Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 7 updates - #883

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/minor-and-patch-ec8b9e895a
Open

chore(deps): bump the minor-and-patch group across 1 directory with 7 updates#883
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/minor-and-patch-ec8b9e895a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 7 updates in the /backend directory:

Package From To
uvicorn 0.52.1 0.52.4
sqlalchemy 2.0.51 2.0.52
greenlet 3.5.4 3.5.5
resend 2.35.0 2.39.0
gunicorn 26.0.0 26.1.0
ruff 0.16.2 0.16.4
diff-cover 10.4.2 10.5.1

Updates uvicorn from 0.52.1 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Commits

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

    References: #13477

orm

  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

    References: #13439

  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

    References: #13485

  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

Updates greenlet from 3.5.4 to 3.5.5

Changelog

Sourced from greenlet's changelog.

3.5.5 (2026-08-10)

  • Link the C++ runtime statically into the Windows wheels again, as the Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported MSVCP140.dll, which no Windows CPython distribution ships, so importing greenlet failed on machines without the Visual C++ redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue and pull request by Daniel Sticker.

.. note:: Binary 3.15 wheels are now built with 3.15.0rc1. This should be compatible with future 3.15 releases and is believed compatible with 3.15b4 as well (but not earlier versions).

Commits
  • ddb1453 Preparing release 3.5.5
  • 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
  • f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
  • f1ce3ca Restore static linking of the C++ runtime for Windows wheels
  • b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
  • 726cc38 Bump the github-actions group with 3 updates
  • e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
  • be55a59 Check that the suspended greenlet is what keeps the class alive
  • e9c01dd Back to development: 3.5.5
  • See full diff in compare view

Updates resend from 2.35.0 to 2.39.0

Release notes

Sourced from resend's releases.

v2.39.0

What's Changed

Full Changelog: resend/resend-python@v2.38.0...v2.39.0

v2.38.0

What's Changed

Full Changelog: resend/resend-python@v2.37.0...v2.38.0

v2.37.0

What's Changed

Full Changelog: resend/resend-python@v2.36.0...v2.37.0

v2.36.0

What's Changed

Full Changelog: resend/resend-python@v2.35.0...v2.36.0

Commits

Updates gunicorn from 26.0.0 to 26.1.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [ are treated as patterns, so ui/*/config.json watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and ** recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (#1643, #3662).

Security

  • Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now require the first clean release; pytest and httpx were unpinned and now carry floors. The tornado example pinned tornado<6, which was both the source of several advisories and older than the >=6.5.0 the tornado worker needs, so the example could not run as pinned.

Bug Fixes

  • SIGHUP did not reload the logger configuration: Arbiter.reload() re-read the configuration file but kept using the logger built at startup, calling only reopen_files() on its existing handlers. Changes to logconfig, logconfig_dict, logconfig_json and loglevel were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (#3353).

  • Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises ChunkMissingTerminator (#3382, #3685).

  • --spew crashed on dynamically generated code: the trace hook indexed the 2-tuple returned by inspect.getsourcelines() by line number rather than indexing the list of lines, so a frame with no __file__ raised AttributeError: 'int' object has no attribute 'rstrip' on line 1 and

... (truncated)

Commits
  • 71b59a7 Merge pull request #3698 from benoitc/fix/docker-health-check-readerror
  • 48287de test: catch every transport error in the docker health check
  • 3110e8c Merge pull request #3696 from benoitc/docs/roadmap
  • cc56c41 Merge pull request #3693 from benoitc/release/26.1.0
  • 5cf1f16 docs: surface the roadmap on the site home page
  • 7e35f72 docs: add FastCGI to the roadmap and point items at Ideas
  • 18ddc58 docs: drop the framework and reverse-proxy non-goals from the roadmap
  • 1ecae56 docs: add a roadmap and make the chat easy to find
  • ca412e3 docs: sync the Latest changelog page with 26.1.0
  • 640936f docs: note the dependency security work in 26.1.0
  • Additional commits viewable in compare view

Updates ruff from 0.16.2 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Commits

Updates diff-cover from 10.4.2 to 10.5.1

Release notes

Sourced from diff-cover's releases.

Vesion 10.5.1

What's Changed

Full Changelog: Bachmann1234/diff_cover@v10.5.0...v10.5.1

Version 10.5.0

What's Changed

New Contributors

Full Changelog: Bachmann1234/diff_cover@v10.4.2...v10.5.0

Changelog

Sourced from diff-cover's changelog.

8/16/2026 v10.5.1

8/08/2026 v10.5.0

8/06/2026 v10.4.2

7/23/2026 v10.4.1

  • Handle low confidence chardet detection for undeclared encodings. Fixes a failing test for chardet 7 and upgrades the tested suite to chardet7 PR 611 (bachmann1234)

7/21/2026 v10.4.0

  • Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

  • Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

  • Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

01/08/2026 v10.2.0

12/30/2025 v10.1.0

  • Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

  • Remove python 3.9 support
  • Add python 3.14 support
  • Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

... (truncated)

Commits
  • 14f114d Version 10.5.1
  • b360113 fix: report a missing git instead of an unhandled FileNotFoundError (#620)
  • 46e8b53 perf: index the Clover file lookup instead of rescanning per source path (#618)
  • e34eec3 Version 10.5.0
  • 5fc9e82 Support PHPUnit clover reports (silently reported as zero coverage) (#617)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 7…
15e9c4a 
… updates

Bumps the minor-and-patch group with 7 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.51` | `2.0.52` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.4` | `3.5.5` |
| [resend](https://github.com/resendlabs/resend-python) | `2.35.0` | `2.39.0` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.1.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.2` | `0.16.4` |
| [diff-cover](https://github.com/Bachmann1234/diff-cover) | `10.4.2` | `10.5.1` |



Updates `uvicorn` from 0.52.1 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.1...0.52.4)

Updates `sqlalchemy` from 2.0.51 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `greenlet` from 3.5.4 to 3.5.5
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.4...3.5.5)

Updates `resend` from 2.35.0 to 2.39.0
- [Release notes](https://github.com/resendlabs/resend-python/releases)
- [Commits](resend/resend-python@v2.35.0...v2.39.0)

Updates `gunicorn` from 26.0.0 to 26.1.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.1.0)

Updates `ruff` from 0.16.2 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.2...0.16.4)

Updates `diff-cover` from 10.4.2 to 10.5.1
- [Release notes](https://github.com/Bachmann1234/diff-cover/releases)
- [Changelog](https://github.com/Bachmann1234/diff_cover/blob/main/CHANGELOG)
- [Commits](Bachmann1234/diff_cover@v10.4.2...v10.5.1)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sqlalchemy
  dependency-version: 2.0.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: greenlet
  dependency-version: 3.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: resend
  dependency-version: 2.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: gunicorn
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: diff-cover
  dependency-version: 10.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 24, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) August 24, 2026 16:20
@codecov

codecov Bot commented Aug 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants