Skip to content

build(deps): bump the allpip group across 1 directory with 45 updates#788

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/allpip-bdf3c7b54e
Open

build(deps): bump the allpip group across 1 directory with 45 updates#788
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/allpip-bdf3c7b54e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the allpip group with 43 updates in the / directory:

Package From To
fastapi 0.136.3 0.139.2
alembic 1.18.4 1.18.5
uvicorn 0.48.0 0.51.0
click 8.4.1 8.4.2
python-ulid 3.1.0 3.2.1
sqlalchemy 2.0.50 2.0.51
python-multipart 0.0.31 0.0.32
vcrpy 8.2.1 8.3.0
prometheus-fastapi-instrumentator 8.0.0 8.0.2
coverage 7.14.1 7.15.2
playwright 1.60.0 1.61.0
ruff 0.15.15 0.15.22
pyright 1.1.410 1.1.411
setuptools 82.0.1 83.0.0
djlint 1.36.4 1.41.0
anyio 4.13.0 4.14.2
beautifulsoup4 4.14.3 4.15.0
blessed 1.44.0 1.47.0
certifi 2026.5.20 2026.6.17
cffi 2.0.0 2.1.0
charset-normalizer 3.4.7 3.4.9
cryptography 48.0.1 49.0.0
cssbeautifier 1.15.4 2.0.3
distlib 0.4.0 0.4.3
dulwich 1.2.6 1.2.12
filelock 3.29.0 3.31.1
fsspec 2026.4.0 2026.6.0
greenlet 3.5.1 3.5.3
idna 3.17 3.18
jaraco-functools 4.5.0 4.6.0
joserfc 1.6.8 1.7.4
jsbeautifier 1.15.4 2.0.3
json5 0.14.0 0.15.0
pbs-installer 2026.5.10 2026.7.18
platformdirs 4.10.0 4.10.1
python-discovery 1.4.0 1.4.4
regex 2026.5.9 2026.7.19
soupsieve 2.8.4 2.9
tomlkit 0.15.0 0.15.1
typing-extensions 4.15.0 4.16.0
virtualenv 21.4.2 21.6.1
websockets 16.0 16.1.1
wrapt 2.2.1 2.2.2

Updates fastapi from 0.136.3 to 0.139.2

Release notes

Sourced from fastapi's releases.

0.139.2

Fixes

  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.

0.139.1

Fixes

  • 🐛 Fix frontend fallback support for doted paths like /users/john.doe. PR #16011 by @​tiangolo.

Docs

  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #15995 by @​YuriiMotov.

Translations

Internal

... (truncated)

Commits
  • 866b7a3 🔖 Release version 0.139.2 (#16014)
  • 7b3effe 📝 Update release notes
  • 7fe315c 🐛 Refactor router route building to make it thread-safe, mainly relevant for ...
  • c48e67b 🔖 Release version 0.139.1 (#16012)
  • 2acc4fb 📝 Update release notes
  • eb75fd0 🐛 Fix frontend fallback support for doted paths like /users/john.doe (#16011)
  • 9b8410b 📝 Update release notes
  • e24d44c 📝 Fix topic repository list not being displayed and skip_users not being ap...
  • 93b78f8 📝 Update release notes
  • b959b44 📝 Update release notes
  • Additional commits viewable in compare view

Updates alembic from 1.18.4 to 1.18.5

Release notes

Sourced from alembic's releases.

1.18.5

Released: June 25, 2026

usecase

  • [usecase] [commands] Added --splice support to the merge() command. Previously, the merge command would suggest using --splice when attempting to merge non-head revisions, but the flag was not actually accepted by the command. The splice parameter is now available in both the command-line interface and the command.merge() function, matching the existing support in command.revision(). Pull request courtesy Kadir Can Ozden.

    References: #1712

  • [usecase] [environment] Added ScriptDirectory.get_heads.consider_depends_on parameter to ScriptDirectory.get_heads(). When set to True, head revisions that are also a dependency of another revision via depends_on are excluded from the result, matching the effective heads that would be present in the alembic_version table after running all upgrades.

    References: #1806

bug

  • [bug] [autogenerate] Fixed rendering of dialect keyword arguments containing ~sqlalchemy.schema.Column objects within sequences, such as postgresql_include. These were previously rendered using repr(), producing invalid Python in the generated migration scripts. Column objects within list or tuple values are now correctly rendered as their string column names. Pull request courtesy Ajay Singh.

    References: #1258

  • [bug] [mysql] Implemented type comparison for ENUM datatypes on MySQL, which checks that the individual enum values are equivalent. If additional entries are on either side, this generates a diff. Changes of order do not generate a diff. Pull request courtesy Furkan Köykıran.

    References: #1745, #779

  • [bug] [operations] Fixed bug where the inline_references parameter of Operations.add_column() did not include foreign key referential actions such as ON DELETE, ON UPDATE, DEFERRABLE, INITIALLY, and MATCH when rendering the inline REFERENCES clause.

... (truncated)

Commits

Updates uvicorn from 0.48.0 to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

Full Changelog: Kludex/uvicorn@0.49.0...0.50.0

Version 0.49.0

What's Changed

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

  • Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

  • Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

  • Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)
  • Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)
  • Default --ws auto to websockets-sansio when websockets is installed (#2985)
  • Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)
  • Build a fresh asgi scope dict per request (#2977)
  • Cache the asgi scope sub-dict per connection (#2976)
  • Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)
  • Memoize trusted host checks in ProxyHeadersMiddleware (#2970)
  • Replace click.style with an internal ANSI style helper (#2981)

Deprecated

  • Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

0.49.0 (June 3, 2026)

Changed

  • Bump httptools minimum version to 0.8.0 (#2962)
  • Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)
Commits
  • e4d0b05 Version 0.51.0 (#3028)
  • 944e43d Remove colorama from the standard extra (#3027)
  • 2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
  • a1b570c Version 0.50.2 (#3022)
  • 83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
  • b4d0116 Version 0.50.1 (#3020)
  • 2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
  • 1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
  • 837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
  • 21d2c16 Version 0.50.0 (#3013)
  • Additional commits viewable in compare view

Updates click from 8.4.1 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

  • Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
  • Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
  • A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
  • echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
  • {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582
Changelog

Sourced from click's changelog.

Version 8.4.2

Released 2026-06-24

  • Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
  • Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
  • A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
  • echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. {pr}3578
  • {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. {issue}2331 {issue}1884 {issue}3125 {pr}3582
Commits
  • b2e30a1 Release version 8.4.2
  • 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
  • bec5928 Fix package_name resolution when top-level module differs from distribution...
  • 916883a Fix tests to not rely on -Wdefault option (#3591)
  • 09195f6 Fix double-bracketing of choices in synopsis (#3578)
  • 1557e26 Check for warning exception with idiomatic context manager
  • d9ff133 Static typing improvements in click.shell_completion (#3460)
  • 762c97e Fix double-bracketing of choices in synopsis
  • 8929d39 Convert changes to markdown. (#3559)
  • 237be50 Move changes headings down a level.
  • Additional commits viewable in compare view

Updates python-ulid from 3.1.0 to 3.2.1

Release notes

Sourced from python-ulid's releases.

3.2.0

Added

  • Added transparent bidirectional UUIDv7 conversion methods (ULID.to_uuid7 and ULID.from_uuidv7) @​pirate.
  • Added a --uuid7 option to the CLI's show command to convert and output a ULID as an RFC 4122 compliant UUIDv7.

Changed

  • Dropped support for Python 3.9 and added support for Python 3.14 @​Avihais12344.
  • Depend on typing-extensions only when running on Python < 3.11 @​musicinmybrain.
  • Migrated package and development workflow from Hatch to uv and poethepoet.
  • Configured Flox for bootstrapping the development environment.

Fixed

  • Fixed a clock-skew bug where non-monotonic ULIDs could be generated when crossing a millisecond boundary between timestamp and randomness sampling @​gaoflow.
  • Fixed warning from uv during synchronization @​jaseemabid.
  • Resolved various Ruff linter warnings and Pyrefly type checker issues.
Changelog

Sourced from python-ulid's changelog.

.. _changelog:

Changelog

Versions follow Semantic Versioning <http://www.semver.org>_

3.2.0_ - 2026-07-17

Added

* Added transparent bidirectional UUIDv7 conversion methods (``ULID.to_uuid7`` and
  ``ULID.from_uuidv7``) `@pirate <https://github.com/pirate>`_.
* Added a ``--uuid7`` option to the CLI's ``show`` command to convert and output a ULID as an
  RFC 4122 compliant UUIDv7.

Changed

  • Dropped support for Python 3.9 and added support for Python 3.14 @Avihais12344 <https://github.com/Avihais12344>_.
  • Depend on typing-extensions only when running on Python < 3.11 @musicinmybrain <https://github.com/musicinmybrain>_.
  • Migrated package and development workflow from Hatch to uv and poethepoet.
  • Configured Flox for bootstrapping the development environment.

Fixed

* Fixed a clock-skew bug where non-monotonic ULIDs could be generated when crossing a millisecond boundary between timestamp and randomness sampling `@gaoflow <https://github.com/gaoflow>`_.
* Fixed warning from ``uv`` during synchronization `@jaseemabid <https://github.com/jaseemabid>`_.
* Resolved various Ruff linter warnings and Pyrefly type checker issues.
Commits
  • 7a31bbd Improve contribution guide
  • 4c35bd2 chore: Add missing build step to publish job
  • 7226f71 chore: Use pinned commit for codecov as well
  • 84ecd54 chore: Use commit SHA pin for external actions
  • 3f04e7f chore: Update CHANGELOG with latest changes
  • 8ee65f6 Depend on typing-extensions for Python<3.11; avoid it otherwise (#50)
  • 9b592d2 Add changelog for 3.2.0 release
  • a1ef275 Add --uuid7 option to ulid show command
  • e24d596 Add contribution guides for humans and AI
  • 2f4f67f chore: Ignore coverage files
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

  • [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

    References: #13207

  • [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

    References: #13356

engine

  • [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

    References: #9427

sql

  • [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

    References: #10827

... (truncated)

Commits

Updates python-multipart from 0.0.31 to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

  • Speed up partial-boundary scanning for CR/LF-dense part data #300.
Commits

Updates vcrpy from 8.2.1 to 8.3.0

Release notes

Sourced from vcrpy's releases.

v8.3.0

What's Changed

  • Add support for niquests (#980) — thanks @​ionelmc
  • Recording now fails fast if a request or response contains a Python object the safe YAML loader (introduced in 8.2.1) couldn't read back, instead of writing a cassette that breaks on replay. The error shows exactly how to register the object if you need it (#1007, #1009) — thanks @​Polandia94
  • New vcr.serializers.yamlserializer.with_custom_tags(...) builds a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) — thanks @​Polandia94
  • Clearer error when a cassette contains an unsupported YAML tag, and the stale git.io migration link is gone (#1007, #1008) — thanks @​gaoflow
  • Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

Full Changelog: kevin1024/vcrpy@v8.2.1...v8.3.0

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

  • 8.3.0

    • Add support for niquests (#980) - thanks @​ionelmc
    • Refuse to record a cassette containing a Python object the safe YAML loader could not read back, so recording fails fast instead of producing a cassette that breaks on replay (#1007, #1009) - thanks @​Polandia94
    • Add vcr.serializers.yamlserializer.with_custom_tags to build a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) - thanks @​Polandia94
    • Clearer error when a cassette contains an unsupported YAML tag, and remove the stale git.io migration link (#1007, #1008) - thanks @​gaoflow
    • Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

  • 8.2.1

    • SECURITY: Load cassettes with a safe YAML loader, preventing arbitrary code execution when a cassette from an untrusted source is loaded (GHSA-rpj2-4hq8-938g) - thanks @​RamiAltai and @​EQSTLab
    • Validate record_mode and raise a clear error on an invalid value (#208)
    • Recommend pytest-recording over the unmaintained pytest-vcr in the docs (#986)

  • 8.2.0

    • Add support for httpx 2.x (#993) - thanks @​dsfaccini
    • Patch httpx transports instead of httpcore (#972) - thanks @​seowalex
    • Fix aiohttp 3.14 compatibility: AsyncStreamReaderMixin removed and ClientResponse now requires stream_writer (#995) - thanks @​dsfaccini
    • Account for modified requests when storing played cassettes, so drop_unused_requests honours before_record_request filtering (#962) - thanks @​jamesbraza
    • Make the request URL available on VCRHTTPResponse (#976) - thanks @​dAnjou
    • Improve error message when a matching request has already been consumed (#985) - thanks @​Polandia94
    • Fix body check in convert_body_to_unicode to use an explicit type check (#982) - thanks @​Polandia94
    • Add env proxy cassette regression test (#994) - thanks @​tine1117
    • Remove milestone references from docs (#984) - thanks @​Polandia94
    • CI: bump sphinx-rtd-theme from 3.0.2 to 3.1.0 (#973)

  • 8.1.1

    • Fix sync requests in async contexts for HTTPX (#965) - thanks @​seowalex
    • CI: bump peter-evans/create-pull-request from 7 to 8 (#969)

  • 8.1.0

  • 8.0.0

    • BREAKING: Drop support for Python 3.9 (major version bump) - thanks @​jairhenrique
    • BREAKING: Drop support for urllib3 < 2 - fixes CVE warnings from urllib3 1.x (#926, #880) - thanks @​jairhenrique
    • New feature: drop_unused_requests option to remove unused interactions from cassettes (#763) - thanks @​danielnsilva
    • Rewrite httpx support to patch httpcore instead of httpx (#943) - thanks @​seowalex
      • Fixes httpx.ResponseNotRead exceptions (#832, #834)
      • Fixes KeyError: 'follow_redirects' (#945)
      • Adds support for custom httpx transports
    • Fix HTTPS proxy handling - proxy address no longer ends up in cassette URIs (#809, #914) - thanks @​alga

... (truncated)

Commits

Updates prometheus-fastapi-instrumentator from 8.0.0 to 8.0.2

Release notes

Sourced from prometheus-fastapi-instrumentator's releases.

8.0.2 / 2026-06-23

Fixed

  • Replaced deprecated asyncio.iscoroutinefunction() with inspect.iscoroutinefunction() in Instrumentator.add() to avoid warnings on Python 3.12+ in #378.

8.0.1 / 2026-06-22

Fixed

  • Fixed resolving route names for routers registered via include_router() on FastAPI 0.116+ leading to AttributeError getting raised on every request. The internal route name resolution now also handles _IncludedRouter and recurses into the included router's own routes so the Prometheus label reflects the leaf endpoint. Thanks to @​adeebmirza in #371 for fixing it.
  • Fixed hitting mounts with slash redirection collecting wrong handler name. Thanks to @​lbonn for raising and fixing this issue in #369.
Changelog

Sourced from prometheus-fastapi-instrumentator's changelog.

8.0.2 / 2026-06-23

Fixed

  • Replaced deprecated asyncio.iscoroutinefunction() with inspect.iscoroutinefunction() in Instrumentator.add() to avoid warnings on Python 3.12+ in #378.

8.0.1 / 2026-06-22

Fixed

  • Fixed resolving route names for routers registered via include_router() on FastAPI 0.116+ leading to AttributeError getting raised on every request. The internal route name resolution now also handles _IncludedRouter and recurses into the included router's own routes so the Prometheus label reflects the leaf endpoint. Thanks to @​adeebmirza in #371 for fixing it.
  • Fixed hitting mounts with slash redirection collecting wrong handler name. Thanks to @​lbonn for raising and fixing this issue in #369.
Commits
  • c1c1fb6 chore: Prepare release v8.0.2
  • 652991e docs: Add link to pr in changelog
  • 4cca8aa build(deps): bump pre-commit/action from 3.0.0 to 3.0.1 (#301)
  • dd185b0 build(deps): bump softprops/action-gh-release from 2 to 3 (#363)
  • 8e8f8c5 build(deps): bump amannn/action-semantic-pull-request from 5 to 6 (#364)
  • 778526b build(deps): bump actions/cache from 4 to 5 (#365)
  • c212ede build(deps): bump github/codeql-action from 2 to 4 (#366)
  • f31451c chore: Replace deprecated coroutine detection (#378)
  • c433368 test(routing): add 405/Mount/WebSocket coverage for _IncludedRouter (#377)
  • e7b3266 Remove incorrect build badge from readme
  • Additional commits viewable in compare view

Updates coverage from 7.14.1 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 22...

    Description has been truncated

@dependabot
build(deps): bump the allpip group across 1 directory with 45 updates
4f2bbbc 
Bumps the allpip group with 43 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.3` | `0.139.2` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.18.5` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.48.0` | `0.51.0` |
| [click](https://github.com/pallets/click) | `8.4.1` | `8.4.2` |
| [python-ulid](https://github.com/mdomke/python-ulid) | `3.1.0` | `3.2.1` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.51` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.31` | `0.0.32` |
| [vcrpy](https://github.com/kevin1024/vcrpy) | `8.2.1` | `8.3.0` |
| [prometheus-fastapi-instrumentator](https://github.com/trallnag/prometheus-fastapi-instrumentator) | `8.0.0` | `8.0.2` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.2` |
| [playwright](https://github.com/microsoft/playwright-python) | `1.60.0` | `1.61.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.15` | `0.15.22` |
| [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.410` | `1.1.411` |
| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |
| [djlint](https://github.com/djlint/djLint) | `1.36.4` | `1.41.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) | `4.14.3` | `4.15.0` |
| [blessed](https://github.com/jquast/blessed) | `1.44.0` | `1.47.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.5.20` | `2026.6.17` |
| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.0` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |
| [cryptography](https://github.com/pyca/cryptography) | `48.0.1` | `49.0.0` |
| [cssbeautifier](https://github.com/beautifier/js-beautify) | `1.15.4` | `2.0.3` |
| [distlib](https://github.com/pypa/distlib) | `0.4.0` | `0.4.3` |
| [dulwich](https://github.com/dulwich/dulwich) | `1.2.6` | `1.2.12` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.29.0` | `3.31.1` |
| [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.4.0` | `2026.6.0` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.3` |
| [idna](https://github.com/kjd/idna) | `3.17` | `3.18` |
| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.5.0` | `4.6.0` |
| [joserfc](https://github.com/authlib/joserfc) | `1.6.8` | `1.7.4` |
| [jsbeautifier](https://github.com/ghost6991/Jsbeautifier) | `1.15.4` | `2.0.3` |
| [json5](https://github.com/dpranke/pyjson5) | `0.14.0` | `0.15.0` |
| [pbs-installer](https://github.com/frostming/pbs-installer) | `2026.5.10` | `2026.7.18` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.10.1` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.4.0` | `1.4.4` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.5.9` | `2026.7.19` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.4` | `2.9` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.0` | `0.15.1` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.4.2` | `21.6.1` |
| [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1.1` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.2.1` | `2.2.2` |



Updates `fastapi` from 0.136.3 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.3...0.139.2)

Updates `alembic` from 1.18.4 to 1.18.5
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `uvicorn` from 0.48.0 to 0.51.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.48.0...0.51.0)

Updates `click` from 8.4.1 to 8.4.2
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.1...8.4.2)

Updates `python-ulid` from 3.1.0 to 3.2.1
- [Release notes](https://github.com/mdomke/python-ulid/releases)
- [Changelog](https://github.com/mdomke/python-ulid/blob/main/CHANGELOG.rst)
- [Commits](mdomke/python-ulid@3.1.0...3.2.1)

Updates `sqlalchemy` from 2.0.50 to 2.0.51
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `python-multipart` from 0.0.31 to 0.0.32
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.31...0.0.32)

Updates `vcrpy` from 8.2.1 to 8.3.0
- [Release notes](https://github.com/kevin1024/vcrpy/releases)
- [Changelog](https://github.com/kevin1024/vcrpy/blob/master/docs/changelog.rst)
- [Commits](kevin1024/vcrpy@v8.2.1...v8.3.0)

Updates `prometheus-fastapi-instrumentator` from 8.0.0 to 8.0.2
- [Release notes](https://github.com/trallnag/prometheus-fastapi-instrumentator/releases)
- [Changelog](https://github.com/trallnag/prometheus-fastapi-instrumentator/blob/master/CHANGELOG.md)
- [Commits](trallnag/prometheus-fastapi-instrumentator@v8.0.0...v8.0.2)

Updates `coverage` from 7.14.1 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.2)

Updates `playwright` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright-python/releases)
- [Commits](microsoft/playwright-python@v1.60.0...v1.61.0)

Updates `ruff` from 0.15.15 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.15...0.15.22)

Updates `pyright` from 1.1.410 to 1.1.411
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.410...v1.1.411)

Updates `setuptools` from 82.0.1 to 83.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v82.0.1...v83.0.0)

Updates `djlint` from 1.36.4 to 1.41.0
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.36.4...v1.41.0)

Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)

Updates `beautifulsoup4` from 4.14.3 to 4.15.0

Updates `blessed` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/jquast/blessed/releases)
- [Changelog](https://github.com/jquast/blessed/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/blessed/commits)

Updates `certifi` from 2026.5.20 to 2026.6.17
- [Commits](certifi/python-certifi@2026.05.20...2026.06.17)

Updates `cffi` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v2.0.0...v2.1.0)

Updates `charset-normalizer` from 3.4.7 to 3.4.9
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.7...3.4.9)

Updates `cryptography` from 48.0.1 to 49.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.1...49.0.0)

Updates `cssbeautifier` from 1.15.4 to 2.0.3
- [Release notes](https://github.com/beautifier/js-beautify/releases)
- [Changelog](https://github.com/beautifier/js-beautify/blob/main/CHANGELOG.md)
- [Commits](beautifier/js-beautify@v1.15.4...v2.0.3)

Updates `distlib` from 0.4.0 to 0.4.3
- [Release notes](https://github.com/pypa/distlib/releases)
- [Changelog](https://github.com/pypa/distlib/blob/master/CHANGES.rst)
- [Commits](pypa/distlib@0.4.0...0.4.3)

Updates `dulwich` from 1.2.6 to 1.2.12
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-1.2.6...dulwich-1.2.12)

Updates `filelock` from 3.29.0 to 3.31.1
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.29.0...3.31.1)

Updates `fsspec` from 2026.4.0 to 2026.6.0
- [Commits](fsspec/filesystem_spec@2026.4.0...2026.6.0)

Updates `greenlet` from 3.5.1 to 3.5.3
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.3)

Updates `idna` from 3.17 to 3.18
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.17...v3.18)

Updates `jaraco-functools` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/jaraco/jaraco.functools/releases)
- [Changelog](https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst)
- [Commits](jaraco/jaraco.functools@v4.5.0...v4.6.0)

Updates `jinxed` from 2.0.4 to 2.1.0
- [Release notes](https://github.com/Rockhopper-Technologies/jinxed/releases)
- [Commits](Rockhopper-Technologies/jinxed@2.0.4...2.1.0)

Updates `joserfc` from 1.6.8 to 1.7.4
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.6.8...1.7.4)

Updates `jsbeautifier` from 1.15.4 to 2.0.3
- [Commits](https://github.com/ghost6991/Jsbeautifier/commits)

Updates `json5` from 0.14.0 to 0.15.0
- [Commits](dpranke/pyjson5@v0.14.0...v0.15.0)

Updates `pbs-installer` from 2026.5.10 to 2026.7.18
- [Release notes](https://github.com/frostming/pbs-installer/releases)
- [Commits](frostming/pbs-installer@2026.05.10...2026.07.18)

Updates `platformdirs` from 4.10.0 to 4.10.1
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.10.0...4.10.1)

Updates `python-discovery` from 1.4.0 to 1.4.4
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.4.0...1.4.4)

Updates `regex` from 2026.5.9 to 2026.7.19
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.5.9...2026.7.19)

Updates `soupsieve` from 2.8.4 to 2.9
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](facelessuser/soupsieve@2.8.4...2.9)

Updates `tomlkit` from 0.15.0 to 0.15.1
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.0...0.15.1)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

Updates `virtualenv` from 21.4.2 to 21.6.1
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.4.2...21.6.1)

Updates `wcwidth` from 0.7.0 to 0.8.2
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Commits](jquast/wcwidth@0.7.0...0.8.2)

Updates `websockets` from 16.0 to 16.1.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@16.0...16.1.1)

Updates `wrapt` from 2.2.1 to 2.2.2
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.2.1...2.2.2)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: alembic
  dependency-version: 1.18.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: uvicorn
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: click
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: python-ulid
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: sqlalchemy
  dependency-version: 2.0.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: vcrpy
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: prometheus-fastapi-instrumentator
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: playwright
  dependency-version: 1.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: pyright
  dependency-version: 1.1.411
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: allpip
- dependency-name: djlint
  dependency-version: 1.41.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: beautifulsoup4
  dependency-version: 4.15.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: blessed
  dependency-version: 1.47.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: certifi
  dependency-version: 2026.6.17
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: cffi
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: charset-normalizer
  dependency-version: 3.4.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: cryptography
  dependency-version: 49.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: allpip
- dependency-name: cssbeautifier
  dependency-version: 2.0.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: allpip
- dependency-name: distlib
  dependency-version: 0.4.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: dulwich
  dependency-version: 1.2.12
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: filelock
  dependency-version: 3.31.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: fsspec
  dependency-version: 2026.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: greenlet
  dependency-version: 3.5.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: idna
  dependency-version: '3.18'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: jaraco-functools
  dependency-version: 4.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: jinxed
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: joserfc
  dependency-version: 1.7.4
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: jsbeautifier
  dependency-version: 2.0.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: allpip
- dependency-name: json5
  dependency-version: 0.15.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: pbs-installer
  dependency-version: 2026.7.18
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: platformdirs
  dependency-version: 4.10.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: python-discovery
  dependency-version: 1.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: regex
  dependency-version: 2026.7.19
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: soupsieve
  dependency-version: '2.9'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: tomlkit
  dependency-version: 0.15.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: virtualenv
  dependency-version: 21.6.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: wcwidth
  dependency-version: 0.8.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: allpip
- dependency-name: wrapt
  dependency-version: 2.2.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: allpip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependancy issue label Jul 20, 2026
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Welcome to our community 🤗 and thank you for your first contribution.

As a first time contributor please make sure to review our contribution guidelines ❤️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependancy issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants