Skip to content

chore(deps): bump the python-minor-and-patch group with 15 updates - #635

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-204cfbbb38
Open

chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-204cfbbb38

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 27, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 15 updates:

PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4

Updates uvicorn from 0.38.0 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Version 0.52.1

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Version 0.51.0

What's Changed

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

... (truncated)

Commits

Updates fastapi from 0.136.3 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

0.141.0

Features

  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Version 1.5.1

What's Changed

Full Changelog: Kludex/starlette@1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

Full Changelog: Kludex/starlette@1.4.1...1.5.0

Version 1.4.1

What's Changed

Full Changelog: Kludex/starlette@1.4.0...1.4.1

Version 1.4.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

  • Add exclude_content_types parameter to GZipMiddleware#3418.

Changed

  • Expand default excluded content types in GZipMiddleware#3421.

Fixed

  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.

1.4.1 (August 5, 2026)

Fixed

  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.

Version 0.28.0

0.28.0 (28th November, 2024)

The 0.28 release includes a limited set of deprecations.

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

4.14.1

  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)

4.14.0

  • Added support for Python 3.15

  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

  • Added support for custom capacity limiters in async path and file I/O functions and classes

  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

  • Changed TaskGroup.start_soon() to return a TaskHandle

  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()

    This reverts an earlier change from v3.7.0 which was made in error. (#1153)

  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

    • anyio.CancelScope

... (truncated)

Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

    References: #13477

orm

  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

    References: #13439

  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

    References: #13485

  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

Updates aiosqlite from 0.20.0 to 0.22.1

Changelog

Sourced from aiosqlite's changelog.

v0.22.1

Bug fix release

NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer inherits from threading.Thread. If not using aiosqlite as a context manager, clients must await connection.close() or call connection.stop() to ensure the helper thread is completed and terminated correctly. A ResourceWarning will be emitted for any connection that is garbage collected without being closed or stopped.

  • Added synchronous stop() method to aiosqlite.Connection to enable safe cleanup and termination of the background thread without dependence on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0

Feature release

  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0

Maintenance release

  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements

... (truncated)

Commits

Updates alembic from 1.18.4 to 1.19.1

Release notes

Sourced from alembic's releases.

1.19.1

Released: August 8, 2026

bug

  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508 that failed to take into account column bound check constraints, leading to wrong autogenerate detections.

    References: #1842

1.19.0

Released: August 4, 2026

changed

  • [changed] [installation] Environmental updates:

    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature

  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK constraints, as part of the default autogenerate behavior. Detection is name-based only; a constraint whose name is unchanged is presumed equivalent regardless of its expression text, as reliably normalizing SQL expressions across backends for comparison purposes is not generally feasible. This behavior is implemented as a plugin named alembic.autogenerate.checkconstraint_byname, and may be disabled if not desired by excluding it from the EnvironmentContext.configure.autogenerate_plugins list. Pull request courtesy Francois van Kempen.

    References: #508

bug

... (truncated)

Commits

Updates greenlet from 3.5.1 to 3.5.5

Changelog

Sourced from greenlet's changelog.

3.5.5 (2026-08-10)

  • Link the C++ runtime statically into the Windows wheels again, as the Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported MSVCP140.dll, which no Windows CPython distribution ships, so importing greenlet failed on machines without the Visual C++ redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue and pull request by Daniel Sticker.

.. note:: Binary 3.15 wheels are now built with 3.15.0rc1. This should be compatible with future 3.15 releases and is believed compatible with 3.15b4 as well (but not earlier versions).

3.5.4 (2026-07-22)

  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet that was started from a non-empty C-stack-reference state is active. See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

  • Fix a potential use-after-free on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet is suspended holding a _PyCStackRef (for example, mid attribute resolution). See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

  • Fix a deadlock on free-threaded builds when a greenlet switch happened while a PyCriticalSection was held -- for example inside asyncio's Task.__step, which holds one on the running task for the duration of the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>. Thanks to ddorian and Kumar Aditya.

.. note:: Binary 3.15 wheels are now built with Python 3.15b4. These may not be compatible with earlier or later versions of 3.15. Binary 3.15 wheels of greenlet from previous releases (e.g., 3.5.3) may not be compatible with Python 3.15b4.

3.5.3 (2026-06-26)

... (truncated)

Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1

Release notes

Sourced from typer's releases.

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0

Breaking Changes

Internal

0.26.8

Fixes

@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added the dependencies Pull requests that update a dependency file label Aug 27, 2026
@dependabot
dependabotBot requested a review from defreng as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot added python Pull requests that update Python code dependencies Pull requests that update a dependency file labels Aug 27, 2026
@dependabotdependabotBot mentioned this pull request Aug 27, 2026
Closed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
chore(deps): bump the python-minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #635 · Roche/foxops · GitHub
Skip to content
chore(deps): bump the python-minor-and-patch group with 15 updates - #635
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Open
chore(deps): bump the python-minor-and-patch group with 15 updates#635
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/pip/python-minor-and-patch-204cfbbb38
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-minor-and-patch group with 15 updates:
PackageFromTo
uvicorn0.38.00.52.4
fastapi0.136.30.141.1
starlette1.3.11.6.0
httpx0.27.20.28.1
anyio4.13.04.14.2
sqlalchemy2.0.502.0.52
aiosqlite0.20.00.22.1
alembic1.18.41.19.1
greenlet3.5.13.5.5
typer0.16.00.27.1
ruamel-yaml0.17.400.19.1
pydantic-settings2.10.12.15.0
requests2.33.12.34.2
pytest-alembic0.10.70.12.1
coverage7.14.17.15.4
Updates uvicorn from 0.38.0 to 0.52.4
Release notes
Sourced from uvicorn's releases.
Version 0.52.4
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Full Changelog: Kludex/uvicorn@0.52.3...0.52.4
Version 0.52.3
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
Full Changelog: Kludex/uvicorn@0.52.2...0.52.3
Version 0.52.2
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Full Changelog: Kludex/uvicorn@0.52.1...0.52.2
Version 0.52.1
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Full Changelog: Kludex/uvicorn@0.52.0...0.52.1
Version 0.52.0
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Full Changelog: Kludex/uvicorn@0.51.0...0.52.0
Version 0.51.0
What's Changed
... (truncated)
Changelog
Sourced from uvicorn's changelog.
0.52.4 (August 18, 2026)
Fixed
  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
Removed
  • Remove colorama from the standard extra (#3027)
... (truncated)
Commits

Updates fastapi from 0.136.3 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0
Release notes
Sourced from starlette's releases.
Version 1.6.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.5.1...1.6.0
Version 1.5.1
What's Changed
Full Changelog: Kludex/starlette@1.5.0...1.5.1
Version 1.5.0
This release is all about giving GZipMiddleware some love. 🗜️
What's Changed
Full Changelog: Kludex/starlette@1.4.1...1.5.0
Version 1.4.1
What's Changed
Full Changelog: Kludex/starlette@1.4.0...1.4.1
Version 1.4.0
What's Changed
New Contributors
Full Changelog: Kludex/starlette@1.3.1...1.4.0
Changelog
Sourced from starlette's changelog.
1.6.0 (August 8, 2026)
Added
  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.
1.5.1 (August 8, 2026)
Fixed
  • Reject inverted single-byte ranges in FileResponse#3389.
  • Limit FileResponse to 100 ranges #3430.
1.5.0 (August 8, 2026)
Added
  • Add exclude_content_types parameter to GZipMiddleware#3418.
Changed
  • Expand default excluded content types in GZipMiddleware#3421.
Fixed
  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware#3420.
1.4.1 (August 5, 2026)
Fixed
  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.
1.4.0 (August 5, 2026)
Added
  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.
Changed
  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1
Release notes
Sourced from httpx's releases.
Version 0.28.1
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
Version 0.28.0
0.28.0 (28th November, 2024)
The 0.28 release includes a limited set of deprecations.
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog
Sourced from httpx's changelog.
0.28.1 (6th December, 2024)
  • Fix SSL case where verify=False together with client side certificates.
0.28.0 (28th November, 2024)
Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.
The 0.28 release includes a limited set of deprecations...
Deprecations:
We are working towards a simplified SSL configuration API.
For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...
  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.
Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.
The following changes are also included:
  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates anyio from 4.13.0 to 4.14.2
Release notes
Sourced from anyio's releases.
4.14.2
  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
4.14.1
  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
4.14.0
  • Added support for Python 3.15
  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
  • Added support for custom capacity limiters in async path and file I/O functions and classes
  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
  • Changed TaskGroup.start_soon() to return a TaskHandle
  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()
    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    • anyio.CancelScope
... (truncated)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.52
Release notes
Sourced from sqlalchemy's releases.
2.0.52
Released: August 11, 2026
platform
  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes
for full compatibility.
    References: #13477
orm
  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
    References: #13439
  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
    References: #13485
  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
... (truncated)
Commits

Updates aiosqlite from 0.20.0 to 0.22.1
Changelog
Sourced from aiosqlite's changelog.
v0.22.1
Bug fix release
NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer
inherits from threading.Thread. If not using aiosqlite as a context manager,
clients must await connection.close() or call connection.stop() to ensure
the helper thread is completed and terminated correctly. A ResourceWarning
will be emitted for any connection that is garbage collected without being
closed or stopped.
  • Added synchronous stop() method to aiosqlite.Connection to enable safe
cleanup and termination of the background thread without dependence
on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
2	Amethyst Reese

v0.22.0
Feature release
  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
1	Alec Berryman
1	Amethyst Reese
1	David Andreoletti
1	Markus Heidelberg
1	beerpsi
19	dependabot[bot]

v0.21.0
Maintenance release
  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements
... (truncated)
Commits

Updates alembic from 1.18.4 to 1.19.1
Release notes
Sourced from alembic's releases.
1.19.1
Released: August 8, 2026
bug
  • [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
    References: #1842
1.19.0
Released: August 4, 2026
changed
  • [changed] [installation] Environmental updates:
    - Trove classifiers now include Python 3.15 which is now part of CI
integration

    • Python 3.14 is also added to trove classifiers which had been previously
omitted
    • Implemented PEP 604 style unions in type annotations

feature
  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
    References: #508
bug
... (truncated)
Commits

Updates greenlet from 3.5.1 to 3.5.5
Changelog
Sourced from greenlet's changelog.
3.5.5 (2026-08-10)
  • Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd
imported MSVCP140.dll, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue
and pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
3.5.4 (2026-07-22)
  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a _PyCStackRef (for example, mid attribute
resolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.
Thanks to ddorian and Kumar Aditya.
  • Fix a deadlock on free-threaded builds when a greenlet switch happened
while a PyCriticalSection was held -- for example inside asyncio's
Task.__step, which holds one on the running task for the duration of
the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.
Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
3.5.3 (2026-06-26)
... (truncated)
Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • 384be88 Preparing release 3.5.4
  • Additional commits viewable in compare view

Updates typer from 0.16.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
0.27.0
Breaking Changes
Internal
0.26.8
Fixes
@dependabot
chore(deps): bump the python-minor-and-patch group with 15 updates
c4da3f2
Bumps the python-minor-and-patch group with 15 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.38.0` | `0.52.4` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.141.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.52` |
| [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.1` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.5` |
| [typer](https://github.com/fastapi/typer) | `0.16.0` | `0.27.1` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.15.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [pytest-alembic](https://github.com/schireson/pytest-alembic) | `0.10.7` | `0.12.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.4` |
Updates `uvicorn` from 0.38.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.38.0...0.52.4)
Updates `fastapi` from 0.136.3 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.141.1)
Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)
Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)
Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)
Updates `sqlalchemy` from 2.0.50 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)
Updates `aiosqlite` from 0.20.0 to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)
Updates `alembic` from 1.18.4 to 1.19.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)
Updates `greenlet` from 3.5.1 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.5)
Updates `typer` from 0.16.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.16.0...0.27.1)
Updates `ruamel-yaml` from 0.17.40 to 0.19.1
Updates `pydantic-settings` from 2.10.1 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.15.0)
Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)
Updates `pytest-alembic` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/schireson/pytest-alembic/releases)
- [Changelog](https://github.com/schireson/pytest-alembic/blob/main/CHANGELOG.md)
- [Commits](schireson/pytest-alembic@v0.10.7...v0.12.1)
Updates `coverage` from 7.14.1 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.4)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.52.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: starlette
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: httpx
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: anyio
dependency-version: 4.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
dependency-version: 2.0.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: aiosqlite
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: alembic
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: greenlet
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-and-patch
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: ruamel-yaml
dependency-version: 0.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: requests
dependency-version: 2.34.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: pytest-alembic
dependency-version: 0.12.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added
the 
dependencies
Pull requests that update a dependency file
label
Aug 27, 2026
@dependabot
dependabotBot
requested a review
from defreng
as a code ownerAugust 27, 2026 15:15
@dependabotdependabotBot
added

python
Pull requests that update Python code
dependencies
Pull requests that update a dependency file
labels
Aug 27, 2026
@dependabotdependabotBot
mentioned this pull request
Aug 27, 2026
 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@defrengdefrengAwaiting requested review from defrengdefreng is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants