build(deps): bump the python group across 1 directory with 2 updates

[dependabot]

Updates the requirements on httpcore and pydantic-settings to permit the latest version.
Updates httpcore to 1.0.9

Release notes

Sourced from httpcore's releases.

Version 1.0.9 (April 24th, 2025)

• Resolve GHSA-vqfr-h8mv-ghfj with h11 dependency update. (#1008)

Changelog

Sourced from httpcore's changelog.

Version 1.0.9 (April 24th, 2025)

• Resolve GHSA-vqfr-h8mv-ghfj with h11 dependency update. (#1008)

Version 1.0.8 (April 11th, 2025)

• Fix AttributeError when importing on Python 3.14. (#1005)

Version 1.0.7 (November 15th, 2024)

• Support proxy=… configuration on ConnectionPool(). (#974)

Version 1.0.6 (October 1st, 2024)

• Relax trio dependency pinning. (#956)
• Handle trio raising NotImplementedError on unsupported platforms. (#955)
• Handle mapping ssl.SSLError to httpcore.ConnectError. (#918)

1.0.5 (March 27th, 2024)

• Handle EndOfStream exception for anyio backend. (#899)
• Allow trio 0.25.* series in package dependancies. (#903)

1.0.4 (February 21st, 2024)

• Add target request extension. (#888)
• Fix support for connection Upgrade and CONNECT when some data in the stream has been read. (#882)

1.0.3 (February 13th, 2024)

• Fix support for async cancellations. (#880)
• Fix trace extension when used with socks proxy. (#849)
• Fix SSL context for connections using the "wss" scheme (#869)

1.0.2 (November 10th, 2023)

• Fix float("inf") timeouts in Event.wait function. (#846)

1.0.1 (November 3rd, 2023)

• Fix pool timeout to account for the total time spent retrying. (#823)
• Raise a neater RuntimeError when the correct async deps are not installed. (#826)
• Add support for synchronous TLS-in-TLS streams. (#840)

1.0.0 (October 6th, 2023)

From version 1.0 our async support is now optional, as the package has minimal dependencies by default.

For async support use either pip install 'httpcore[asyncio]' or pip install 'httpcore[trio]'.

... (truncated)

Commits

• 9820975 Version 1.0.9 (#1011)
• d1e17c5 Update h11 dependency, resolving security fix. (#1008)
• ae46dfb Version 1.0.8 (#1006)
• b2a796c Fix AttributeError when importing on Python 3.14 (#1005)
• 38f277c Revert "Use AnyIO fast_acquire (#953)" (#1002)
• 973cbdd Use AnyIO fast_acquire (#953)
• 8b8ab18 fix ci (#999)
• a173552 Version 1.0.7 (#977)
• 13e281d Add proxy configuration to ConnectionPool. (#974)
• 0bfcee4 default port for the socks5h scheme (#972)
• Additional commits viewable in compare view

Updates pydantic-settings to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

• Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @​hramezani in pydantic/pydantic-settings#889
• Prepare release 2.14.2 by @​hramezani in pydantic/pydantic-settings#890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

Commits

• d703bd7 Prepare release 2.14.2 (#890)
• See full diff in compare view

[dependabot]

Dependabot couldn't access the repository. Because of this, Dependabot cannot update this pull request.