build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.47

[dependabot]

Updates the requirements on uvicorn to permit the latest version.

Release notes

Sourced from uvicorn's releases.

Version 0.46.0

What's Changed

• Support ws_max_size in wsproto implementation by @​Kludex in Kludex/uvicorn#2915
• Support ws_ping_interval and ws_ping_timeout in wsproto implementation by @​Kludex in Kludex/uvicorn#2916
• Use bytearray for incoming WebSocket message buffer in websockets-sansio by @​Kludex in Kludex/uvicorn#2917

Full Changelog: Kludex/uvicorn@0.45.0...0.46.0

Changelog

Sourced from uvicorn's changelog.

0.46.0 (April 23, 2026)

Added

• Support ws_max_size in wsproto implementation (#2915)
• Support ws_ping_interval and ws_ping_timeout in wsproto implementation (#2916)

Changed

• Use bytearray for incoming WebSocket message buffer in websockets-sansio (#2917)

0.45.0 (April 21, 2026)

Added

• Add --reset-contextvars flag to isolate ASGI request context (#2912)
• Accept os.PathLike for log_config (#2905)
• Accept log_level strings case-insensitively (#2907)

Changed

• Revert "Emit http.disconnect on server shutdown for streaming responses" (#2913)
• Revert "Explicitly start ASGI run with empty context" (#2911)

Fixed

• Preserve forwarded client ports in proxy headers middleware (#2903)
• Raise helpful ImportError when PyYAML is missing for YAML log config (#2906)

0.44.0 (April 6, 2026)

Added

• Implement websocket keepalive pings for websockets-sansio (#2888)

0.43.0 (April 3, 2026)

You can quit Uvicorn now. We heard you, @​pamelafox - all 47 of your Ctrl+C's (thanks for flagging it, and thanks to @​tiangolo for the fix 🙏). See the tweet.

Changed

• Emit http.disconnect ASGI receive() event on server shutting down for streaming responses (#2829)
• Use native context parameter for create_task on Python 3.11+ (#2859)
• Drop cast in ASGI types (#2875)

0.42.0 (March 16, 2026)

Changed

• Use bytearray for request body accumulation to avoid O(n^2) allocation on fragmented bodies (#2845)

... (truncated)

Commits

• b224045 Version 0.46.0 (#2918)
• 7375b5b Use bytearray for incoming WebSocket message buffer in websockets-sansio (#...
• d438fb1 Support ws_ping_interval and ws_ping_timeout in wsproto implementation ...
• 3e6b964 Support ws_max_size in wsproto implementation (#2915)
• 2c423bd Version 0.45.0 (#2914)
• 7f027f8 Revert "Emit http.disconnect on server shutdown for streaming responses" (#...
• 73a80c3 Add --reset-contextvars flag to isolate ASGI request context (#2912)
• 45c0b56 Revert empty context for ASGI runs (#2911)
• 850d926 Raise helpful ImportError when PyYAML is missing for YAML log config (#2906)
• fdcacb4 Accept log_level strings case-insensitively (#2907)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Updated server dependency to use a flexible version range, enabling compatibility with recent releases while maintaining stability.

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Walkthrough

The uvicorn dependency version constraint in pyproject.toml is updated from caret-pinned ^0.44.0 to an explicit range >=0.44,<0.47, expanding version compatibility while maintaining the standard extras.

Changes

Dependency Version Constraint

Layer / File(s)	Summary
Dependency Version Update pyproject.toml	uvicorn constraint changed from ^0.44.0 to >=0.44,<0.47, broadening version compatibility within minor/patch releases.

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately summarizes the main change: updating the uvicorn dependency constraint from ^0.44.0 to >=0.44,<0.47, which is the sole modification in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/pip/uvicorn-gte-0.44-and-lt-0.47

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pyproject.toml`:
- Line 12: The uvicorn version constraint was broadened to ">=0.44,<0.47" (the
uvicorn spec in pyproject.toml); add CI/test matrix entries to run the test
suite against 0.44.*, 0.45.*, and 0.46.* and add or update unit/integration
tests covering the http.disconnect event handling and ASGI run-context/lifespan
behaviors (simulate client disconnects and ensure background tasks/contexts
behave as expected) so any incompatibility introduced in 0.45.0 is caught; if
tests fail, either add compatibility shims where the code handles
http.disconnect and ASGI run context or restrict the version constraint
accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: a01f3704-bdd0-4c28-bd10-c044fcac1531

📥 Commits

Reviewing files that changed from the base of the PR and between 9496795 and 500e137.

📒 Files selected for processing (1)

• pyproject.toml

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify uvicorn versions and security advisories

# Check PyPI for available uvicorn versions in the 0.44-0.46 range
echo "=== Available uvicorn versions ==="
curl -s https://pypi.org/pypi/uvicorn/json | jq -r '.releases | keys[]' | grep -E '^0\.(44|45|46)\.' | sort -V

# Check latest version
echo -e "\n=== Latest uvicorn version ==="
curl -s https://pypi.org/pypi/uvicorn/json | jq -r '.info.version'

# Check for security advisories
echo -e "\n=== Security advisories for uvicorn ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: PIP, package: "uvicorn") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: cryptoxdog/l9-codegraph

Length of output: 639

---

Broadened uvicorn version constraint is valid; test for compatibility with reverted changes.

The versions in the constraint >=0.44,<0.47 (0.44.0, 0.45.0, 0.46.0) all exist on PyPI and have no known security vulnerabilities. However, since this broadens the allowed range from patch updates only to minor updates through 0.46.x, ensure your test suite verifies compatibility with the reverted changes in 0.45.0 (http.disconnect emission, ASGI run context modifications) to avoid runtime issues.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pyproject.toml` at line 12, The uvicorn version constraint was broadened to
">=0.44,<0.47" (the uvicorn spec in pyproject.toml); add CI/test matrix entries
to run the test suite against 0.44.*, 0.45.*, and 0.46.* and add or update
unit/integration tests covering the http.disconnect event handling and ASGI
run-context/lifespan behaviors (simulate client disconnects and ensure
background tasks/contexts behave as expected) so any incompatibility introduced
in 0.45.0 is caught; if tests fail, either add compatibility shims where the
code handles http.disconnect and ASGI run context or restrict the version
constraint accordingly.

[dependabot]

Superseded by #23.