MESH-2092 Bump the dependencies group with 4 updates

[dependabot]

Bumps the dependencies group with 4 updates: fastapi, gunicorn, coverage and starlette.

Updates fastapi from 0.128.5 to 0.128.6

Release notes

Sourced from fastapi's releases.

0.128.6

Fixes

• 🐛 Fix on_startup and on_shutdown parameters of APIRouter. PR #14873 by @​YuriiMotov.

Translations

• 🌐 Update translations for zh (update-outdated). PR #14843 by @​tiangolo.

Internal

• ✅ Fix parameterized tests with snapshots. PR #14875 by @​YuriiMotov.

Commits

• fbca586 📝 Update release notes
• 4e87979 📝 Update release notes
• 0a4033a 🔖 Release version 0.128.6
• ed2512a 🐛 Fix on_startup and on_shutdown parameters of APIRouter (#14873)
• 0c0f633 📝 Update release notes
• 227cb85 ✅ Fix parameterized tests with snapshots (#14875)
• cd31576 📝 Update release notes
• 376e108 🌐 Update translations for zh (update-outdated) (#14843)
• See full diff in compare view

Updates gunicorn from 25.0.2 to 25.0.3

Release notes

Sourced from gunicorn's releases.

25.0.3

What's Changed

Bug Fixes

• Fix RuntimeError when StopIteration raised in ASGI coroutine (#3484)
• Fix passing maxsplit in re.split() as positional argument (deprecated in Python 3.13)

Documentation

• Updated sponsorship section and homepage

Full Changelog: benoitc/gunicorn@25.0.2...25.0.3

Commits

• fc85068 chore: prepare release 25.0.3
• 787602f docs: shorten README sponsor section
• a52c81f Merge pull request #3492 from benoitc/feature/improve-sponsorship
• 1afb2b7 Merge pull request #3490 from tyrossel/master
• 2ead70d docs: add Sponsor to top-level navigation
• 874e8be docs: shorten sponsor section on homepage
• 7293b21 docs: add prominent sponsorship options
• 70d571b docs: update homepage title and remove version display
• d301d53 fix: resolve RuntimeError when StopIteration raised in ASGI coroutine
• 68abb98 fix: passing maxsplit in re.split() as positional argument is deprecated
• See full diff in compare view

Updates coverage from 7.13.3 to 7.13.4

Changelog

Sourced from coverage's changelog.

Version 7.13.4 — 2026-02-09

• Fix: the third-party code fix in 7.13.3 required examining the parent directories where coverage was run. In the unusual situation that one of the parent directories is unreadable, a PermissionError would occur, as described in issue 2129_. This is now fixed.

• Fix: in test suites that change sys.path, coverage.py could fail with "RuntimeError: Set changed size during iteration" as described and fixed in pull 2130_. Thanks, Noah Fatsi.

• We now publish ppc64le wheels, thanks to Pankhudi Jain <pull 2121_>_.

.. _pull 2121: coveragepy/coveragepy#2121 .. _issue 2129: coveragepy/coveragepy#2129 .. _pull 2130: coveragepy/coveragepy#2130

.. _changes_7-13-3:

Commits

• 4f78d57 build: no need to publish status.json
• f8616ff docs: sample HTML for 7.13.4
• fcf8c68 docs: prep for 7.13.4
• 189ecfd docs: thanks Pankhudi Jain for ppc64le wheels #2121
• 58aade0 build: add support for ppc64le architecture (#2121)
• 8ea42c8 chore: bump actions/attest-build-provenance (#2131)
• c09595f docs: Janine put a lot of effort into debugging issue #2128
• 8ee1760 docs: Greg wrote a great issue: #2129
• 76ba043 docs: thanks, Noah Fatsi
• 371fcc5 fix: set fixed paths_list in TreeMatcher init (#2130)
• Additional commits viewable in compare view

Updates starlette from 0.50.0 to 0.52.1

Release notes

Sourced from starlette's releases.

Version 0.52.1

What's Changed

• Only use typing_extensions in older Python versions by @​Kludex in Kludex/starlette#3109

---

Full Changelog: Kludex/starlette@0.52.0...0.52.1

Version 0.52.0

In this release, State can be accessed using dictionary-style syntax for improved type safety (#3036).

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from typing import TypedDict
import httpx
from starlette.applications import Starlette
from starlette.requests import Request
class State(TypedDict):
http_client: httpx.AsyncClient
@​asynccontextmanager
async def lifespan(app: Starlette) -> AsyncIterator[State]:
async with httpx.AsyncClient() as client:
yield {"http_client": client}
async def homepage(request: Request[State]):
client = request.state["http_client"]
# If you run the below line with mypy or pyright, it will reveal the correct type.
reveal_type(client)  # Revealed type is 'httpx.AsyncClient'

See Accessing State for more details.

---

Full Changelog: Kludex/starlette@0.51.0...0.52.0

Version 0.51.0

Added

• Add allow_private_network in CORSMiddleware #3065.

Changed

... (truncated)

Changelog

Sourced from starlette's changelog.

0.52.1 (January 18, 2026)

Fixed

• Only use typing_extensions in older Python versions #3109.

0.52.0 (January 18, 2026)

In this release, State can be accessed using dictionary-style syntax for improved type safety (#3036).

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from typing import TypedDict
import httpx
from starlette.applications import Starlette
from starlette.requests import Request
class State(TypedDict):
http_client: httpx.AsyncClient
@​asynccontextmanager
async def lifespan(app: Starlette) -> AsyncIterator[State]:
async with httpx.AsyncClient() as client:
yield {"http_client": client}
async def homepage(request: Request[State]):
client = request.state["http_client"]
# If you run the below line with mypy or pyright, it will reveal the correct type.
reveal_type(client)  # Revealed type is 'httpx.AsyncClient'

See Accessing State for more details.

0.51.0 (January 10, 2026)

Added

• Add allow_private_network in CORSMiddleware #3065.

Changed

• Increase warning stacklevel on DeprecationWarning for wsgi module #3082.

Commits

• e5b8a5d Version 0.52.1 (#3110)
• d02eade Only use typing_extensions in older Python versions (#3109)
• f490b42 Version 0.52.0 (#3107)
• d8c7cf9 Turn State into a Mapping (#3036)
• cfce146 chore: bump coverage (#3103)
• 9138e55 fix: setup github pages for deployment (#3102)
• aff6df7 docs: add environment for github docs (#3101)
• 434bab9 docS: fix gh pages deploy (#3100)
• 03426be docs: replace mkdocs by zensical (#3098)
• df2ee22 Version 0.51.0 (#3097)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
2931	2719	93%	85%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: c8013da by action🐍

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud