Bump the python-packages group across 1 directory with 16 updates by dependabot[bot] · Pull Request #1102 · pydantic/httpx2

dependabot · 2026-08-02T08:32:34Z

Updates the requirements on chardet, coverage[toml], cryptography, pytest-codspeed, pytest-httpbin, trio, uvicorn, websockets, mypy, ruff, build, twine, zensical, mkdocstrings[python], aiohttp and click to permit the latest version.
Updates chardet from 6.0.0.post1 to 7.4.3

Release notes

Sourced from chardet's releases.

7.4.3

Patch release: fixes a crash when input contains null bytes inside a <meta charset> declaration.

Bug Fixes

Fixed ValueError: embedded null character crash when input contained a <meta charset> declaration with a null byte in the encoding name (e.g. b'<meta charset="\x00utf-8">'). codecs.lookup() raises ValueError on embedded nulls, and lookup_encoding() was only catching LookupError. Also added defensive ValueError catches in _validate_bytes() and _to_utf8() for completeness. (#369, thanks @DRMacIver for the report)

Full Changelog: chardet/chardet@7.4.2...7.4.3

7.4.2

Patch release: fixes a crash on short inputs and closes a bunch of WHATWG/IANA alias gaps.

Bug Fixes

Fixed RuntimeError: pipeline must always return at least one result on ~2% of all possible two-byte inputs (e.g. b"\xf9\x92"). Multi-byte encodings like CP932 and Johab could score above the structural confidence threshold on very short inputs, but then statistical scoring would return nothing, leaving an empty result list instead of falling through to the fallback. (#367, #368, thanks @jasonwbarnett)

Improvements

Added ~90 encoding aliases from the WHATWG Encoding Standard and IANA Character Sets registry so that <meta charset> labels like x-cp1252, x-sjis, dos-874, csUTF8, and the cswindows* family all resolve correctly through the markup detection stage. Every alias was driven by a failing spec-compliance test, not speculative. (#366)

Added a spec-compliance test suite covering Python decode round-trips for all 86 registry encodings, WHATWG label resolution, IANA preferred MIME names, and Unicode/RFC conformance (BOM sniffing, UTF-8 boundary cases, UTF-16 surrogate pairs). This is the test suite that would have caught the 7.4.1 BOM bug before release. (#366)

Full Changelog: chardet/chardet@7.4.1...7.4.2

7.4.1

Bug Fixes

BOM-prefixed UTF-16/32 input now returns utf-16/utf-32 instead of utf-16-le/utf-16-be/utf-32-le/utf-32-be. The endian-specific codecs don't strip the BOM on decode, so callers were getting a stray U+FEFF at the start of their text. BOM-less detection is unchanged. (#364, #365)

Full Changelog: chardet/chardet@7.4.0...7.4.1

chardet 7.4.0 brings accuracy up to 99.3% (from 98.6% in 7.3.0) and significantly faster cold start thanks to a new dense model format.

What's New

Performance:

New dense zlib-compressed model format (v2) drops cold start (import + first detect) from ~75ms to ~13ms with mypyc

Accuracy (98.6% → 99.3%):

Eliminated train/test data overlap via content fingerprinting

Added MADLAD-400 and Wikipedia as supplemental training sources

Improved non-ASCII bigram scoring: high-byte bigrams are now preserved during training and weighted by per-bigram IDF

Encoding-aware substitution filtering (substitutions only apply for characters the target encoding can't represent)

Increased training samples from 15K to 25K per language/encoding pair

Bug fixes:

Added dedicated structural analyzers for CP932, CP949, and Big5-HKSCS (these were previously sharing their base encoding's byte-range analyzer, missing extended ranges)

Metrics

| | chardet 7.4.0 (mypyc) | chardet 6.0.0 | charset-normalizer 3.4.6 |

... (truncated)

Changelog

Sourced from chardet's changelog.

7.4.3 (2026-04-13)

Bug Fixes:

Fixed ValueError: embedded null character crash when input contained a <meta charset> declaration with a null byte in the encoding name (e.g. b'<meta charset="\x00utf-8">'). codecs.lookup() raises ValueError on embedded nulls, and lookup_encoding() was only catching LookupError. Also added defensive ValueError catches in _validate_bytes() and _to_utf8() for completeness. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude, [#369](https://github.com/chardet/chardet/issues/369) <https://github.com/chardet/chardet/issues/369>_)

7.4.2 (2026-04-12)

Bug Fixes:

Fixed RuntimeError: pipeline must always return at least one result on ~2% of all possible two-byte inputs (e.g. b"\xf9\x92"). Multi-byte encodings like CP932 and Johab could score above the structural confidence threshold on very short inputs, but then statistical scoring would return nothing, leaving the pipeline with an empty result list instead of falling through to the no_match_encoding fallback. (Jason Barnett <https://github.com/jasonwbarnett>_ via Claude, [#367](https://github.com/chardet/chardet/issues/367) <https://github.com/chardet/chardet/issues/367>, [#368](https://github.com/chardet/chardet/issues/368) <https://github.com/chardet/chardet/pull/368>)

Improvements:

Added ~90 encoding aliases from the WHATWG Encoding Standard and IANA Character Sets registry so that <meta charset> labels like x-cp1252, x-sjis, dos-874, csUTF8, and the cswindows* family all resolve correctly through the markup detection stage. Every alias was driven by a failing spec-compliance test. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude, [#366](https://github.com/chardet/chardet/issues/366) <https://github.com/chardet/chardet/pull/366>_)

Added a spec-compliance test suite covering Python decode round-trips for all 86 registry encodings, WHATWG web-platform label resolution, IANA preferred MIME names, and Unicode/RFC conformance (BOM sniffing, UTF-8 boundary cases, UTF-16 surrogate pairs). This is the test suite that would have caught the 7.4.1 BOM bug before release. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude, [#366](https://github.com/chardet/chardet/issues/366) <https://github.com/chardet/chardet/pull/366>_)

7.4.1 (2026-04-07)

... (truncated)

Commits

8f404a5 docs: set 7.4.3 release date to 2026-04-13
7a6667f docs: fix changelog attribution for #369
a1fc986 docs: changelog for 7.4.3
0af01d6 Fix ValueError crash on null bytes in charset declarations (#369)
08e4ebc ci: parallelize riscv64 builds across 5 RISE runners
2f6e1e9 ci: use python3 -m pip on riscv64 runner
204623d ci: invoke cibuildwheel manually on riscv64 runner
78c1d20 ci: use native runners for aarch64/riscv64 instead of QEMU
3cc0960 docs: changelog for 7.4.2
9079efc Fix RuntimeError on ~2% of two-byte inputs (#368)
Additional commits viewable in compare view

Updates coverage[toml] from 7.10.6 to 7.15.2

Release notes

Sourced from coverage[toml]'s releases.

7.15.2

Version 7.15.2 — 2026-07-15

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️ PyPI page: coverage 7.15.2. :arrow_right: To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.

A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️ PyPI page: coverage 7.15.1. :arrow_right: To install: python3 -m pip install coverage==7.15.1

7.15.0

Version 7.15.0 — 2026-07-02

Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198.

Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen.

When running your program, coverage now correctly sets yourmodule.__spec__.loader as strongly recommended, avoiding the deprecation warning described in issue 2208. Thanks, A5rocks.

Fix: with Python 3.10, running with the -I (isolated mode) option didn’t correctly omit the current directory from the module search path, as described in issue 2103. That is now fixed thanks to Ilia Sorokin.

➡️ PyPI page: coverage 7.15.0. :arrow_right: To install: python3 -m pip install coverage==7.15.0

7.14.3

Version 7.14.3 — 2026-06-22

Fix: the default ... exclusion rule now also matches function bodies whose closing return-type bracket is on its own line (for example, after a long -> dict[ ... ] annotation that a formatter has split over multiple lines). Closes issue 2185, thanks Mengjia Shang.

Fix: On 3.13t, we incorrectly issued Couldn't import C tracer errors. We can’t import the C tracer because in 7.14.2 we stopped shipping compiled wheels for 3.13t. Thanks, Hugo van Kemenade.

➡️ PyPI page: coverage 7.14.3. :arrow_right: To install: python3 -m pip install coverage==7.14.3

7.14.2

Version 7.14.2 — 2026-06-20

Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr, fixing issue 2197.

Fix: CoverageData kept one SQLite connection per thread that recorded coverage, but never closed them when those threads terminated. On long runs with many short-lived threads this leaked one file descriptor per dead thread, eventually failing with OSError: [Errno 24] Too many open files. Connections belonging to terminated threads are now closed and dropped. Fixes issue 2192. Thanks, Matthew Lloyd.

Fix: when using sys.monitoring, we were assuming we could use the COVERAGE_ID tool id. But other tools might also assume they could use that id. Pre-allocated ids don’t really make sense, so now we search for a usable one instead. Fixes issue 2187.

Following the advice of cibuildwheel, we no longer distribute wheels for Python 3.13 free-threaded.

➡️ PyPI page: coverage 7.14.2. :arrow_right: To install: python3 -m pip install coverage==7.14.2

7.14.1

Version 7.14.1 — 2026-05-26

... (truncated)

Changelog

Sourced from coverage[toml]'s changelog.

Version 7.15.2 — 2026-07-15

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Version 7.15.0 — 2026-07-02

Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198_.

Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

When running your program, coverage now correctly sets

... (truncated)

Commits

50d8659 docs: sample HTML for 7.15.2
b5eed20 docs: prep for 7.15.2
78cab6e fix: reduce memory use during reporting. #2229 (#2231)
b4c1fda build: bump version to 7.15.2
da63bed docs: sample HTML for 7.15.1
bc35e64 docs: prep for 7.15.1
182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
dd80635 fix: escape context labels in html report inline script block (#2224)
Additional commits viewable in compare view

Updates cryptography from 48.0.1 to 49.0.0

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12


* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table>

... (truncated)

Commits

e300bbe bump version and changelog for 49.0.0 (#15030)
fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
6080dc7 Bump dependencies that dependabot isn't (#15026)
121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
829520b Add more robust processing for DH parameters. (#15016)
0f05001 Bump downstream dependencies in CI (#15025)
Additional commits viewable in compare view

Updates pytest-codspeed from 4.5.0 to 5.0.3

Release notes

Sourced from pytest-codspeed's releases.

v5.0.3

What's Changed

chore: move callgrind skip obj API to instrument-hooks by @not-matthias in CodSpeedHQ/pytest-codspeed#123

Full Changelog: CodSpeedHQ/pytest-codspeed@v5.0.2...v5.0.3

v5.0.2

What's Changed

feat: skip Python runtime objects in callgrind by @not-matthias in CodSpeedHQ/pytest-codspeed#122

Full Changelog: CodSpeedHQ/pytest-codspeed@v5.0.1...v5.0.2

v5.0.1

What's Changed

build: enable free-threaded wheels in cibuildwheel by @art049 in CodSpeedHQ/pytest-codspeed#121

Full Changelog: CodSpeedHQ/pytest-codspeed@v5.0.0...v5.0.1

v5.0.0

Highlights

MacOS walltime profiling is now available with the codspeed cli v4.16.1 and above.

pytest-codspeed can now be used in free threaded mode. This has been tested with 3.14t and 3.15t. For this, we have dropped usage of cffi in favor of the native extension support.

What's Changed

chore: bump instrument-hooks by @not-matthias in CodSpeedHQ/pytest-codspeed#119

Remove CFFI in favor of native extension to support free-threaded mode by @adriencaccia in CodSpeedHQ/pytest-codspeed#96

feat(hooks): declare native extension free-thread safe by @art049 in CodSpeedHQ/pytest-codspeed#120

feat: use instrument-hook markers in walltime by @GuillaumeLagrange in CodSpeedHQ/pytest-codspeed#118

Full Changelog: CodSpeedHQ/pytest-codspeed@v4.5.0...v5.0.0

Changelog

Sourced from pytest-codspeed's changelog.

[5.0.3] - 2026-05-22

🏗️ Refactor

Use instrument_hooks_callgrind_add_obj_skip from C API by @not-matthias in #123

[5.0.2] - 2026-05-14

🚀 Features

Skip Python runtime objects in callgrind by @not-matthias in #122

[5.0.1] - 2026-05-13

💼 Other

Enable free-threaded wheels in cibuildwheel (#121) by @art049 in #121

[5.0.0] - 2026-05-13

🚀 Features

Use instrument_hooks markers in walltime by @GuillaumeLagrange

Declare native extension free-thread safe (#120) by @art049 in #120

Remove cffi in favor of native extension by @adriencaccia

⚡ Performance

Bind callgrind start/stop directly to avoid extra frame by @art049 in #96

⚙️ Internals

Ignore common compilation warnings for instrument-hooks by @GuillaumeLagrange in #118

Use unsigned bash in the macos test by @GuillaumeLagrange

Bump pinned uv version to 0.11.14 by @art049

Add python 3.15 and 3.15t to test matrix by @art049

Add 3.14.t in test suite by @adriencaccia

Bump instrument-hooks (#119) by @not-matthias in #119

Commits

b2d12d8 Release v5.0.3 🚀
31447b7 refactor: use instrument_hooks_callgrind_add_obj_skip from C API
fc33d20 Release v5.0.2 🚀
3bbabe4 feat: skip Python runtime objects in callgrind
d4d9dc6 Release v5.0.1 🚀
ad709a5 build: enable free-threaded wheels in cibuildwheel (#121)
080d620 Release v5.0.0 🚀
befdebf chore: ignore common compilation warnings for instrument-hooks
ee98055 chore: use unsigned bash in the macos test
5a205c8 feat: use instrument_hooks markers in walltime
Additional commits viewable in compare view

Updates pytest-httpbin from 2.0.0 to 2.1.0

Commits

5cee134 Merge pull request #95 from kevin1024/bump-version-final
f424122 bump to 2.1.0
f7b2b3e Merge pull request #94 from kevin1024/bump-version
9b18f26 Update README.md
3b4a22a Update README.md
b90b867 bump to 2.1.0rc1
e71ed01 Merge pull request #90 from kevin1024/test-on-3-13-and-pypy-3-10
c86126c remove unsupported PyPy versions
aad2fe3 Merge branch 'master' of github.com:kevin1024/pytest-httpbin into test-on-3-1...
f81b16b Merge pull request #93 from kevin1024/fix-deprecated-upload-download-artifact
Additional commits viewable in compare view

Updates trio from 0.31.0 to 0.33.0

Release notes

Sourced from trio's releases.

v0.33.0

Full Changelog: python-trio/trio@v0.32.0...v0.33.0

Bugfixes

Start supporting Android's new "android" sys.platform. (python-trio/trio#3357)

Deprecations and removals

Both trio.testing.RaisesGroup and trio.testing.Matcher have been deprecated. Pytest alternatives pytest.RaisesGroup and pytest.RaisesExc (respectively) are considered correct replacement. (python-trio/trio#3326)

v0.32.0

Full Changelog: python-trio/trio@v0.31.0...v0.32.0

Features

Allow trio.CapacityLimiter to have zero total_tokens. (python-trio/trio#3321)

Bugfixes

Fixed a bug where iterating over an @as_safe_channel-derived ReceiveChannel would raise trio.BrokenResourceError if the channel was closed by another task. It now shuts down cleanly. (python-trio/trio#3331)

trio.lowlevel.Task.iter_await_frames now works on completed tasks, by returning an empty list of frames if the underlying coroutine has been closed. Previously, it raised an internal error. (python-trio/trio#3337)

Removals without deprecations

Drop support for Python 3.9. (python-trio/trio#3345)

Miscellaneous internal changes

Decrease indentation for exception groups raised in trio.as_safe_channel. (python-trio/trio#3332)

Commits

3073f0c Bump version to 0.33.0
c21654b Bump dependencies from commit 694044 (#3391)
6940445 Documentation search improvements (#3378)
e27a303 Merge pull request #3384 from A5rocks/update-sphinx
93b989b Add coredis and streaQ libraries to documentation (#3389)
bc94ce1 Add coredis and streaQ libraries to documentation
1ee96c8 [pre-commit.ci] pre-commit autoupdate (#3387)
95d9205 Dependency updates (#3386)
21250b1 Update to Sphinx 9
4a9c6db [pre-commit.ci] pre-commit autoupdate (#3382)
Additional commits viewable in compare view

Updates uvicorn from 0.46.0 to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @Kludex in Kludex/uvicorn#3025

Remove colorama from the standard extra by @Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation by @Aayush7352 in Kludex/uvicorn#3019

New Contributors

@Aayush7352 made their first contribution in Kludex/uvicorn#3019

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

Memoize trusted host checks to avoid re-parsing the client IP per request by @Kludex in Kludex/uvicorn#2970

Cache the asgi scope sub-dict per connection by @Kludex in Kludex/uvicorn#2976

Build a fresh asgi scope dict per request by @Kludex in Kludex/uvicorn#2977

Replace click.style with an internal ANSI style helper by @Kludex in Kludex/uvicorn#2981

Avoid copying single-frame WebSocket payloads in websockets-sansio by @Kludex in Kludex/uvicorn#2983

Deprecate the legacy websockets implementation and default auto to websockets-sansio by @Kludex in Kludex/uvicorn#2985

Exit with a dedicated code on startup failure and stop the supervisor when a worker can't boot by @Kludex in Kludex/uvicorn#3001

Skip the eager app import in the parent when spawning workers by @Kludex in Kludex/uvicorn#3012

Full Changelog: Kludex/uvicorn@0.49.0...0.50.0

Version 0.49.0

What's Changed

Bump httptools minimum version to 0.8.0 by @Kludex in Kludex/uvicorn#2962

Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by @Kludex in Kludex/uvicorn#2971

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Version 0.48.0

What's Changed

Default ssl_ciphers to None and use OpenSSL defaults by @Kludex in Kludex/uvicorn#2940

Ignore duplicate forwarding headers in ProxyHeadersMiddleware by @Kludex in Kludex/uvicorn#2944

Full Changelog: Kludex/uvicorn@0.47.0...0.48.0

Version 0.47.0

What's Changed

Eagerly import the ASGI app in the parent process by @Kludex in Kludex/uvicorn#2919

Add ssl_context_factory for custom SSLContext configuration by @Kludex in Kludex/uvicorn#2920

Treat fd=0 as a valid file descriptor with reload/workers by @eltoder in Kludex/uvicorn#2927

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)

Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)

Default --ws auto to websockets-sansio when websockets is installed (#2985)

Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)

Build a fresh asgi scope dict per request (#2977)

Cache the asgi scope sub-dict per connection (#2976)

Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)

Memoize trusted host checks in ProxyHeadersMiddleware (#2970)

Replace click.style with an internal ANSI style helper (#2981)

Deprecated

Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

0.49.0 (June 3, 2026)

Changed

Bump httptools minimum version to 0.8.0 (#2962)

Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

... (truncated)

Commits

e4d0b05 Version 0.51.0 (#3028)
944e43d Remove colorama from the standard extra (#3027)
2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
a1b570c Version 0.50.2 (#3022)
83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
b4d0116 Version 0.50.1 (#3020)
2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
21d2c16 Version 0.50.0 (#3013)
Additional commits viewable in compare view

Updates websockets from 16.0 to 16.1.1

Release notes

Sourced from websockets's releases.

16.1.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

16.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits

01df1e4 Revert "Decode non-ASCII header values with iso-8859-1."
2d61f74 Clarify restriction on headers in 16.1.
4df6f90 Release version 16.1.
7c69eca Increase timeout for building wheels.
493864e Complete and review changelog.
73ff538 Temporarily remove the trio implementation (again).
77f7d71 Shorten changelog and docstring for previous commit.
84859e1 Add text argument to broadcast() to force the frame type
1a38f5a Document research on removing a workaround.
99431ee Apply code style to docs/conf.py.
Additional commits viewable in compare view

Updates mypy from 1.17.1 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)

Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)

Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)

Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)

Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

8aabf84 Drop +dev from version
4d8ad2a Update changelog for 2.3 release (#21728)
2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)

codspeed-hq · 2026-08-02T08:33:33Z

Merging this PR will improve performance by 10.92%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

#### 🎉 Hooray! `pytest-codspeed` just leveled up to 5.0.3!

A heads-up, this is a breaking change and it might affect your current performance baseline a bit. But here's the exciting part - it's packed with new, cool features and promises improved result stability 🥳!
Curious about what's new? Visit our releases page to delve into all the awesome details about this new version.

⚡ 2 improved benchmarks
✅ 13 untouched benchmarks
⏩ 7 skipped benchmarks¹

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
⚡	Simulation	`test_bench_headers_raw`	24.2 µs	21.6 µs	+11.68%
⚡	Simulation	`test_bench_headers_lookup`	29.9 µs	27.1 µs	+10.17%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing dependabot/uv/python-packages-7667e6bff8 (70bbb72) with main (e27e2f9)}

7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: build dependency-version: 1.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: chardet dependency-version: 7.4.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-packages - dependency-name: click dependency-version: 8.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: coverage[toml] dependency-version: 7.15.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: cryptography dependency-version: 49.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-packages - dependency-name: mkdocstrings[python] dependency-version: 1.0.6 dependency-type: direct:development dependency-group: python-packages - dependency-name: mypy dependency-version: 2.3.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-packages - dependency-name: pytest-codspeed dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-packages - dependency-name: pytest-httpbin dependency-version: 2.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: trio dependency-version: 0.33.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: twine dependency-version: 6.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: uvicorn dependency-version: 0.51.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: websockets dependency-version: 16.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: zensical dependency-version: 0.0.51 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-packages ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 2, 2026

dependabot Bot had a problem deploying to cloudflare August 2, 2026 08:32 Failure

dependabot Bot changed the title ~~Bump the python-packages group with 16 updates~~ Bump the python-packages group across 1 directory with 16 updates Aug 2, 2026

dependabot Bot force-pushed the dependabot/uv/python-packages-7667e6bff8 branch from 9312bdf to 70bbb72 Compare August 2, 2026 08:47

dependabot Bot had a problem deploying to cloudflare August 2, 2026 08:47 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the python-packages group across 1 directory with 16 updates - #1102

Bump the python-packages group across 1 directory with 16 updates#1102
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-packages-7667e6bff8

dependabot Bot commented on behalf of github Aug 2, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

7.4.3

Bug Fixes

7.4.2

Bug Fixes

Improvements

7.4.1

Bug Fixes

What's New

Metrics

7.4.3 (2026-04-13)

7.4.2 (2026-04-12)

7.4.1 (2026-04-07)

7.15.2

Version 7.15.2 — 2026-07-15

7.15.1

Version 7.15.1 — 2026-07-12

7.15.0

Version 7.15.0 — 2026-07-02

7.14.3

Version 7.14.3 — 2026-06-22

7.14.2

Version 7.14.2 — 2026-06-20

7.14.1

Version 7.14.1 — 2026-05-26

Version 7.15.2 — 2026-07-15

Version 7.15.1 — 2026-07-12

Version 7.15.0 — 2026-07-02

v5.0.3

What's Changed

v5.0.2

What's Changed

v5.0.1

What's Changed

v5.0.0

Highlights

What's Changed

[5.0.3] - 2026-05-22

🏗️ Refactor

[5.0.2] - 2026-05-14

🚀 Features

[5.0.1] - 2026-05-13

💼 Other

[5.0.0] - 2026-05-13

🚀 Features

⚡ Performance

⚙️ Internals

v0.33.0

Bugfixes

Deprecations and removals

v0.32.0

Features

Bugfixes

Removals without deprecations

Miscellaneous internal changes

Version 0.51.0

What's Changed

Version 0.50.1

What's Changed

New Contributors

Version 0.50.0

What's Changed

Version 0.49.0

What's Changed

Version 0.48.0

What's Changed

Version 0.47.0

What's Changed

0.51.0 (July 8, 2026)

Added

Removed

0.50.2 (July 6, 2026)

Fixed

0.50.1 (July 6, 2026)

Fixed

0.50.0 (July 4, 2026)

Changed

dependabot Bot commented on behalf of github Aug 2, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 2, 2026 •

edited

Loading