Skip to content

chore(deps): bump the pip group across 1 directory with 7 updates - #63

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/pip-1474cfd050
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/pip-1474cfd050

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026 •

Copy link
Copy Markdown

Bumps the pip group with 7 updates in the /backend directory:

Package From To
uvicorn 0.52.4 0.53.0
pydantic 2.13.4 2.13.5
sse-starlette 3.4.8 3.4.11
lancedb 0.37.1 0.39.0
pypdf 6.16.2 6.19.0
ruff 0.16.4 0.16.8
httpx2 2.12.0 2.13.0

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits
  • 421708f Version 0.53.0 (#3136)
  • f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
  • 63971ed Document HTTP/2 support (#3130)
  • 7d1a005 Remove race from multiprocess health check test (#3128)
  • 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
  • 098b206 Remove timing race from SIGHUP supervisor test (#3127)
  • 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
  • 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
  • fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
  • fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates sse-starlette from 3.4.8 to 3.4.11

Release notes

Sourced from sse-starlette's releases.

v3.4.11

What's Changed

New Contributors

Full Changelog: sysid/sse-starlette@v3.4.10...v3.4.11

v3.4.10

What's Changed

New Contributors

Full Changelog: sysid/sse-starlette@v3.4.9...v3.4.10

v3.4.9

What's Changed

Full Changelog: sysid/sse-starlette@v3.4.8...v3.4.9

Commits
  • 6754ef3 Bump version to 3.4.11
  • 25bcc15 fix(examples): make broadcast stream terminal after cleanup
  • faa2c1c Merge pull request #209 from varadfromeast/fix/broadcasting-backpressure
  • cb2205e fix(examples): close send-timeout leak and harden broadcasting tests
  • b2362d5 fix(examples): handle slow broadcasting clients
  • dd0cdb2 fix: uv.lock
  • 70368f0 Bump version to 3.4.10
  • 824f8c0 Merge pull request #208 from wse114/fix/send-timeout-heartbeat
  • e9dcc04 Bump version to 3.4.9
  • 8d050b7 Merge pull request #207 from sysid/fix/issue206
  • Additional commits viewable in compare view

Updates lancedb from 0.37.1 to 0.39.0

Release notes

Sourced from lancedb's releases.

LanceDB v0.39.0

🛠 Breaking Changes

🎉 New Features

🐛 Bug Fixes

📚 Documentation

Other Changes

... (truncated)

Commits
  • 0c33b27 Bump version: 0.39.0-beta.9 → 0.39.0
  • a514e2f Bump version: 0.39.0-beta.8 → 0.39.0-beta.9
  • 0ed17a6 feat: update lance dependency to v12.0.0 (#4216)
  • 3be313f test(node): fix flaky optimize cleanup test (#4217)
  • aad9664 fix: scope the Function binding guard on schema evolution to the bound column...
  • f013e3f fix: return InvalidTableName instead of panicking in open_table/create_table ...
  • c7d0473 fix: expose public FTS paths in remote index listings (#4194)
  • 425774b fix(python): correct pylance test extra pin (#4051)
  • 53679de fix: do not allow . and .. as table names (#4191)
  • acf4a50 fix: accept all-null batches and plain JSON strings for json columns (#4067)
  • Additional commits viewable in compare view

Updates pypdf from 6.16.2 to 6.19.0

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

Deprecations (DEP)

Performance Improvements (PI)

Bug Fixes (BUG)

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Documentation (DOC)

Full Changelog

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

  • Use apply_configuration as a context manager to temporarily overwrite configuration values.

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

  • Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

  • Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

  • Move static value out of loop body for appearance stream data (#4087)
  • Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

  • Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
  • Use page reference for existing internal link targets (#4076)
  • Arabic-Indic digits are reversed during text extraction (#4077)
  • Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

  • Further restrict FlateDecode recovery (#4073)
  • Limit entry count for TrueType and Type1 font /Widths (#4072)
  • Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

  • Use current text matrix for visitor_text (#4062)
  • Repeat the letter for /S /A and /S /a page labels past Z (#4065)
  • Use font color for FreeText default appearance (#4051)

Robustness (ROB)

  • Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

  • Use combined matrix in visitor examples (#4066)

Full Changelog

Version 6.18.0, 2026-09-07

Security (SEC)

  • Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

  • Rework configuration value handling (#4044)

New Features (ENH)

  • Draw borders and backgrounds for appearance streams and annotations (#4033)

... (truncated)

Commits
  • d62cb58 REL: 6.19.0
  • 0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
  • 959467a PI: Move static value out of loop body for appearance stream data (#4087)
  • 20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
  • 25f2301 DEP: Replace PdfWriter method add_js (#3979)
  • a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
  • cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
  • 96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
  • 2d21901 DEV: Fix Color class for latest mypy (#4082)
  • 893a010 MAINT: Split PdfDocCommon._flatten (#4070)
  • Additional commits viewable in compare view

Updates ruff from 0.16.4 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpx2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

httpcore2

Changed

Fixed

  • Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Changelog

Sourced from httpx2's changelog.

2.13.0 (September 14th, 2026)

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

  • Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
  • Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the pip group with 7 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.53.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.8` | `3.4.11` |
| [lancedb](https://github.com/lancedb/lancedb) | `0.37.1` | `0.39.0` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.16.2` | `6.19.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.8` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.12.0` | `2.13.0` |



Updates `uvicorn` from 0.52.4 to 0.53.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.53.0)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `sse-starlette` from 3.4.8 to 3.4.11
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v3.4.8...v3.4.11)

Updates `lancedb` from 0.37.1 to 0.39.0
- [Release notes](https://github.com/lancedb/lancedb/releases)
- [Changelog](https://github.com/lancedb/lancedb/blob/main/release_process.md)
- [Commits](lancedb/lancedb@v0.37.1...v0.39.0)

Updates `pypdf` from 6.16.2 to 6.19.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.16.2...6.19.0)

Updates `ruff` from 0.16.4 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.8)

Updates `httpx2` from 2.12.0 to 2.13.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.12.0...v2.13.0)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: sse-starlette
  dependency-version: 3.4.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: lancedb
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: pypdf
  dependency-version: 6.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: httpx2
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 4, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 4, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/backend/pip-1474cfd050 branch October 4, 2026 23:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants