Bump the minor-and-patch group across 1 directory with 18 updates by dependabot[bot] · Pull Request #31 · eslam5464/Fastapi-Template

dependabot · 2026-07-30T17:04:13Z

Bumps the minor-and-patch group with 18 updates in the / directory:

Package	From	To
aiohttp	`3.13.2`	`3.14.3`
alembic	`1.17.1`	`1.18.5`
b2sdk	`2.10.1`	`2.12.0`
fastapi	`0.121.0`	`0.140.6`
httptools	`0.7.1`	`0.8.0`
pre-commit	`4.3.0`	`4.6.1`
psycopg	`3.3.2`	`3.3.4`
pydantic	`2.12.3`	`2.13.4`
pydantic-settings	`2.11.0`	`2.14.2`
pyjwt	`2.10.1`	`2.13.0`
python-multipart	`0.0.20`	`0.0.32`
yarl	`1.22.0`	`1.24.5`
resend	`2.23.0`	`2.35.0`
firebase-admin	`7.1.0`	`7.5.0`
gcloud-aio-storage	`9.6.1`	`9.6.4`
anyio	`4.11.0`	`4.14.2`
pytest-cov	`7.0.0`	`7.1.0`
ruff	`0.15.22`	`0.16.0`

Updates aiohttp from 3.13.2 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

Related issues and pull requests on GitHub: :issue:13180.

Fixed error message construction in the C HTTP parser -- by :user:bdraco.

Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

Related issues and pull requests on GitHub: :issue:5303.

Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

5e392ce Release v3.14.3 (#13225)
49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
d93f30a Bump version (#13202)
c1b9212 Release v3.14.2 (#13201)
380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
Additional commits viewable in compare view

Updates alembic from 1.17.1 to 1.18.5

Release notes

Sourced from alembic's releases.

1.18.5

Released: June 25, 2026

usecase

[usecase] [commands] Added --splice support to the merge() command. Previously, the merge command would suggest using --splice when attempting to merge non-head revisions, but the flag was not actually accepted by the command. The splice parameter is now available in both the command-line interface and the command.merge() function, matching the existing support in command.revision(). Pull request courtesy Kadir Can Ozden.

References: #1712

[usecase] [environment] Added ScriptDirectory.get_heads.consider_depends_on parameter to ScriptDirectory.get_heads(). When set to True, head revisions that are also a dependency of another revision via depends_on are excluded from the result, matching the effective heads that would be present in the alembic_version table after running all upgrades.

References: #1806

bug

[bug] [autogenerate] Fixed rendering of dialect keyword arguments containing ~sqlalchemy.schema.Column objects within sequences, such as postgresql_include. These were previously rendered using repr(), producing invalid Python in the generated migration scripts. Column objects within list or tuple values are now correctly rendered as their string column names. Pull request courtesy Ajay Singh.

References: #1258

[bug] [mysql] Implemented type comparison for ENUM datatypes on MySQL, which checks that the individual enum values are equivalent. If additional entries are on either side, this generates a diff. Changes of order do not generate a diff. Pull request courtesy Furkan Köykıran.

References: #1745, #779

[bug] [operations] Fixed bug where the inline_references parameter of Operations.add_column() did not include foreign key referential actions such as ON DELETE, ON UPDATE, DEFERRABLE, INITIALLY, and MATCH when rendering the inline REFERENCES clause.

... (truncated)

Commits

See full diff in compare view

Updates b2sdk from 2.10.1 to 2.12.0

Release notes

Sourced from b2sdk's releases.

2.12.0

Removed

Drop support for Python 3.9 and PyPy 3.9.

Infrastructure

Upgrade test dependencies versions.

2.11.0

Fixed

Handle null case when encoding / decoding content_sha1 in BaseFileVersion. (#553)

Fix SqliteAccountInfo to explicitly close temporary sqlite connections used during setup, add a close() method for cached connection.

Added

Declare official support for Python 3.14 and include it in the CI test matrix.

Introduce a reusable validator to ensure remote B2 file names are safe to use as local paths.

Infrastructure

Bump tornado dependency from 6.5.4 to 6.5.5.

2.10.4

Fixed

Fixed a retry bug in upload_unbound_stream() small-file uploads where a retryable upload error could cause a one-shot buffered stream to be reopened after it was closed, raising ValueError: I/O operation on closed file.

Infrastructure

Add exponential retries for bucket creation in testing.helpers.BucketManager.

Fix redudant files in the sdist after migrating from pdm to uv.

2.10.3

Fixed

Address backwards compatibility issue for sqlite account info caused by the migration of schema to a new multi-bucket format.

Avoid http-level retries during upload requests.

Use stat.S_ISDIR check for local folder children scanning instead of Path.is_dir to account for an api change in Python 3.14.

Infrastructure

Bump pip version.

Migrate from pdm to uv.

Move pytest_plugins to top-level conftest (fix for newer pytest).

Set temporary directory as account info config dir in tests.

Use a separate nox dependency group for reprocible installs of nox in ci / cd.

... (truncated)

Changelog

Sourced from b2sdk's changelog.

2.12.0 - 2026-05-05

Removed

Drop support for Python 3.9 and PyPy 3.9.

Infrastructure

Upgrade test dependencies versions.

2.11.0 - 2026-05-01

Fixed

Handle null case when encoding / decoding content_sha1 in BaseFileVersion. (#553)

Fix SqliteAccountInfo to explicitly close temporary sqlite connections used during setup, add a close() method for cached connection.

Added

Declare official support for Python 3.14 and include it in the CI test matrix.

Introduce a reusable validator to ensure remote B2 file names are safe to use as local paths.

Infrastructure

Bump tornado dependency from 6.5.4 to 6.5.5.

2.10.4 - 2026-03-03

Fixed

Fixed a retry bug in upload_unbound_stream() small-file uploads where a retryable upload error could cause a one-shot buffered stream to be reopened after it was closed, raising ValueError: I/O operation on closed file.

Infrastructure

Add exponential retries for bucket creation in testing.helpers.BucketManager.

Fix redudant files in the sdist after migrating from pdm to uv.

2.10.3 - 2026-02-23

Fixed

Address backwards compatibility issue for sqlite account info caused by the migration of schema to a new multi-bucket format.

Avoid http-level retries during upload requests.

... (truncated)

Commits

9827cf3 release 2.12.0
d4b0890 Merge pull request #570 from Backblaze/sec-updates
cdadf81 Restrict pydantic version for PyPy 3.10
049e6ed Remove obsolete pdm.lock file
389674f Upgrade test dependencies versions, address subtest serialization
be49f2b Drop support for Python 3.9 and PyPy 3.9, update deps.
9cb432b release 2.11.0
38e7da8 Merge pull request #569 from Backblaze/filepath-validation
c02fa49 Add reusable validator to ensure local safety of remote B2 file names
5687321 Merge pull request #567 from Backblaze/python3.14
Additional commits viewable in compare view

Updates fastapi from 0.121.0 to 0.140.6

Release notes

Sourced from fastapi's releases.

0.140.6

Refactors

⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #16073 by @tiangolo.

0.140.5

Refactors

⚡️ Avoid flattening dependencies for body fields. PR #16071 by @tiangolo.

0.140.4

Refactors

⚡️ Skip unused dependency repeat bookkeeping. PR #16069 by @tiangolo.

0.140.3

Refactors

⚡️ Avoid repeated dependency flattening in OpenAPI. PR #16067 by @tiangolo.

0.140.2

Refactors

⚡️ Stop retaining flat dependency trees. PR #16065 by @tiangolo.

Internal

👷 Add new memory benchmark. PR #16064 by @tiangolo.

0.140.1

Refactors

♻️ Update the lru_cache limit for dependencies to account for large apps. PR #16062 by @tiangolo.

0.140.0

Refactors

⚡️ Reduce memory usage in dependencies. PR #16049 by @tiangolo.

Docs

📝 Fix links in docs. PR #15967 by @YuriiMotov.

📝 Add Library Skills documentation. PR #16041 by @tiangolo.

📝 Update docs to use uv projects by default. PR #16032 by @tiangolo.

📝 Restructure FastAPI People and related pages. PR #16015 by @tiangolo.

Internal

👷 Add CI memory benchmark. PR #16046 by @tiangolo.

👥 Update FastAPI People - Sponsors. PR #16027 by @tiangolo.

... (truncated)

Commits

bcd4e89 🔖 Release version 0.140.6 (#16074)
27c922c 📝 Update release notes
cc96fd3 ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI (...
ac068db 🔖 Release version 0.140.5 (#16072)
6be87d1 📝 Update release notes
23e4a10 ⚡️ Avoid flattening dependencies for body fields (#16071)
7ac0f1b 🔖 Release version 0.140.4 (#16070)
44e4eea 📝 Update release notes
7134121 ⚡️ Skip unused dependency repeat bookkeeping (#16069)
415d37f 🔖 Release version 0.140.3 (#16068)
Additional commits viewable in compare view

Updates httptools from 0.7.1 to 0.8.0

Release notes

Sourced from httptools's releases.

v0.8.0

Changes

Add http-parser and llhttp licenses into the wheels (#135) (by @justeph in c398a157)

Mark cython module as free-threading compatible (#139) (by @kumaraditya303 in 28d1db15)

Fix all typing issues (#134) (by @Kludex in a9bda0ed)

Bump llhttp to 9.4.1 (#145) (by @fantix in e3e8d71e)

Security: fix URL truncation issue (#144) (by @fantix in a0283f07 for #142)

Allow building with latest setuptools (#138) (by @OldManYellsAtCloud in c403ad1a)

Commits

cf10ce6 httptools 0.8.0
a0283f0 security: fix URL truncation issue (#144)
05e6b8e ci: add freethreading 3.14 to the CI matrix (#146)
e3e8d71 Bump llhttp to 9.4.1 (#145)
a9bda0e Fix all typing issues (#134)
28d1db1 mark cython module as free-threading compatible (#139)
c403ad1 Allow building with latest setuptools (#138)
c398a15 Add http-parser and llhttp licenses into the wheels (#135)
4cfdabd ci: fix release workflow (#132)
ef71da9 Post-release version bump
See full diff in compare view

Updates pre-commit from 4.3.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

pre-commit v4.6.0

Features

pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

#3662 PR by @asottile.

Fixes

pre-commit hook-impl: --hook-type is required.

#3661 PR by @asottile.

pre-commit v4.5.1

Fixes

Fix language: python with repo: local without additional_dependencies.

#3597 PR by @asottile.

pre-commit v4.5.0

Features

Add pre-commit hazmat.

#3585 PR by @asottile.

pre-commit v4.4.0

Features

Add --fail-fast option to pre-commit run.

#3528 PR by @JulianMaurin.

Upgrade ruby-build / rbenv.

#3566 PR by @asottile.

#3565 issue by @MRigal.

Add language: unsupported / language: unsupported_script as aliases for language: system / language: script (which will eventually be deprecated).

#3577 PR by @asottile.

Add support docker-in-docker detection for cgroups v2.

#3535 PR by @br-rhrbacek.

#3360 issue by @JasonAlt.

... (truncated)

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

4.6.0 - 2026-04-21

Features

pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

#3662 PR by @asottile.

Fixes

pre-commit hook-impl: --hook-type is required.

#3661 PR by @asottile.

4.5.1 - 2025-12-16

Fixes

Fix language: python with repo: local without additional_dependencies.

#3597 PR by @asottile.

4.5.0 - 2025-11-22

Features

Add pre-commit hazmat.

#3585 PR by @asottile.

4.4.0 - 2025-11-08

... (truncated)

Commits

242ce8a v4.6.1
766e550 Merge pull request #3727 from pre-commit/dedupe
1558d06 Merge pull request #3726 from pre-commit/exists-faster
8a1c47a avoid duplicate files in --all-files during conflict
2e01c99 faster check of rev existing locally as a commit
3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
1d811d9 Return an error for invalid --repo
374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
1e7994f set JULIA_DEPOT_PATH
b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
Additional commits viewable in compare view

Updates psycopg from 3.3.2 to 3.3.4

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.5 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).

Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).

Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).

Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Current release

Psycopg 3.3.4 ^^^^^^^^^^^^^

Fix possible spurious connection timeout in systems with very long uptimes in C extension (:ticket:[#1280](https://github.com/psycopg/psycopg/issues/1280)).

Fix client-side adaptation of enums whose name require quotes (:ticket:[#1298](https://github.com/psycopg/psycopg/issues/1298)).

Consistently populate ~Cursor.statusmessage after ~Cursor.executemany() (:ticket:[#1302](https://github.com/psycopg/psycopg/issues/1302)).

Psycopg 3.3.3 ^^^^^^^^^^^^^

Retain Error.pgconn when raising a single exception for multiple connection attempt errors (:ticket:[#1246](https://github.com/psycopg/psycopg/issues/1246)).

Return a proper error when server sends ErrorResponse for a Sync after a Parse (:ticket:[#1260](https://github.com/psycopg/psycopg/issues/1260)).

Psycopg 3.3.2

... (truncated)

Commits

83f1103 chore: bump psycopg_pool package version to 3.3.1
1828770 chore: bump psycopg package version to 3.3.4
8be14bb Merge pull request #1301 from oliverhaas/fix/sync-pool-open-race
aee0bf2 fix(pool): fix race in the construction of the sync ConnectionPool lock
bc4d303 chore(deps): bump the actions group across 1 directory with 4 updates
785379f fix: retain statusmessage after executemany with returning=False
8882a73 perf: do less if X in Y: return Y[X] for cache-like patterns
2f78539 Merge pull request #1299 from dvarrazzo/fix-camel-enum
37ef1dc test: skip test on crdb depending on precise regtype behaviour
7f2f1d1 fix: fix client-side representation of enums requiring quotes
Additional commits viewable in compare view

Updates pydantic from 2.12.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Bump libc from 0.2.155 to 0.2.185 by @Viicos in #13109

Adapt pydantic-core linker flags on macOS by @washingtoneg and @Viicos in #13147

Fixes

Preserve RootModel core metadata by @Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

Handle AttributeError subclasses with from_attributes by @Viicos in #13096

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

Fix ValidationInfo.field_name missing with model_validate_json() by @Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

v2.13.1 (2026-04-15)

What's Changed

Fixes

Fix ValidationInfo.data missing with model_validate_json() by @davidhewitt in #13079

Full Changelog: pydantic/pydantic@v2.13.0...v2.13.1

v2.13.0 2026-04-13

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Bump libc from 0.2.155 to 0.2.185 by @Viicos in #13109

Adapt pydantic-core linker flags on macOS by @washingtoneg and @Viicos in #13147

Fixes

Preserve RootModel core metadata by @Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

Handle AttributeError subclasses with from_attributes by @Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

Fix ValidationInfo.field_name missing with model_validate_json() by @Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

Fix ValidationInfo.data missing with model_validate_json() by @davidhewitt in #13079

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits

cf67d4b Fix linting
f0d8a21 Prepare release v2.13.4
5e3fe1d Check for pydantic tag pattern in CI
7f9edcc Document tagging conventions
b46a0c9 Adapt pydantic-core linker flags on macOS
50629c8 Update to PyPy 7.3.22
8522ebb Preserve RootModel core metadata
a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
909259a Remove Logfire example in documentation
2c4174c Bump libc from 0.2.155 to 0.2.185
Additional commits viewable in compare view

Updates pydantic-settings from 2.11.0 to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @hramezani in pydantic/pydantic-settings#889

Prepare release 2.14.2 by @hramezani in pydantic/pydantic-settings#890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

v2.14.1

What's Changed

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#850

Bump the python-packages group with 5 updates by @dependabot[bot] in pydantic/pydantic-settings#854

Bump the github-actions group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#853

Bump the python-packages group with 2 updates by @dependabot[bot] in pydantic/pydantic-settings#856

Fix field named cls conflicting with classmethod parameter by @hramezani in pydantic/pydantic-settings#858

Prepare release 2.14.1 by @hramezani in pydantic/pydantic-settings#859

Full Changelog: pydantic/pydantic-settings@v2.14.0...v2.14.1

v2.14.0

What's Changed

Fix parsing env vars into Optional Strict types by @hramezani in pydantic/pydantic-settings#792

Fix RecursionError with mutually recursive models in CLI by @hramezani in pydantic/pydantic-settings#794

Fix env_file from model_config ignored in CliApp.run() (#795) by @hramezani in pydantic/pydantic-settings#796

Update dependencies by @hramezani in pydantic/pydantic-settings#798

Add Dependabot configuration by @hramezani in pydantic/pydantic-settings#801

Bump samuelcolvin/check-python-version from 4.1 to 5 by @dependabot[bot] in pydantic/pydantic-settings#802

Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in pydantic/pydantic-settings#803

Bump actions/checkout from 4 to 6 by @dependabot[bot] in pydantic/pydantic-settings#804

Bump astral-sh/setup-uv from 5 to 7 by @dependabot[bot] in pydantic/pydantic-settings#805

Bump actions/setup-python from 5 to 6 by @dependabot[bot] in pydantic/pydantic-settings#806

Ignore chardet and group GitHub Actions in Dependabot by @hramezani in pydantic/pydantic-settings#808

Bump actions/download-artifact from 4 to 8 in the github-actions group by @dependabot[bot] in pydantic/pydantic-settings#809

Bump the python-packages group with 2 updates by @dependabot[bot] in pydantic/pydantic-settings#810

Support reading .env files from FIFOs (e.g. 1Password Environments) by @JacobHayes in pydantic/pydantic-settings#776

Fix AliasChoices ignored when changing provider priority by @hramezani in pydantic/pydantic-settings#813

fix: resolve KeyError in run_subcommand for underscore field names by @bradykieffer in pydantic/pydantic-settings#799

Bump the python-packages group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#814

Fix Literal[numeric Enum] coercion for CLI and env vars by @m9810223 in pydantic/pydantic-settings#811

Fix nested discriminated unions not discovered by env/CLI providers by @hramezani in pydantic/pydantic-settings#816

Bump the python-packages group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#820

CLI ensure env nested max split internally. by @kschwab in pydantic/pydantic-settings#821

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#824

... (truncated)

Commits

d703bd7 Prepare release 2.14.2 (#890)
e95c30b Prepare release 2.14.1 (#859)
0c87345 Fix field named cls conflicting with classmethod parameter (#858)
7bd0072 Bump the python-packages group with 2 updates (#856)
b03e573 Bump the github-actions group with 3 updates (#853)
eaa3b43 Bump the python-packages group with 5 updates (#854)
9f95615 Bump the python-packages group with 4 updates (#850)
8916bee Prepare release 2.14.0 (#848)
39e551c Fix CLI descriptions lost under python -OO by falling back to `json_schema_...
9ed7f48 Bump the python-packages group with 4 updates (#847)
Additional commits viewable in compare view

Updates pyjwt from 2.10.1 to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @aradona91.

GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @sushi-gif.

GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @thesmartshadow.

GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @KEIJOT.

GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @eddieran.

Fixed

Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "")... Description has been truncated

Bumps the minor-and-patch group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.13.2` | `3.14.3` | | [alembic](https://github.com/sqlalchemy/alembic) | `1.17.1` | `1.18.5` | | [b2sdk](https://github.com/Backblaze/b2-sdk-python) | `2.10.1` | `2.12.0` | | [fastapi](https://github.com/fastapi/fastapi) | `0.121.0` | `0.140.6` | | [httptools](https://github.com/MagicStack/httptools) | `0.7.1` | `0.8.0` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.3.0` | `4.6.1` | | [psycopg](https://github.com/psycopg/psycopg) | `3.3.2` | `3.3.4` | | [pydantic](https://github.com/pydantic/pydantic) | `2.12.3` | `2.13.4` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.11.0` | `2.14.2` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.32` | | [yarl](https://github.com/aio-libs/yarl) | `1.22.0` | `1.24.5` | | [resend](https://github.com/resendlabs/resend-python) | `2.23.0` | `2.35.0` | | [firebase-admin](https://github.com/firebase/firebase-admin-python) | `7.1.0` | `7.5.0` | | [gcloud-aio-storage](https://github.com/talkiq/gcloud-aio) | `9.6.1` | `9.6.4` | | [anyio](https://github.com/agronholm/anyio) | `4.11.0` | `4.14.2` | | [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.22` | `0.16.0` | Updates `aiohttp` from 3.13.2 to 3.14.3 - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.13.2...v3.14.3) Updates `alembic` from 1.17.1 to 1.18.5 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `b2sdk` from 2.10.1 to 2.12.0 - [Release notes](https://github.com/Backblaze/b2-sdk-python/releases) - [Changelog](https://github.com/Backblaze/b2-sdk-python/blob/master/CHANGELOG.md) - [Commits](Backblaze/b2-sdk-python@v2.10.1...v2.12.0) Updates `fastapi` from 0.121.0 to 0.140.6 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.121.0...0.140.6) Updates `httptools` from 0.7.1 to 0.8.0 - [Release notes](https://github.com/MagicStack/httptools/releases) - [Commits](MagicStack/httptools@v0.7.1...v0.8.0) Updates `pre-commit` from 4.3.0 to 4.6.1 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.3.0...v4.6.1) Updates `psycopg` from 3.3.2 to 3.3.4 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.3.2...3.3.4) Updates `pydantic` from 2.12.3 to 2.13.4 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.12.3...v2.13.4) Updates `pydantic-settings` from 2.11.0 to 2.14.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.11.0...v2.14.2) Updates `pyjwt` from 2.10.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.10.1...2.13.0) Updates `python-multipart` from 0.0.20 to 0.0.32 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.20...0.0.32) Updates `yarl` from 1.22.0 to 1.24.5 - [Release notes](https://github.com/aio-libs/yarl/releases) - [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst) - [Commits](aio-libs/yarl@v1.22.0...v1.24.5) Updates `resend` from 2.23.0 to 2.35.0 - [Release notes](https://github.com/resendlabs/resend-python/releases) - [Commits](resend/resend-python@v2.23.0...v2.35.0) Updates `firebase-admin` from 7.1.0 to 7.5.0 - [Release notes](https://github.com/firebase/firebase-admin-python/releases) - [Commits](firebase/firebase-admin-python@v7.1.0...v7.5.0) Updates `gcloud-aio-storage` from 9.6.1 to 9.6.4 - [Release notes](https://github.com/talkiq/gcloud-aio/releases) - [Commits](talkiq/gcloud-aio@storage-9.6.1...storage-9.6.4) Updates `anyio` from 4.11.0 to 4.14.2 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.11.0...4.14.2) Updates `pytest-cov` from 7.0.0 to 7.1.0 - [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst) - [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0) Updates `ruff` from 0.15.22 to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.16.0) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: alembic dependency-version: 1.18.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: b2sdk dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: fastapi dependency-version: 0.140.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: httptools dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pre-commit dependency-version: 4.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: psycopg dependency-version: 3.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pydantic dependency-version: 2.13.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: python-multipart dependency-version: 0.0.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: yarl dependency-version: 1.24.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: resend dependency-version: 2.35.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: firebase-admin dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: gcloud-aio-storage dependency-version: 9.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: anyio dependency-version: 4.14.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pytest-cov dependency-version: 7.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-30T17:30:51Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026

dependabot Bot requested a review from eslam5464 as a code owner July 30, 2026 17:04

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026

dependabot Bot closed this Jul 30, 2026

dependabot Bot deleted the dependabot/uv/minor-and-patch-702963d884 branch July 30, 2026 17:30

Navigation Menu

Bump the minor-and-patch group across 1 directory with 18 updates - #31

Bump the minor-and-patch group across 1 directory with 18 updates#31
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/minor-and-patch-702963d884

dependabot Bot commented on behalf of github Jul 30, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.14.3 (2026-07-22)

Bug fixes

3.14.2 (2026-07-20)

Bug fixes

1.18.5

usecase

bug

2.12.0

Removed

Infrastructure

2.11.0

Fixed

Added

Infrastructure

2.10.4

Fixed

Infrastructure

2.10.3

Fixed

Infrastructure

2.12.0 - 2026-05-05

Removed

Infrastructure

2.11.0 - 2026-05-01

Fixed

Added

Infrastructure

2.10.4 - 2026-03-03

Fixed

Infrastructure

2.10.3 - 2026-02-23

Fixed

0.140.6

Refactors

0.140.5

Refactors

0.140.4

Refactors

0.140.3

Refactors

0.140.2

Refactors

Internal

0.140.1

Refactors

0.140.0

Refactors

Docs

Internal

v0.8.0

Changes

pre-commit v4.6.1

Fixes

pre-commit v4.6.0

Features

Fixes

pre-commit v4.5.1

Fixes

pre-commit v4.5.0

Features

pre-commit v4.4.0

Features

4.6.1 - 2026-07-21

Fixes

4.6.0 - 2026-04-21

Features

Fixes

4.5.1 - 2025-12-16

Fixes

4.5.0 - 2025-11-22

Features

4.4.0 - 2025-11-08

psycopg release notes

Future releases

Current release

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

dependabot Bot commented on behalf of github Jul 30, 2026 •

edited

Loading

`psycopg` release notes