Bump the production-version-updates group with 6 updates

[dependabot]

Bumps the production-version-updates group with 6 updates:

Package	From	To
fastapi	0.137.0	0.138.0
pydantic-settings	2.14.1	2.14.2
sqlalchemy	2.0.50	2.0.51
anyio	4.13.0	4.14.0
certifi	2026.5.20	2026.6.17
greenlet	3.5.1	3.5.2

Updates fastapi from 0.137.0 to 0.138.0

Release notes

Sourced from fastapi's releases.

0.138.0

Features

• ✨ Add support for app.frontend("/", directory="dist") and router.frontend("/", directory="dist"). PR #15800 by @​tiangolo.
  • Read the docs: Frontend.

Docs

• 📝 Fix typo in release notes. PR #15807 by @​tiangolo.
• 📝 Add app.frontend() instructions to Agent Library Skill. PR #15805 by @​tiangolo.
• 📝 Update release notes link. PR #15802 by @​tiangolo.
• ✏️ Update white space characters in bigger apps. PR #15801 by @​tiangolo.
• ✏️ Fix grammar, typos, and broken links in docs. PR #15694 by @​YuriiMotov.

Translations

• 🌐 Enable Hindi docs translations. PR #15554 by @​YuriiMotov.

Internal

• 🐛 Fix failing test, update format for raised errors. PR #15804 by @​tiangolo.
• 👷 Fix test-alls-green. PR #15803 by @​tiangolo.
• 🔧 Enable checking release-notes.md for typos. PR #15796 by @​YuriiMotov.
• 📝 Tweak wording about deploying to FastAPI Cloud. PR #15793 by @​tiangolo.
• 🔨 Use gpt-5.5 model in translate.py, specify -chat to avoid warnings. PR #15792 by @​YuriiMotov.

0.137.2

Features

• ✨ Add iter_route_contexts() for advanced use cases that used to use router.routes (e.g. Jupyverse). PR #15785 by @​tiangolo.

Translations

• 🌐 Fix broken Markdown in Korean custom response docs. PR #15774 by @​kooqooo.
• 🌐 Update translations for fr (update-outdated). PR #15761 by @​tiangolo.
• 🌐 Update translations for zh-hant (update-outdated). PR #15760 by @​tiangolo.
• 🌐 Update translations for de (update-outdated). PR #15759 by @​tiangolo.
• 🌐 Update translations for ko (update-outdated). PR #15757 by @​tiangolo.
• 🌐 Update translations for uk (update-outdated). PR #15756 by @​tiangolo.
• 🌐 Update translations for zh (update-outdated). PR #15755 by @​tiangolo.
• 🌐 Update translations for tr (update-outdated). PR #15754 by @​tiangolo.
• 🌐 Update translations for pt (update-outdated). PR #15753 by @​tiangolo.
• 🌐 Update translations for es (update-outdated). PR #15752 by @​tiangolo.
• 🌐 Update translations for ja (update-outdated). PR #15751 by @​tiangolo.
• 🌐 Update translations for ru (update-outdated). PR #15758 by @​tiangolo.

Internal

• 🔧 Update sponsors: add BairesDev. PR #15787 by @​tiangolo.
• 🔨 Update sponsors script to simplify previews. PR #15786 by @​tiangolo.

... (truncated)

Commits

• 4b83b0d 🔖 Release version 0.138.0 (#15808)
• 041cb0c 📝 Update release notes
• 1039384 📝 Fix typo in release notes (#15807)
• 0303491 📝 Update release notes
• 190f6e2 📝 Add Frontend instructions to Agent Library Skill (#15805)
• 17945e5 📝 Update release notes
• 2260afa 🐛 Fix failing test, update format for raised errors (#15804)
• 0cd5001 📝 Update release notes
• 7cb1ab6 👷 Fix test-alls-green (#15803)
• 9c7eceb 📝 Update release notes
• Additional commits viewable in compare view

Updates pydantic-settings from 2.14.1 to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

• Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @​hramezani in pydantic/pydantic-settings#889
• Prepare release 2.14.2 by @​hramezani in pydantic/pydantic-settings#890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

Commits

• d703bd7 Prepare release 2.14.2 (#890)
• See full diff in compare view

Updates sqlalchemy from 2.0.50 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

• [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

  References: #13207

• [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

  References: #13356

engine

• [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

  References: #9427

sql

• [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

  References: #10827

... (truncated)

Commits

• See full diff in compare view

Updates anyio from 4.13.0 to 4.14.0

Release notes

Sourced from anyio's releases.

4.14.0

• Added support for Python 3.15

• Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

• Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

• Added support for custom capacity limiters in async path and file I/O functions and classes

• Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

• Changed TaskGroup.start_soon() to return a TaskHandle

• Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

• Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

• Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

• Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

• Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

• Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

  • TaskGroup.start_soon()
  • TaskGroup.start()
  • anyio.from_thread.run()

  This reverts an earlier change from v3.7.0 which was made in error. (#1153)

• Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

• Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

  • anyio.CancelScope
  • anyio.CapacityLimiter
  • anyio.Condition
  • anyio.Event
  • anyio.Lock
  • anyio.ResourceGuard
  • anyio.Semaphore

• Fixed cancellation exception escaping a cancel scope when triggered via check_cancelled() in a worker thread (#1113)

• Fixed TaskGroup raising AttributeError instead of a clear error when entered more than once (#1109; PR by @​bahtya)

• Fixed lost type information when passing arguments to lru_cache (#1104; PR by @​Graeme22)

• Fixed test resumption after KeyboardInterrupt in async generator fixtures on the asyncio backend (#1060; PR by @​EmmanuelNiyonshuti)

... (truncated)

Commits

• ffe9133 Bumped up the version
• f8b9f01 Fixed asyncio lock waiter deadlocks after cancellation (#1145)
• d517ee1 [pre-commit.ci] pre-commit autoupdate (#1176)
• 550b68e Make anyio.run support Awaitable at runtime on all backends (#1171)
• 29a5e04 Fixed FastAPI test run
• 4d752ac Updated downstream test setups for FastAPI and Anthropic MCP
• ebdc950 Added task handle support to start() and start_soon() (#1153)
• f32bfb8 Fixed test suite compatibility issues with Pytest 9.1.0
• 85f7e8e Added __slots__ to several classes
• b7ea84c [pre-commit.ci] pre-commit autoupdate (#1165)
• Additional commits viewable in compare view

Updates certifi from 2026.5.20 to 2026.6.17

Commits

• d0ac52f 2026.06.17 (#418)
• d46de62 Bump actions/checkout from 6.0.2 to 6.0.3 (#417)
• 6c183ec fix: update Requests docs link to canonical URL (#415)
• 36e3568 Bump dessant/lock-threads from 6.0.0 to 6.0.2
• See full diff in compare view

Updates greenlet from 3.5.1 to 3.5.2

Changelog

Sourced from greenlet's changelog.

3.5.2 (2026-06-17)

• The minimum supported version of Python 3.15 is now 3.15b2.
• Fix some garbage-collection related crashes on free-threaded Python 3.15. Thanks to Kumar Aditya in PR [#511](https://github.com/python-greenlet/greenlet/issues/511) <https://github.com/python-greenlet/greenlet/pull/511>_.
• Improve garbage collection of greenlets. This mostly applies to Python 3.15. Thanks to Kumar Aditya in PR [#512](https://github.com/python-greenlet/greenlet/issues/512) <https://github.com/python-greenlet/greenlet/pull/512>_.

Commits

• 0b64e9c Preparing release 3.5.2
• 3e28d27 Add change note for #512 [skip ci]
• 6563c5e Merge pull request #512 from kumaraditya303/ft-mem
• ab6eff6 add ignore for win 3.10
• 41f5349 revert back to fails_leakcheck_on_py314_or_less
• b0aac05 set fail-fast=false and if condition correctly
• 2f87f31 rename to ignores_leakcheck_on_py314_or_less
• 28bbde3 add comments
• 35206b8 fix test and restrict tp_is_gc < 3.15
• abdbab5 fix gil enabled
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}