Skip to content

chore(deps): bump the backend-compatible group in /backend with 12 updates - #27

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-compatible-29d41c0d5f
Open

chore(deps): bump the backend-compatible group in /backend with 12 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-compatible-29d41c0d5f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown

Bumps the backend-compatible group in /backend with 12 updates:

Package From To
fastapi 0.139.0 0.140.13
uvicorn 0.51.0 0.52.0
httpx2 2.5.0 2.9.1
openai 2.44.0 2.50.0
annotated-doc 0.0.4 0.0.5
annotated-types 0.7.0 0.8.0
anyio 4.14.1 4.14.2
greenlet 3.5.3 3.5.4
httpcore2 2.5.0 2.9.1
pydantic-core 2.46.4 2.47.0
tqdm 4.68.3 4.70.0
websockets 16.0 16.1.1

Updates fastapi from 0.139.0 to 0.140.13

Release notes

Sourced from fastapi's releases.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

Internal

0.140.8

Fixes

0.140.6

Refactors

... (truncated)

Commits
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • e92a0dc 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints (#15937)
  • 6215d8a 📝 Update release notes
  • 12242c4 📝 Fix format_sse_event docstring rendering of \n\n terminator (#15613)
  • 70a8f3d 📝 Update release notes
  • 4f0152c 📝 Add API reference page for fastapi.sse (#15930)
  • 5f25505 🔖 Release version 0.140.12 (#16095)
  • 76e2c83 📝 Update release notes
  • 0f3e7bd 🐛 Fix line splitting in format_sse_event to comply with SSE spec (#15515)
  • Additional commits viewable in compare view

Updates uvicorn from 0.51.0 to 0.52.0

Release notes

Sourced from uvicorn's releases.

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Commits

Updates httpx2 from 2.5.0 to 2.9.1

Release notes

Sourced from httpx2's releases.

v2.9.1

What's Changed

Full Changelog: pydantic/httpx2@v2.9.0...v2.9.1

v2.9.0

What's Changed

Full Changelog: pydantic/httpx2@v2.8.0...v2.9.0

v2.8.0

What's Changed

Full Changelog: pydantic/httpx2@v2.7.0...v2.8.0

v2.7.0

This release syncs the vendored WebSocket support with the latest httpx-ws, which was previously pinned to an outdated snapshot.

What's Changed

Full Changelog: pydantic/httpx2@v2.6.0...v2.7.0

v2.6.0

The main feature in this release is support for WebSockets! 🎉

from httpx2 import AsyncClient
async with httpx2.AsyncClient() as client:
async with client.websocket("ws://localhost:8000/ws") as ws:
await ws.send_text("Hello!")
message = await ws.receive_text()

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.9.1 (July 24th, 2026)

Fixed

  • Alias httpcore imports to httpcore2 in alias_httpx(). (#1082)

2.9.0 (July 23rd, 2026)

Added

  • Add alias_httpx(), letting applications make import httpx resolve to httpx2 process-wide. (#1077)

2.8.0 (July 23rd, 2026)

No changes since 2.7.0. Version bumped to stay in lockstep with httpcore2.

2.7.0 (July 14th, 2026)

Changed

  • Update the vendored httpx-ws to upstream v0.9.0. (#1067)

2.6.0 (July 14th, 2026)

Added

  • Add native WebSocket support by vendoring httpx-ws, installable with httpx2[ws]. (#1042)
  • Add support for the QUERY HTTP method via httpx2.query() and client.query(). (#1055)

Changed

  • Allow click 8.4+ in the cli extra, dropping the upper bound. (#1040)
Commits

Updates openai from 2.44.0 to 2.50.0

Release notes

Sourced from openai's releases.

v2.50.0

2.50.0 (2026-07-28)

Full Changelog: v2.49.0...v2.50.0

Features

  • api: transcription model updates (fd57393)

Bug Fixes

  • audio: restore transcription keyword overload (713a262)

v2.49.0

2.49.0 (2026-07-27)

Full Changelog: v2.48.0...v2.49.0

Features

  • require Python 3.10 and automate version reviews (#3537) (d4c151d)

v2.48.0

2.48.0 (2026-07-23)

Full Changelog: v2.47.0...v2.48.0

Features

  • api: accept None for prompt_cache_key/safety_identifier (36820e6)
  • api: add support for spend_limit admin apis (1ff13af)

v2.47.0

2.47.0 (2026-07-21)

Full Changelog: v2.46.0...v2.47.0

Features

  • client: Add experimental runtime support for HTTPX2 clients (#3524) (317260c)
  • stlc: configurable CI runner and private-production-repo support in workflow templates (4303e97)

Bug Fixes

  • deps: require patched aiohttp on Python 3.10+ (#3515) (d4dceb2)

v2.46.0

2.46.0 (2026-07-17)

... (truncated)

Changelog

Sourced from openai's changelog.

2.50.0 (2026-07-28)

Full Changelog: v2.49.0...v2.50.0

Features

  • api: transcription model updates (fd57393)

Bug Fixes

  • audio: restore transcription keyword overload (713a262)

2.49.0 (2026-07-27)

Full Changelog: v2.48.0...v2.49.0

Features

  • require Python 3.10 and automate version reviews (#3537) (d4c151d)

2.48.0 (2026-07-23)

Full Changelog: v2.47.0...v2.48.0

Features

  • api: accept None for prompt_cache_key/safety_identifier (36820e6)
  • api: add support for spend_limit admin apis (1ff13af)

2.47.0 (2026-07-21)

Full Changelog: v2.46.0...v2.47.0

Features

  • client: Add experimental runtime support for HTTPX2 clients (#3524) (317260c)
  • stlc: configurable CI runner and private-production-repo support in workflow templates (4303e97)

Bug Fixes

  • deps: require patched aiohttp on Python 3.10+ (#3515) (d4dceb2)

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

... (truncated)

Commits
  • 4f40426 release: 2.50.0
  • 92594f1 fix(audio): restore transcription keyword overload
  • 59ed1dc feat(api): transcription model updates
  • 6ba31bc release: 2.49.0 (#3539)
  • 90483ad test: support a hermetic local API reference (#3542)
  • d4c151d feat: require Python 3.10 and automate version reviews (#3537)
  • 8a6adcb release: 2.48.0
  • cbd2fba feat(api): add support for spend_limit admin apis
  • 00709f2 feat(api): accept None for prompt_cache_key/safety_identifier
  • e67afa8 release: 2.47.0
  • Additional commits viewable in compare view

Updates annotated-doc from 0.0.4 to 0.0.5

Release notes

Sourced from annotated-doc's releases.

0.0.5

Breaking Changes

Upgrades

Docs

Internal

... (truncated)

Changelog

Sourced from annotated-doc's changelog.

0.0.5 (2026-07-28)

Breaking Changes

Upgrades

Docs

Internal

... (truncated)

Commits
  • ef48d6a 🔖 Release version 0.0.5 (#93)
  • c628000 📝 Update release notes
  • e0b4579 ➖ Drop support for Python 3.8 (#36)
  • ef956b4 📝 Update release notes
  • 84bf1e5 ⬆️ Upgrade latest-changes to 0.7.1 (#92)
  • cf773e1 📝 Update release notes
  • 1375d6e ⬆ Bump the github-actions group across 1 directory with 3 updates (#91)
  • cd37365 📝 Update release notes
  • f9f3b69 ⬆ Bump the python-packages group across 1 directory with 3 updates (#90)
  • 8420844 📝 Update release notes
  • Additional commits viewable in compare view

Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: annotated-types/annotated-types@v0.7.0...v0.8.0

Commits

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates greenlet from 3.5.3 to 3.5.4

Changelog

Sourced from greenlet's changelog.

3.5.4 (2026-07-22)

  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet that was started from a non-empty C-stack-reference state is active. See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

  • Fix a potential use-after-free on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet is suspended holding a _PyCStackRef (for example, mid attribute resolution). See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

  • Fix a deadlock on free-threaded builds when a greenlet switch happened while a PyCriticalSection was held -- for example inside asyncio's Task.__step, which holds one on the running task for the duration of the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>. Thanks to ddorian and Kumar Aditya.

.. note:: Binary 3.15 wheels are now built with Python 3.15b4. These may not be compatible with earlier or later versions of 3.15. Binary 3.15 wheels of greenlet from previous releases (e.g., 3.5.3) may not be compatible with Python 3.15b4.

Commits
  • 384be88 Preparing release 3.5.4
  • bbdf57b Add note to CHANGES about versions of 3.15 binary wheels may/not be compatibl...
  • 7599023 Merge pull request #517 from ddorian/issue515-c-stack-refs
  • 73a0a1a Fix the suspended C-stack-ref GC test to catch its regression
  • 1ff35f4 Merge branch 'master' into issue515-c-stack-refs
  • 847fb82 Merge pull request #520 from dynapx/fix-test-extension-npd
  • 0b471ba Merge pull request #519 from ddorian/freethread-switch-critical-section
  • d55914d Simplify the CHANGES.rst entry
  • 78932dc Change notes are for end users, they don't need to go into technical detail
  • 39bf70c Hold the C-stack ref snapshot in a std::vector<OwnedObject>
  • Additional commits viewable in compare view

Updates httpcore2 from 2.5.0 to 2.9.1

Release notes

Sourced from httpcore2's releases.

v2.9.1

What's Changed

Full Changelog: pydantic/httpx2@v2.9.0...v2.9.1

v2.9.0

What's Changed

Full Changelog: pydantic/httpx2@v2.8.0...v2.9.0

v2.8.0

What's Changed

  • Eliminate multi-assignment churn in the connection pool by

@dependabot
chore(deps): bump the backend-compatible group
8f19afb 
Bumps the backend-compatible group in /backend with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.140.13` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.51.0` | `0.52.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.5.0` | `2.9.1` |
| [openai](https://github.com/openai/openai-python) | `2.44.0` | `2.50.0` |
| [annotated-doc](https://github.com/fastapi/annotated-doc) | `0.0.4` | `0.0.5` |
| [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.1` | `4.14.2` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.3` | `3.5.4` |
| [httpcore2](https://github.com/pydantic/httpx2) | `2.5.0` | `2.9.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.4` | `2.47.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.68.3` | `4.70.0` |
| [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1.1` |


Updates `fastapi` from 0.139.0 to 0.140.13
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.140.13)

Updates `uvicorn` from 0.51.0 to 0.52.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.51.0...0.52.0)

Updates `httpx2` from 2.5.0 to 2.9.1
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.5.0...v2.9.1)

Updates `openai` from 2.44.0 to 2.50.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v2.44.0...v2.50.0)

Updates `annotated-doc` from 0.0.4 to 0.0.5
- [Release notes](https://github.com/fastapi/annotated-doc/releases)
- [Changelog](https://github.com/fastapi/annotated-doc/blob/main/release-notes.md)
- [Commits](fastapi/annotated-doc@0.0.4...0.0.5)

Updates `annotated-types` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/annotated-types/annotated-types/releases)
- [Commits](annotated-types/annotated-types@v0.7.0...v0.8.0)

Updates `anyio` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.1...4.14.2)

Updates `greenlet` from 3.5.3 to 3.5.4
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.3...3.5.4)

Updates `httpcore2` from 2.5.0 to 2.9.1
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Commits](pydantic/httpx2@v2.5.0...v2.9.1)

Updates `pydantic-core` from 2.46.4 to 2.47.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `tqdm` from 4.68.3 to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.3...v4.70.0)

Updates `websockets` from 16.0 to 16.1.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@16.0...16.1.1)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.140.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: uvicorn
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: httpx2
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: openai
  dependency-version: 2.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: annotated-doc
  dependency-version: 0.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-compatible
- dependency-name: annotated-types
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-compatible
- dependency-name: greenlet
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-compatible
- dependency-name: httpcore2
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: pydantic-core
  dependency-version: 2.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-compatible
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 29, 2026
@dependabot
dependabot Bot requested a review from Soturine as a code owner July 29, 2026 09:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 29, 2026
This was referenced Jul 29, 2026
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Soturine Soturine Awaiting requested review from Soturine Soturine is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants