Pydantic

Last updated: Nov 4, 2026

Rationale

Fluid Attacks uses Pydantic as the standard library for data modeling, validation, and serialization in its Python components.

It is open source.
It gives data models with plain Python classes and type hints. Thus, it does not have to have a different schema language or configuration format.
It validates data at runtime. Thus, it finds incorrect inputs at the boundary of the system, before they go deeper into it.
It supports complex validation conditions, for example, field-level constraints, cross-field dependencies, and custom validator functions.
It gives first-class serialization and deserialization to and from JSON, with fine-grained control over field aliasing and output shape.
Its v2 implementation has a Rust core. Thus, it is much faster than pure Python alternatives.
It has a very large community, and it is one of the most downloaded Python packages. Thus, it is reliable and it has good support.
It integrates easily with modern Python tools.

Alternatives

dataclasses

dataclasses is a standard library module to make simple data containers with type annotations.

It is part of the Python standard library. Thus, it does not add a dependency.
It does not do runtime validation. Fields accept values of all types, and not only of the annotated type.
It does not have built-in serialization support.
By default, it does not support field constraints, custom validators, or cross-field validation.

attrs

attrs is a mature library to write concise and correct Python classes.

It is open source.
It supports validators and converters. But with attrs, developers must write more boilerplate than with Pydantic, which uses type annotations.
It does not give native JSON serialization or deserialization.
For developers who know Python type hints, its API is less intuitive than the Pydantic API.
It has a smaller community than Pydantic.

marshmallow

marshmallow is an object serialization and deserialization library for Python.

It is open source.
Its schemas are not part of the data classes. This makes the code longer and adds duplication.
It supports custom validation and field transformations, but developers must write more manual wiring than with Pydantic.
It does not use Python type hints as its primary interface. This decreases its integration with static analysis tools.
In most benchmarks, it is slower than Pydantic v2.
It has a smaller community than Pydantic.

confuse

confuse is a configuration library for Python applications. It loads and validates settings from YAML files, environment variables, and command-line arguments.

It is open source.
Its purpose is application configuration, and not general data modeling. Thus, it is a good tool to manage settings from more than one source with a specified priority sequence.
By default, it supports YAML-based configuration files. YAML is a usual format for developer-facing settings.
It gives a layered configuration system. In this system, environment variables and command-line overrides can have priority over file-based defaults.
It does not use Python type hints as its primary interface. This decreases its integration with static analysis tools.
Its validation API has more limits than the Pydantic API. It does not support complex cross-field constraints or custom validators.
It does not give serialization support.
Its community is much smaller than the Pydantic community, and it has a smaller number of users.

Usage

Fluid Attacks uses Pydantic in its Python components for these tasks:

To make typed data models for structured data, for example, configuration files, vulnerability schemas, and API payloads
To validate user and external inputs at the boundaries of the system, for example, CLI arguments and data from third-party sources
To manage typed application settings from environment variables with pydantic-settings
To serialize internal models to output formats that obey standards, for example, JSON, SARIF, and YAML