chore(deps): bump the productiondependencies group across 5 directories with 6 updates

[dependabot]

Updates the requirements on langchain-core, pwdlib, sentry-sdk, sqlalchemy, alembic and uvicorn to permit the latest version.
Updates langchain-core to 1.5.5

Release notes

Sourced from langchain-core's releases.

langchain-core==1.5.5

Changes since langchain-core==1.5.4

release(core): 1.5.5 (#39655) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (#39367) fix(core): respect pydantic aliases when validating tool inputs (#39572) fix(core): issues in merging chunks (#39535) fix(core): handle v1 base model validation in async path (#39576) fix(core): handle tool descriptions for infer_schema=False (#39573) fix(core): clear usage metadata callback on exceptions in context manager (#39616) fix(core): handle falsy LLM and chat model caches (#39283) chore(core): add httpx as an explicit dep (#39612) fix(core): preserve non-str/non-dict items in DictPromptTemplate list values (#39588) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (#39142) fix(core): guard malformed Anthropic content blocks (#38670)

Commits

• c197a7b chore(model-profiles): refresh model profile data (#39646)
• 555702e release(core): 1.5.5 (#39655)
• e32fa9a chore(infra): add fields for social handles in issue templates (#39654)
• d6cd98a release(openai): 1.5.1 (#39653)
• 7b954aa fix(openai): preserve streamed encrypted reasoning (#39635)
• 0082ce0 chore(infra): support langsmith gateway in CI (#39651)
• f9ee55d fix(core): make abatch_iterate consistent with batch_iterate for None and zer...
• 162f9d9 chore(model-profiles): refresh model profile data (#39625)
• a2f02ab chore(langchain): update docs on error handling for json schema (#39632)
• cde5293 fix(core): respect pydantic aliases when validating tool inputs (#39572)
• Additional commits viewable in compare view

Updates pwdlib to 0.3.1

Release notes

Sourced from pwdlib's releases.

v0.3.1

Bump version 0.3.0 → 0.3.1

Improvements

• Remove top-pin of dependencies. Thanks @​hynek 🎉
• PasswordHash.recommended() constructor now returns typing.Self. Thanks @​waketzheng 🎉

Commits

• bb51a24 Bump version 0.3.0 → 0.3.1
• 1c3f93a Fix dependency versions
• 7a6855d docs: add hynek as a contributor for code (#49)
• 7a070b5 docs: add waketzheng as a contributor for code (#48)
• c22deeb Use Self instead of class name for type hints
• 3493637 Remove argon2-cffi top-pin (#47)
• e746495 Bump actions/setup-python from 6 to 7 (#46)
• dcc5aa3 Bump actions/checkout from 6 to 7 (#45)
• 8051873 Bump actions/deploy-pages from 4 to 5 (#38)
• 775bc5d Bump extractions/setup-just from 3 to 4 (#40)
• Additional commits viewable in compare view

Updates sentry-sdk to 2.68.0

Release notes

Sourced from sentry-sdk's releases.

2.68.0

Important

• We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

  Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

  Action Needed

  If you had enable_logs set to True:

  • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
  • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:

  importsentry_sdkfromsentry_sdk.integrations.loggingimportLoggingIntegrationfromsentry_sdk.integrations.loguruimportLoguruIntegrationsentry_sdk.init(
  integrations=[
  LoggingIntegration(capture_sentry_logs=True),
  LoguruIntegration(capture_sentry_logs=True),
  ],
  )

  If you had enable_logs set to False:

  • If you were using it to gate usages of the sentry_sdk.logger.X API, you'll need to remove the calls entirely or define a before_send_log callback to filter out unwanted logs.

  If you has enable_metrics set to False:

  • Any metrics emitted using the metrics API will be emitted. You'll need to drop them in a before_send_metric or remove the calls to the API.

  Why We're Doing This

  We recognize this is a disruptive change for some folks and want to make it clear this is a one-off. We're removing the options because they were an unnecessary hurdle that one had to jump through to be able to use logs and metrics, and it was confusing why the logging API would not just work on its own. On the other hand, we wanted to give you more fine-grained control over automatic collection.

New Features ✨

Other

• Set the segment source on the scope for NoOpStreamedSpan by @​alexander-alderman-webb in #7163
• Remove early return for NoOpStreamedSpan in set_transaction_name() by @​alexander-alderman-webb in #7164
• Set the segment name on the scope with NoOpStreamedSpan by @​alexander-alderman-webb in #7162

Bug Fixes 🐛

• (batcher) Add global flush trigger based on the span number by @​alexander-alderman-webb in #7150

Internal Changes 🔧

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.68.0

Important

• We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

  Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

  Action Needed

  If you had enable_logs set to True:

  • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
  • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:

  importsentry_sdkfromsentry_sdk.integrations.loggingimportLoggingIntegrationfromsentry_sdk.integrations.loguruimportLoguruIntegrationsentry_sdk.init(
  integrations=[
  LoggingIntegration(capture_sentry_logs=True),
  LoguruIntegration(capture_sentry_logs=True),
  ],
  )

  If you had enable_logs set to False:

  • If you were using it to gate usages of the sentry_sdk.logger.X API, you'll need to remove the calls entirely or define a before_send_log callback to filter out unwanted logs.

  If you has enable_metrics set to False:

  • Any metrics emitted using the metrics API will be emitted. You'll need to drop them in a before_send_metric or remove the calls to the API.

  Why We're Doing This

  We recognize this is a disruptive change for some folks and want to make it clear this is a one-off. We're removing the options because they were an unnecessary hurdle that one had to jump through to be able to use logs and metrics, and it was confusing why the logging API would not just work on its own. On the other hand, we wanted to give you more fine-grained control over automatic collection.

New Features ✨

Other

• Set the segment source on the scope for NoOpStreamedSpan by @​alexander-alderman-webb in #7163
• Remove early return for NoOpStreamedSpan in set_transaction_name() by @​alexander-alderman-webb in #7164
• Set the segment name on the scope with NoOpStreamedSpan by @​alexander-alderman-webb in #7162

Bug Fixes 🐛

• (batcher) Add global flush trigger based on the span number by @​alexander-alderman-webb in #7150

... (truncated)

Commits

• c819e66 Update README
• 90446df Update CHANGELOG.md
• cb2499c release: 2.68.0
• 1c3b50d ref: Flush trace buckets when segment spans finish (#7170)
• c200bdf test(django): Remove dead code and stale markers from the Django test suite (...
• 4e4ea83 ref(boto3): Move crumbs to integration (#7165)
• 0f0cd1f ref(stdlib): Move crumbs to integration (#7161)
• 2fef9bc chore: Make enable_logs, enable_metrics no-op (#7177)
• 8177739 ref(httpx,httpx2): Move crumbs to integrations (#7149)
• e4d7398 ref(pyreqwest): Move crumbs to integration (#7148)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates alembic to 1.19.1

Release notes

Sourced from alembic's releases.

1.19.1

Released: August 8, 2026

bug

• [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508 that failed to take into account column bound check constraints, leading to wrong autogenerate detections.

  References: #1842

Commits

• See full diff in compare view

Updates uvicorn to 0.52.3

Release notes

Sourced from uvicorn's releases.

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Changelog

Sourced from uvicorn's changelog.

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

... (truncated)

Commits

• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• 2a5ff18 Version 0.52.2 (#3066)
• 1920297 Update zttp to 0.0.22 (#3063)
• 5c560da chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3061)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions