chore(deps): bump the backend-dependencies group across 1 directory with 20 updates by dependabot[bot] · Pull Request #2459 · utksh1/SecuScan

dependabot · 2026-08-04T15:06:52Z

Updates the requirements on fastapi, cryptography, uvicorn, pydantic, pydantic-settings, psycopg, redis, sse-starlette, python-multipart, aiosqlite, python-whois, openai, pytest, pytest-cov, ruff, pytest-asyncio, anyio, pip-audit, pyyaml and trio to permit the latest version.
Updates fastapi to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @tiangolo.

Docs

📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @tiangolo.

Commits

95f8322 🔖 Release version 0.141.1 (#16106)
f137944 📝 Update release notes
d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
1d211b9 📝 Update release notes
8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
c7e7b65 🔖 Release version 0.141.0 (#16103)
6bceb84 📝 Update release notes
5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
628663f 🔖 Release version 0.140.13 (#16096)
0b54fd0 📝 Update release notes
Additional commits viewable in compare view

Updates cryptography to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates uvicorn to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)

Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)

Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)

Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)

Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

... (truncated)

Commits

ee8e45c Version 0.52.1 (#3056)
b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
e148451 Handle connection loss during WebSocket write backpressure (#3050)
e16a69b Add missing write flow control to websockets-sansio (#3048)
ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
8f1b884 Version 0.52.0 (#3044)
f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
Additional commits viewable in compare view

Updates pydantic to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Bump libc from 0.2.155 to 0.2.185 by @Viicos in #13109

Adapt pydantic-core linker flags on macOS by @washingtoneg and @Viicos in #13147

Fixes

Preserve RootModel core metadata by @Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Bump libc from 0.2.155 to 0.2.185 by @Viicos in #13109

Adapt pydantic-core linker flags on macOS by @washingtoneg and @Viicos in #13147

Fixes

Preserve RootModel core metadata by @Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

Handle AttributeError subclasses with from_attributes by @Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

Fix ValidationInfo.field_name missing with model_validate_json() by @Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

Fix ValidationInfo.data missing with model_validate_json() by @davidhewitt in #13079

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits

cf67d4b Fix linting
f0d8a21 Prepare release v2.13.4
5e3fe1d Check for pydantic tag pattern in CI
7f9edcc Document tagging conventions
b46a0c9 Adapt pydantic-core linker flags on macOS
50629c8 Update to PyPy 7.3.22
8522ebb Preserve RootModel core metadata
a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
909259a Remove Logfire example in documentation
2c4174c Bump libc from 0.2.155 to 0.2.185
Additional commits viewable in compare view

Updates pydantic-settings to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.

Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.

Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.

PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.

toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.

Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.

GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.

Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.

Fix AliasPath on nested model fields not JSON-decoding env values (#898).

Fix case-insensitive matching for optional nested models (#905).

Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.

Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).

Fix Secret subclasses crashing when loaded from the environment (#920).

Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).

An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).

NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).

GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.

AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).

Recommend an async settings loading pattern (#908).

Clarify behavior when an unprefixed value is present in a dotenv file (#895).

Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

Update documentation link for Pydantic settings by @hramezani in pydantic/pydantic-settings#863

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#865

docs: clarify environment variable helper descriptions by @vip892766gma in pydantic/pydantic-settings#867

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#870

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#875

Skip list_secrets call when case_sensitive=True by @ecerulm in pydantic/pydantic-settings#862

GoogleSecretManagerSettingsSource: read project_id from previous sources by @ecerulm in pydantic/pydantic-settings#878

... (truncated)

Commits

f725ca1 Prepare release 2.15.0 (#930)
28f35c2 Bump the python-packages group with 4 updates (#929)
9056db0 test: move function-local imports to the top of test modules (#927)
f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
798dcea Bump the python-packages group with 4 updates (#924)
a190041 Bump the github-actions group with 4 updates (#925)
5d93332 Bump the python-packages group with 4 updates (#921)
d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
2256a4e Bump the python-packages group with 3 updates (#915)
Additional commits viewable in compare view

Updates psycopg to 3.3.4

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.5 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).

Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).

Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).

Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Current release

Psycopg 3.3.4 ^^^^^^^^^^^^^

Fix possible spurious connection timeout in systems with very long uptimes in C extension (:ticket:[#1280](https://github.com/psycopg/psycopg/issues/1280)).

Fix client-side adaptation of enums whose name require quotes (:ticket:[#1298](https://github.com/psycopg/psycopg/issues/1298)).

Consistently populate ~Cursor.statusmessage after ~Cursor.executemany() (:ticket:[#1302](https://github.com/psycopg/psycopg/issues/1302)).

Psycopg 3.3.3 ^^^^^^^^^^^^^

Retain Error.pgconn when raising a single exception for multiple connection attempt errors (:ticket:[#1246](https://github.com/psycopg/psycopg/issues/1246)).

Return a proper error when server sends ErrorResponse for a Sync after a Parse (:ticket:[#1260](https://github.com/psycopg/psycopg/issues/1260)).

Psycopg 3.3.2

... (truncated)

Commits

83f1103 chore: bump psycopg_pool package version to 3.3.1
1828770 chore: bump psycopg package version to 3.3.4
8be14bb Merge pull request #1301 from oliverhaas/fix/sync-pool-open-race
aee0bf2 fix(pool): fix race in the construction of the sync ConnectionPool lock
bc4d303 chore(deps): bump the actions group across 1 directory with 4 updates
785379f fix: retain statusmessage after executemany with returning=False
8882a73 perf: do less if X in Y: return Y[X] for cache-like patterns
2f78539 Merge pull request #1299 from dvarrazzo/fix-camel-enum
37ef1dc test: skip test on crdb depending on precise regtype behaviour
7f2f1d1 fix: fix client-side representation of enums requiring quotes
Additional commits viewable in compare view

Updates redis to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).

Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).

Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).

Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).

Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).

Sentinel — replica sentinel aliases (#4127).

🚀 New Features

Add replica sentinel aliases (#4127)

Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)

feat: add TS.READ command support to the timeseries module (#4170)

feat: add SDIFFCARD and SUNIONCARD command support (#4171)

feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)

feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)

feat: add async maintenance-notifications support for standalone and cluster clients (#4177)

feat: add COLLECT reducer support to search aggregations (#4179)

feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)

feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)

feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)

Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits

e013126 Testing with 8.10 GA (#4227)
059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
14714a0 fix: Fixed double decoding issue with unquote() (#4222)
227280a Update lib version to 8.1.0
88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
599fd75 feat: add FT.ALIASLIST support (#4198)
71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
Additional commits viewable in compare view

Updates sse-starlette to 3.4.8

Release notes

Sourced from sse-starlette's releases.

v3.4.8

Full Changelog: sysid/sse-starlette@v3.4.7...v3.4.8

Commits

a815cd3 Bump version to 3.4.8
79d7745 Bump version to 3.4.7
5ee7ba5 Merge pull request #205 from sysid/dependabot/uv/cryptography-50.0.0
ae7c799 Merge pull request #203 from sysid/dependabot/uv/pyasn1-0.6.4
2cded15 chore(deps): bump cryptography from 48.0.1 to 50.0.0
1c41d17 chore(deps): bump pyasn1 from 0.6.3 to 0.6.4
c956ba3 Bump version to 3.4.6
2dd7924 Merge pull request #202 from mahenzon/fix/deterministic-ping-tests
6ffcd0d update test_sse: make ping tests independent of wall-clock timing
d630709 Merge pull request #200 from sysid/dependabot/github_actions/actions/checkout-7
Additional commits viewable in compare view

Updates python-multipart to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

Replace per-byte partial-boundary scan with rfind lookbehind by @Kludex in Kludex/python-multipart#300

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

Speed up partial-boundary scanning for CR/LF-dense part data #300.

0.0.31 (2026-06-04)

Speed up multipart header parsing and callback dispatch #295.

Bound header field name size before validating #296.

Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.

Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.

0.0.29 (2026-05-17)

Handle malformed RFC 2231 continuations in parse_options_header #270.

0.0.28 (2026-05-10)

Speed up partial-boundary tail scan via bytes.find #281.

Cap multipart boundary length at 256 bytes #282.

0.0.27 (2026-04-27)

Add multipart header limits #267.

Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

Skip preamble before the first multipart boundary more efficiently #262.

Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

Add MIME content type info to File #143.

Handle CTE values case-insensitively #258.

Remove custom FormParser classes #257.

Add UPLOAD_DELETE_TMP to FormParser config #254.

Emit field_end for trailing bare field names on finalize #230.

Handle multipart headers case-insensitively #252.

Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

... (truncated)

Commits

238ead6 Version 0.0.32 (#302)
8672979 Replace per-byte partial-boundary scan with rfind lookbehind (#300)
8190779 Bump the python-packages group with 7 updates (#301)
0d3c086 Use uv package ecosystem for Dependabot (#299)
4cffc68 Version 0.0.31 (#298)
c814948 Reject negative Content-Length in parse_form (#297)
6b837d4 Bound header field name size before validating (#296)
e0c4f9d Bump the github-actions group with 3 updates (#294)
b8a01bb Bump the python-packages group with 3 updates (#293)
6732164 Speed up multipart header parsing and callback dispatch (#295)
Additional commits viewable in compare view

Updates aiosqlite to 0.22.1

Changelog

Sourced from aiosqlite's changelog.

v0.22.1

Bug fix release

NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer inherits from threading.Thread. If not using aiosqlite as a context manager, clients must await connection.close() or call connection.stop() to ensure the helper thread is completed and terminated correctly. A ResourceWarning will be emitted for any connection that is garbage collected without being closed or stopped.

Added synchronous stop() method to aiosqlite.Connection to enable safe cleanup and termination of the background thread without dependence on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
     2	Amethyst Reese
v0.22.0

Feature release

Support set_authorizer query access controls (#349)

Wait for transaction queue to complete when closing connection (#305)

Emit warning when connection goes out of scope without being closed (#355)

Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
     1	Alec Berryman
     1	Amethyst Reese
     1	David Andreoletti
     1	Markus Heidelberg
     1	beerpsi
    19	dependabot[bot]
v0.21.0

Maintenance release

Fix: close connection correctly when BaseException raised in connection (#317)

Metadata improvements

... (truncated)

Commits

9b127ce Version bump v0.22.1
5c3f61c Improve stop semantics for connections (#370)
a869d73 Version bump v0.22.0
1cd60ad Emit warning if connection is deleted before it is closed (#355)
611d7b4 Add set_authorizer support for fine-grained access control (#349)
81d00c8 Bump actions/setup-python from 5 to 6 (#357)
7a26722 Bump coverage[toml] from 7.8.0 to 7.10.7 (#358)
4457540 Bump flake8 from 7.2.0 to 7.3.0 (#346)
b650dad Bump actions/checkout from 5 to 6 (#366)
065ffdd Bump mypy from 1.15.0 to 1.19.0 (#367)
Additional commits viewable in compare view

Updates python-whois to 0.9.6

Commits

See full diff in compare view

Updates openai to 2.53.0

Release notes

Sourced from openai's releases.

v2.53.0

2.53.0 (2026-08-03)

Features

api: Add gpt-5.5 and tool name/namespace to Responses types (#3569) (dd1202d)

Bug Fixes

ci: avoid NumPy source builds and duplicate HTTPX coverage (#3573) (b58332f)

Changelog

Sourced from openai's changelog.

2.53.0 (2026-08-03)

Features

api: Add gpt-5.5 and tool name/namespace to Responses types (#3569) (dd1202d)

Bug Fixes

ci: avoid NumPy source builds and duplicate HTTPX coverage (#3573) (b58332f)

2.52.1 (2026-07-31)

Full Changelog: v2.52.0...v2.52.1

Chores

ci: pin setup-uv v5 to its underlying commit (#3560) (cbdc98b)

2.52.0 (2026-07-31)

Full Changelog: v2.51.0...v2.52.0

Features

api: content provenance checks (

utksh1

Dependabot backend dependency updates. Approved.

…ith 20 updates Updates the requirements on [fastapi](https://github.com/fastapi/fastapi), [cryptography](https://github.com/pyca/cryptography), [uvicorn](https://github.com/Kludex/uvicorn), [pydantic](https://github.com/pydantic/pydantic), [pydantic-settings](https://github.com/pydantic/pydantic-settings), [psycopg](https://github.com/psycopg/psycopg), [redis](https://github.com/redis/redis-py), [sse-starlette](https://github.com/sysid/sse-starlette), [python-multipart](https://github.com/Kludex/python-multipart), [aiosqlite](https://github.com/omnilib/aiosqlite), [python-whois](https://github.com/richardpenman/whois), [openai](https://github.com/openai/openai-python), [pytest](https://github.com/pytest-dev/pytest), [pytest-cov](https://github.com/pytest-dev/pytest-cov), [ruff](https://github.com/astral-sh/ruff), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio), [anyio](https://github.com/agronholm/anyio), [pip-audit](https://github.com/pypa/pip-audit), [pyyaml](https://github.com/yaml/pyyaml) and [trio](https://github.com/python-trio/trio) to permit the latest version. Updates `fastapi` to 0.141.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.115.0...0.141.1) Updates `cryptography` to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@42.0.0...50.0.0) Updates `uvicorn` to 0.52.1 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.30.6...0.52.1) Updates `pydantic` to 2.13.4 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.8.2...v2.13.4) Updates `pydantic-settings` to 2.15.0 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.6.0...v2.15.0) Updates `psycopg` to 3.3.4 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.3.0...3.3.4) Updates `redis` to 8.1.0 - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](redis/redis-py@v5.2.1...v8.1.0) Updates `sse-starlette` to 3.4.8 - [Release notes](https://github.com/sysid/sse-starlette/releases) - [Commits](sysid/sse-starlette@v2.1.0...v3.4.8) Updates `python-multipart` to 0.0.32 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.9...0.0.32) Updates `aiosqlite` to 0.22.1 - [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md) - [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1) Updates `python-whois` to 0.9.6 - [Commits](https://github.com/richardpenman/whois/commits) Updates `openai` to 2.53.0 - [Release notes](https://github.com/openai/openai-python/releases) - [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md) - [Commits](openai/openai-python@v1.0.0...v2.53.0) Updates `pytest` to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.5...9.1.1) Updates `pytest-cov` to 7.1.0 - [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst) - [Commits](pytest-dev/pytest-cov@v6.0.0...v7.1.0) Updates `ruff` to 0.16.2 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.12...0.16.2) Updates `pytest-asyncio` to 1.4.0 - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](pytest-dev/pytest-asyncio@v0.24.0...v1.4.0) Updates `anyio` to 4.14.2 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.0.0...4.14.2) Updates `pip-audit` to 2.10.1 - [Release notes](https://github.com/pypa/pip-audit/releases) - [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md) - [Commits](pypa/pip-audit@v2.6.0...v2.10.1) Updates `pyyaml` to 6.0.3 - [Release notes](https://github.com/yaml/pyyaml/releases) - [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES) - [Commits](yaml/pyyaml@6.0...6.0.3) Updates `trio` to 0.33.0 - [Release notes](https://github.com/python-trio/trio/releases) - [Commits](python-trio/trio@v0.27.0...v0.33.0) --- updated-dependencies: - dependency-name: aiosqlite dependency-version: 0.22.1 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: anyio dependency-version: 4.14.2 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: fastapi dependency-version: 0.141.1 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: openai dependency-version: 2.52.0 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: pip-audit dependency-version: 2.10.1 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: psycopg dependency-version: 3.3.4 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: pydantic dependency-version: 2.13.4 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: pytest-asyncio dependency-version: 1.4.0 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: pytest-cov dependency-version: 7.1.0 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: python-multipart dependency-version: 0.0.32 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: python-whois dependency-version: 0.9.6 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: pyyaml dependency-version: 6.0.3 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: redis dependency-version: 8.1.0 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: ruff dependency-version: 0.16.1 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: sse-starlette dependency-version: 3.4.6 dependency-type: direct:production dependency-group: backend-dependencies - dependency-name: trio dependency-version: 0.33.0 dependency-type: direct:development dependency-group: backend-dependencies - dependency-name: uvicorn dependency-version: 0.52.0 dependency-type: direct:production dependency-group: backend-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 4, 2026

utksh1 approved these changes Aug 6, 2026

View reviewed changes

dependabot Bot changed the title ~~chore(deps): bump the backend-dependencies group in /backend with 20 updates~~ chore(deps): bump the backend-dependencies group across 1 directory with 20 updates Aug 11, 2026

dependabot Bot force-pushed the dependabot/pip/backend/main/backend-dependencies-9206f9b5f8 branch from 55d024c to 21e92c8 Compare August 11, 2026 15:06

Navigation Menu

chore(deps): bump the backend-dependencies group across 1 directory with 20 updates - #2459

chore(deps): bump the backend-dependencies group across 1 directory with 20 updates#2459
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/main/backend-dependencies-9206f9b5f8

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited

Loading

Uh oh!

utksh1 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.141.1

Fixes

Docs

Version 0.52.1

Fixed

0.52.1 (August 1, 2026)

Fixed

0.52.0 (July 29, 2026)

Added

Fixed

0.51.0 (July 8, 2026)

Added

Removed

0.50.2 (July 6, 2026)

Fixed

0.50.1 (July 6, 2026)

Fixed

0.50.0 (July 4, 2026)

Changed

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

What's Changed

Fixes

v2.13.2 (2026-04-17)

What's Changed

Fixes

v2.13.1 (2026-04-15)

What's Changed

Fixes

v2.13.0 (2026-04-13)

v2.15.0

Highlights

Behavior changes

New features

Bug fixes

Documentation

What's Changed

psycopg release notes

Future releases

Current release

8.1.0

Changes

✨ Highlights

Async maintenance notifications

Expanded command coverage

🚀 New Features

⚠️ Experimental

🐛 Bug Fixes

v3.4.8

Version 0.0.32

What's Changed

0.0.32 (2026-06-04)

0.0.31 (2026-06-04)

0.0.30 (2026-05-31)

0.0.29 (2026-05-17)

0.0.28 (2026-05-10)

0.0.27 (2026-04-27)

0.0.26 (2026-04-10)

0.0.25 (2026-04-10)

0.0.24 (2026-04-05)

0.0.23 (2026-04-05)

v0.22.1

v0.22.0

v0.21.0

v2.53.0

2.53.0 (2026-08-03)

Features

Bug Fixes

2.53.0 (2026-08-03)

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited

Loading

`psycopg` release notes