chore(deps): bump the all-dependencies group in /backend with 4 updates

[dependabot]

Updates the requirements on cryptography, fastapi[standard], sqlalchemy and uv-build to permit the latest version.
Updates cryptography from 48.0.1 to 49.0.0

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12

* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table> 

... (truncated)

Commits

• e300bbe bump version and changelog for 49.0.0 (#15030)
• fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
• f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
• 608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
• a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
• 33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
• 6080dc7 Bump dependencies that dependabot isn't (#15026)
• 121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
• 829520b Add more robust processing for DH parameters. (#15016)
• 0f05001 Bump downstream dependencies in CI (#15025)
• Additional commits viewable in compare view

Updates fastapi[standard] to 0.137.1

Release notes

Sourced from fastapi[standard]'s releases.

0.137.1

Fixes

• 🚨 Fix typing checks for APIRoute. PR #15765 by @​tiangolo.
• 🐛 Fix bug, allow empty path in path operation in prefixless router. PR #15763 by @​tiangolo.

Commits

• a82e5f2 🔖 Release version 0.137.1 (#15766)
• edd1461 📝 Update release notes
• b78c822 🚨 Fix typing checks for APIRoute (#15765)
• e0f8cad 📝 Update release notes
• d8aad20 🐛 Fix bug, allow empty path in path operation in prefixless router (#15763)
• 9a9c4ad 🔖 Release version 0.137.0 (#15748)
• c6d5897 📝 Update release notes
• 31d097f 📝 Update release notes (#15747)
• ba609a8 📝 Update release notes
• 8e1d774 ♻️ Refactor internals to preserve APIRouter and APIRoute instances (#15745)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

• [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

  References: #13207

• [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

  References: #13356

engine

• [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

  References: #9427

sql

• [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

  References: #10827

... (truncated)

Commits

• See full diff in compare view

Updates uv-build to 0.11.21

Release notes

Sourced from uv-build's releases.

0.11.21

Release Notes

Released on 2026-06-11.

Python

• Add CPython 3.13.14 and 3.14.6 (#19787)

Preview features

• Add environment.root to uv workspace metadata --sync (#19760)
• Allow uv upgrade to update a single dependency constraint (#19738)
• Compute and pass uv workspace metadata payload in ty check (#19763)
• Make packaged applications the default for uv init (#17841)

Performance

• Add parallel discovery of Python versions for uv python list (#18684)
• Avoid normalizing source distribution names twice (#19784)

Bug fixes

• Improve cache robustness and pruning behavior
  • Allow CI cache pruning without an sdist bucket (#19802)
  • Avoid overflow when reading malformed cache entries (#19799)
  • Preserve cached Python downloads during cache pruning (#19795)
  • Reject running inside the cache (#19659)
• Fix Python discovery and version request edge cases
  • Avoid panics for Unicode Python version requests (#19797)
  • Fix handling of non-critical errors in uv python list with path requests (#19774)
  • Fix stop-discovery-at regression (#19769)
• Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
  • Allow trailing commas in version specifiers (#19806)
  • Avoid panics for invalid UTF-8 URL credentials (#19800)
  • Avoid panics for malformed source distribution filenames (#19776)
  • Avoid panics for trailing extra separators (#19779)
  • Avoid stack overflow for recursive requirements path aliases (#19777)
  • Ignore reversed string compatible-release markers (#19782)
  • Reject duplicate entries in conflict sets (#19801)
  • Reject malformed hash options in requirements files (#19783)
  • Reject source distribution filenames without a separator (#19803)
  • Use UTF-8 lengths for requirement errors (#19781)
  • Use UTF-8 lengths for trailing marker errors (#19796)
  • Use byte offsets when peeking over requirements (#19780)
  • Validate GraalPy ABI suffixes (#19805)
• Improve wheel entry-point error handling and virtual environment activation quoting
  • Propagate errors when reading wheel entry points (#19794)
  • Quote virtual environment activation paths with shell metacharacters (#19798)

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.11.21

Released on 2026-06-11.

Python

• Add CPython 3.13.14 and 3.14.6 (#19787)

Preview features

• Add environment.root to uv workspace metadata --sync (#19760)
• Allow uv upgrade to update a single dependency constraint (#19738)
• Compute and pass uv workspace metadata payload in ty check (#19763)
• Make packaged applications the default for uv init (#17841)

Performance

• Add parallel discovery of Python versions for uv python list (#18684)
• Avoid normalizing source distribution names twice (#19784)

Bug fixes

• Improve cache robustness and pruning behavior
  • Allow CI cache pruning without an sdist bucket (#19802)
  • Avoid overflow when reading malformed cache entries (#19799)
  • Preserve cached Python downloads during cache pruning (#19795)
  • Reject running inside the cache (#19659)
• Fix Python discovery and version request edge cases
  • Avoid panics for Unicode Python version requests (#19797)
  • Fix handling of non-critical errors in uv python list with path requests (#19774)
  • Fix stop-discovery-at regression (#19769)
• Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
  • Allow trailing commas in version specifiers (#19806)
  • Avoid panics for invalid UTF-8 URL credentials (#19800)
  • Avoid panics for malformed source distribution filenames (#19776)
  • Avoid panics for trailing extra separators (#19779)
  • Avoid stack overflow for recursive requirements path aliases (#19777)
  • Ignore reversed string compatible-release markers (#19782)
  • Reject duplicate entries in conflict sets (#19801)
  • Reject malformed hash options in requirements files (#19783)
  • Reject source distribution filenames without a separator (#19803)
  • Use UTF-8 lengths for requirement errors (#19781)
  • Use UTF-8 lengths for trailing marker errors (#19796)
  • Use byte offsets when peeking over requirements (#19780)
  • Validate GraalPy ABI suffixes (#19805)
• Improve wheel entry-point error handling and virtual environment activation quoting
  • Propagate errors when reading wheel entry points (#19794)
  • Quote virtual environment activation paths with shell metacharacters (#19798)

0.11.20

... (truncated)

Commits

• 5aa65dd Bump version to 0.11.21 (#19810)
• 453ab98 Fix musllinux tag priority (#19804)
• 1764c77 Validate GraalPy ABI suffixes (#19805)
• 1379b7d Compute and pass uv workspace metadata payload in ty check (#19763)
• bd6d289 Preserve cached Python downloads during cache pruning (#19795)
• 143c12f Propagate errors when reading wheel entry points (#19794)
• b2d8307 Allow trailing commas in version specifiers (#19806)
• d5c8a5f Quote virtual environment activation paths with shell metacharacters (#19798)
• 48c4357 Avoid overflow when reading malformed cache entries (#19799)
• 6353b24 Allow CI cache pruning without an sdist bucket (#19802)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions