Skip to content

deps: bump the minor-and-patch group with 20 updates - #323

Merged
GeiserX merged 3 commits into
mainfrom
dependabot/pip/minor-and-patch-fbdfb55095
Aug 10, 2026
Merged

deps: bump the minor-and-patch group with 20 updates#323
GeiserX merged 3 commits into
mainfrom
dependabot/pip/minor-and-patch-fbdfb55095

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 20 updates:

Package From To
fastapi 0.136.1 0.141.1
uvicorn 0.47.0 0.52.1
httptools 0.7.1 0.8.0
apscheduler 3.11.2 3.11.3
python-multipart 0.0.31 0.0.32
prometheus-client 0.25.0 0.26.0
docker 7.1.0 7.2.0
tzdata 2026.2 2026.3
annotated-doc 0.0.4 0.0.5
annotated-types 0.7.0 0.8.0
anyio 4.13.0 4.14.2
certifi 2026.5.20 2026.7.22
cffi 2.0.0 2.1.1
charset-normalizer 3.4.7 3.4.9
click 8.4.1 8.4.2
idna 3.16 3.18
pydantic-core 2.46.4 2.48.0
starlette 1.3.1 1.4.1
typing-extensions 4.15.0 4.16.0
tzlocal 5.3.1 5.4.4

Updates fastapi from 0.136.1 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

0.141.0

Features

  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates uvicorn from 0.47.0 to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Version 0.51.0

What's Changed

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

  • Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

  • Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

... (truncated)

Commits
  • ee8e45c Version 0.52.1 (#3056)
  • b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
  • 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
  • 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
  • 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
  • e148451 Handle connection loss during WebSocket write backpressure (#3050)
  • e16a69b Add missing write flow control to websockets-sansio (#3048)
  • ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
  • 8f1b884 Version 0.52.0 (#3044)
  • f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
  • Additional commits viewable in compare view

Updates httptools from 0.7.1 to 0.8.0

Release notes

Sourced from httptools's releases.

v0.8.0

Changes

Commits

Updates apscheduler from 3.11.2 to 3.11.3

Release notes

Sourced from apscheduler's releases.

3.11.3

  • Fixed sub-minute interval jobs stalling for the duration of a DST spring-forward gap when the scheduler was configured with a ZoneInfo time zone, caused by the wakeup delay being computed from the naive wall-clock difference instead of the actual UTC difference (#1103)
  • Fixed imported jobs missing their scheduler and job store links (#1119)
Commits
  • 4308ec9 Added the release version
  • ff68780 Added a note about weekday numbers in CronTrigger.from_crontab()
  • 36936e9 Updated actions
  • c0ff7e4 Fixed Pyside6 tests failing on Python 3.9 and 3.8
  • 1b782c9 Fixed fixture coreapp not found
  • dc3dde4 Test against PySide6 on all Python versions
  • 18a6f6b Fixed imported jobs missing their scheduler and job store links
  • 1693db4 Fix interval jobs stalling across DST spring-forward with ZoneInfo (#1114)
  • 0636bf4 Added Python 3.14 to the test matrix
  • 3eb3de8 Fixed bad use of pytest.raises()
  • Additional commits viewable in compare view

Updates python-multipart from 0.0.31 to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

  • Speed up partial-boundary scanning for CR/LF-dense part data #300.
Commits

Updates prometheus-client from 0.25.0 to 0.26.0

Release notes

Sourced from prometheus-client's releases.

v0.26.0

What's Changed

New Contributors

Full Changelog: prometheus/client_python@v0.25.0...v0.26.0

Commits
  • 9b6b971 Release v0.26.0
  • fb072c2 Fix operator precedence allowing exemplars on any metric type (#1188)
  • 6e22fb5 Remove nameless collectors from the registry on unregister (#1191)
  • 5b09479 Parse the native histogram sum as a float (#1192)
  • 769b415 fix: make test suite pass on Windows and Python 3.12+ (#1185)
  • d0b497f Update common Prometheus files (#1195)
  • 75603d7 Update common Prometheus files (#1194)
  • fb2351f Do not emit a leading zero in floatToGoString exponents >= 10 (#1190)
  • a39a697 Validate Enum arguments before registering the collector (#1189)
  • a96f6f4 Add TLS version parameters for start_wsgi_server (#1178)
  • Additional commits viewable in compare view

Updates docker from 7.1.0 to 7.2.0

Release notes

Sourced from docker's releases.

7.2.0

Upgrade Notes

  • docker.from_env() now honors the active Docker CLI context when DOCKER_HOST is not set.
    • This means the client may connect to the daemon selected by DOCKER_CONTEXT or the current context in ~/.docker/config.json, matching Docker CLI behavior more closely.
    • If your application relied on the previous default connection behavior, set DOCKER_HOST explicitly, set DOCKER_CONTEXT=default, or pass use_context=False to DockerClient.from_env().
  • Added docker.from_context() / DockerClient.from_context() for explicitly creating a client from a Docker CLI context.

Features

  • Added support for Docker contexts when creating the default client
  • Added subpath support for volumes

Bugfixes

  • Fixed exec_run documentation for the stream parameter
  • Fixed image loading to avoid depending on the deprecated JSONMessage.error field
  • Preserved the rotated unlock key in swarm integration tests
  • Fixed SSL certificate generation in tests
  • Fixed IPv6 integration tests by explicitly enabling IPv6 where required

Miscellaneous

  • Updated tests for newer Docker Engine behavior
  • CI and build updates

What's Changed

New Contributors

... (truncated)

Commits
  • 5ad5327 Merge pull request #3415 from vvoland/update-changelog
  • d242230 docs: 7.2.0 changelog
  • ba01cc7 Merge pull request #3401 from ebriney/client-from-context
  • ae5dfe9 Merge pull request #3410 from vvoland/fix-flaky
  • aa99999 integration/swarm: Preserve rotated unlock key
  • 059d371 Merge pull request #3407 from vvoland/fix-arm64
  • 9b4b9b8 gha: Add arm64 integration CI
  • 9e9f8ff Skip tests incompatible with host architecture
  • e0542d9 Merge pull request #3408 from vvoland/gha-pin
  • 578a11d gha: Pin to digests
  • Additional commits viewable in compare view

Updates tzdata from 2026.2 to 2026.3

Release notes

Sourced from tzdata's releases.

2026.3: Release of upstream tzdata 2026c

Version 2026.3

Upstream version 2026c released 2026-07-08T17:23:58+00:00

Briefly:

Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. More integer overflow bugs have been fixed in zic.

Changes to future timestamps

Alberta’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh Pournader and others.) Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-06-18, temporarily model the change to occur on 2026-11-01 at 02:00 instead, for the same reason we introduced a similarly temporary hack for British Columbia in 2026b.

Although another TZDB release will likely be needed soon because Northwest Territories will likely follow Alberta, the legal formalities have not yet taken place.

Morocco plans to move back to permanent UTC, without daylight saving time transitions, on 2026-09-20 at 02:00. This also affects Western Sahara.

Changes to commentary

Northwest Territories is expected to move to permanent -06 prior to 2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to Tim Parenti and James Bellaire.) Model this with its traditional abbreviation CST. Unfortunately the change is not yet official, so it is currently present only as comments that can be uncommented as needed.

Changelog

Sourced from tzdata's changelog.

Version 2026.3

Upstream version 2026c released 2026-07-08T17:23:58+00:00

Briefly:

Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. More integer overflow bugs have been fixed in zic.

Changes to future timestamps

Alberta’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh Pournader and others.) Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-06-18, temporarily model the change to occur on 2026-11-01 at 02:00 instead, for the same reason we introduced a similarly temporary hack for British Columbia in 2026b.

Although another TZDB release will likely be needed soon because Northwest Territories will likely follow Alberta, the legal formalities have not yet taken place.

Morocco plans to move back to permanent UTC, without daylight saving time transitions, on 2026-09-20 at 02:00. This also affects Western Sahara.

Changes to commentary

Northwest Territories is expected to move to permanent -06 prior to 2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to Tim Parenti and James Bellaire.) Model this with its traditional abbreviation CST. Unfortunately the change is not yet official, so it is currently present only as comments that can be uncommented as needed.

Commits
  • a442794 Update tzdata to version 2026c (#145)
  • 8f35937 Use the release environment for TestPyPI publishes (#146)
  • ba0b891 Few fixes to the maintaining doc
  • 9a7e6a0 Add Stan Ulbrych to license
  • 1cab5e2 Bump actions/checkout from 6.0.2 to 7.0.0 (#144)
  • e71cff9 Bump hynek/build-and-inspect-python-package action (#143)
  • 14b2953 Make open PR check stricter (#141)
  • 68d4d51 Isolate package build and publish (#137)
  • 5bb6232 Fix punctuation in README.
  • e313d95 Raise with an informative message when release is missing from NEWS file
  • Additional commits viewable in compare view

Updates annotated-doc from 0.0.4 to 0.0.5

Release notes

Sourced from annotated-doc's releases.

0.0.5

Breaking Changes

Upgrades

Docs

Internal

... (truncated)

Changelog

Sourced from annotated-doc's changelog.

0.0.5 (2026-07-28)

Breaking Changes

Upgrades

Docs

Internal

@dependabot
deps: bump the minor-and-patch group with 20 updates
2314fdb 
Bumps the minor-and-patch group with 20 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.1` | `0.141.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.47.0` | `0.52.1` |
| [httptools](https://github.com/MagicStack/httptools) | `0.7.1` | `0.8.0` |
| [apscheduler](https://github.com/agronholm/apscheduler) | `3.11.2` | `3.11.3` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.31` | `0.0.32` |
| [prometheus-client](https://github.com/prometheus/client_python) | `0.25.0` | `0.26.0` |
| [docker](https://github.com/docker/docker-py) | `7.1.0` | `7.2.0` |
| [tzdata](https://github.com/python/tzdata) | `2026.2` | `2026.3` |
| [annotated-doc](https://github.com/fastapi/annotated-doc) | `0.0.4` | `0.0.5` |
| [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.5.20` | `2026.7.22` |
| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.1` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |
| [click](https://github.com/pallets/click) | `8.4.1` | `8.4.2` |
| [idna](https://github.com/kjd/idna) | `3.16` | `3.18` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.4` | `2.48.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.4.1` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |
| [tzlocal](https://github.com/regebro/tzlocal) | `5.3.1` | `5.4.4` |


Updates `fastapi` from 0.136.1 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.1...0.141.1)

Updates `uvicorn` from 0.47.0 to 0.52.1
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.47.0...0.52.1)

Updates `httptools` from 0.7.1 to 0.8.0
- [Release notes](https://github.com/MagicStack/httptools/releases)
- [Commits](MagicStack/httptools@v0.7.1...v0.8.0)

Updates `apscheduler` from 3.11.2 to 3.11.3
- [Release notes](https://github.com/agronholm/apscheduler/releases)
- [Commits](agronholm/apscheduler@3.11.2...3.11.3)

Updates `python-multipart` from 0.0.31 to 0.0.32
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.31...0.0.32)

Updates `prometheus-client` from 0.25.0 to 0.26.0
- [Release notes](https://github.com/prometheus/client_python/releases)
- [Commits](prometheus/client_python@v0.25.0...v0.26.0)

Updates `docker` from 7.1.0 to 7.2.0
- [Release notes](https://github.com/docker/docker-py/releases)
- [Commits](docker/docker-py@7.1.0...7.2.0)

Updates `tzdata` from 2026.2 to 2026.3
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.2...2026.3)

Updates `annotated-doc` from 0.0.4 to 0.0.5
- [Release notes](https://github.com/fastapi/annotated-doc/releases)
- [Changelog](https://github.com/fastapi/annotated-doc/blob/main/release-notes.md)
- [Commits](fastapi/annotated-doc@0.0.4...0.0.5)

Updates `annotated-types` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/annotated-types/annotated-types/releases)
- [Commits](annotated-types/annotated-types@v0.7.0...v0.8.0)

Updates `anyio` from 4.13.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.2)

Updates `certifi` from 2026.5.20 to 2026.7.22
- [Commits](certifi/python-certifi@2026.05.20...2026.07.22)

Updates `cffi` from 2.0.0 to 2.1.1
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v2.0.0...v2.1.1)

Updates `charset-normalizer` from 3.4.7 to 3.4.9
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.7...3.4.9)

Updates `click` from 8.4.1 to 8.4.2
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.1...8.4.2)

Updates `idna` from 3.16 to 3.18
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.16...v3.18)

Updates `pydantic-core` from 2.46.4 to 2.48.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@core-v2.46.4...core-v2.48.0)

Updates `starlette` from 1.3.1 to 1.4.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.4.1)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

Updates `tzlocal` from 5.3.1 to 5.4.4
- [Changelog](https://github.com/regebro/tzlocal/blob/master/CHANGES.txt)
- [Commits](regebro/tzlocal@5.3.1...5.4.4)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.52.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: httptools
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: apscheduler
  dependency-version: 3.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: prometheus-client
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: docker
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tzdata
  dependency-version: '2026.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: annotated-doc
  dependency-version: 0.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: annotated-types
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cffi
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: click
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: idna
  dependency-version: '3.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pydantic-core
  dependency-version: 2.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: starlette
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tzlocal
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added automated Opened automatically by a bot dependencies Pull requests that update a dependency file labels Aug 10, 2026
GeiserX added 2 commits August 10, 2026 17:25
@GeiserX
deps: update uv.lock to match, hold pydantic-core at the stable-pinne…
5664f02 
…d version

requirements.txt is a pinned export of uv.lock (the lockfile is what CI
and the Docker image install), so a bump that edits only requirements.txt
fails test_it_matches_the_lockfile by design. The lock now carries the
same upgrades, regenerated with the documented
  uv export --no-dev --no-hashes --format requirements-txt

One deliberate deviation: pydantic-core stays at 2.46.4 instead of the
proposed 2.48.0. Stable pydantic pins its core exactly, so forcing
2.48.0 drags pydantic itself to the 2.14.0b1 BETA prerelease — a
minor-and-patch group must not ship a beta. pydantic-core follows
whenever pydantic's next stable lands.

Verified locally against the new resolution: full suite 4588 passed
(6 skipped), coverage >= 90, ruff clean; docker-py 7.2.0 still exposes
the cpu_shares run kwarg (PR #317 depends on it).
@GeiserX
deps: keep the GENERATED header on the requirements export
a043db9 
The raw uv-export output replaced the repo's do-not-edit-by-hand header
with uv's own; test_it_says_it_is_generated exists precisely to stop the
file drifting back into a hand-edited second opinion.
@GeiserX

GeiserX commented Aug 10, 2026

Copy link
Copy Markdown
Owner

Fixed the failing check and verified the whole set locally:

  • Why CI was red: requirements.txt is a pinned export of uv.lock (CI and the Docker image install from the lock), so a bump that edits only requirements.txt fails test_it_matches_the_lockfile by design. The lock now carries the same upgrades, and the export is regenerated with the documented command (GENERATED header preserved).
  • One deliberate deviation: pydantic-core stays at 2.46.4 instead of 2.48.0. Stable pydantic pins its core exactly, so forcing 2.48.0 drags pydantic itself to the 2.14.0b1 beta prerelease — a minor-and-patch group must not ship a beta. pydantic-core will follow when pydantic's next stable lands.
  • Tested against the new resolution locally: full suite 4587+ passed / 6 skipped with coverage ≥90, ruff clean, and docker-py 7.2.0 still exposes the cpu_shares run kwarg (feat(worker): add cpu_shares resource control to protect earners under host contention #317 depends on it).

@GeiserX
GeiserX merged commit c625284 into main Aug 10, 2026
7 checks passed
@GeiserX
GeiserX deleted the dependabot/pip/minor-and-patch-fbdfb55095 branch August 10, 2026 15:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated Opened automatically by a bot dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@GeiserX