValidationError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"Invalid schema: {exc}",
+        )
     error_obj = build_error_obj(errors)
 
     return error_obj

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/utilities/dockerutils.py

@@ -140,6 +140,7 @@ _TRANSIENT_ERROR_PATTERNS = (
     "i/o timeout",
     "TLS handshake timeout",
     "connection reset",
+    "context deadline exceeded",
 )
 
 logger: logging.Logger = logging.getLogger(__name__)

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/utilities/schema_tools/AGENTS.md

@@ -47,6 +47,7 @@ Handlers return `Placeholder` subclasses (e.g. `RemoveValue`, `InvalidJSON`, `In
 
 - **Don't use `jinja` kind and expect a typed value** — it always returns a string. Use `json` + `jinja` + `| tojson` for type preservation.
 - **Don't add server imports to this module** — it's used client-side too. `HydrationContext.build()` is an explicit exception (async, server-only); the rest of `hydration.py` must remain importable without a running server.
+- **Don't call `jsonschema.validate()` without `registry=non_fetching_registry()`.** The default behavior fetches remote `$ref` URLs over the network (SSRF). Always pass `registry=non_fetching_registry()` from `prefect._internal.schemas._registry`; external refs raise `referencing.exceptions.Unresolvable` without any network request, while in-document `#/$defs/…` refs still resolve normally.
 
 ## Pitfalls
 

{prefect_client-3.7.5.dev1 → prefect_client-3.7.5.dev3}/src/prefect/utilities/schema_tools/validation.py

@@ -4,10 +4,12 @@ from copy import deepcopy
 from typing import TYPE_CHECKING, Any, cast
 
 import jsonschema
+import referencing.exceptions
 from jsonschema.exceptions import ValidationError as JSONSchemaValidationError
 from jsonschema.validators import Draft202012Validator, create
 from referencing.jsonschema import ObjectSchema, Schema
 
+from prefect._internal.schemas._registry import non_fetching_registry
 from prefect.utilities.collections import remove_nested_keys
 from prefect.utilities.schema_tools.hydration import HydrationError, Placeholder
 
@@ -87,9 +89,13 @@ def validate(
 
     if raise_on_error:
         try:
-            jsonschema.validate(obj, schema, _VALIDATOR)
+            jsonschema.validate(
+                obj, schema, _VALIDATOR, registry=non_fetching_registry()
+            )
         except RecursionError:
             raise CircularSchemaRefError
+        except referencing.exceptions.Unresolvable as exc:
+            raise ValidationError(f"Validation failed. Failure reason: {exc}") from exc
         except JSONSchemaValidationError as exc:
             if exc.json_path == "$":
                 error_message = "Validation failed."
@@ -102,10 +108,16 @@ def validate(
         return []
     else:
         try:
-            validator = _VALIDATOR(schema, format_checker=_VALIDATOR.FORMAT_CHECKER)
+            validator = _VALIDATOR(
+                schema,
+                format_checker=_VALIDATOR.FORMAT_CHECKER,
+                registry=non_fetching_registry(),
+            )
             errors = list(validator.iter_errors(obj))  # type: ignore
         except RecursionError:
             raise CircularSchemaRefError
+        except referencing.exceptions.Unresolvable as exc:
+            raise ValidationError(f"Validation failed. Failure reason: {exc}") from exc
         return errors
 
 

prefect_client-3.7.5.dev1/src/prefect/_build_info.py

@@ -1,5 +0,0 @@
-# Generated by versioningit
-__version__ = "3.7.5.dev1"
-__build_date__ = "2026-06-06 08:58:56.783483+00:00"
-__git_commit__ = "db66b14dbaea18e726fc4ea0100fd194383c6c59"
-__dirty__ = False