chore(deps): bump the backend-dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the backend-dependencies group with 11 updates in the /backend directory:

Package	From	To
uvicorn	0.52.1	0.53.0
sqlalchemy	2.0.51	2.0.53
psycopg	3.3.4	3.3.5
pillow-heif	1.5.0	1.7.0
alembic	1.19.0	1.20.0
onnxruntime	1.28.0	1.30.0
numpy	2.5.1	2.5.3
sentry-sdk	2.66.1	2.69.1
pywebpush	2.4.0	2.5.0
google-auth	2.56.3	2.58.0
ruff	0.16.1	0.16.7

Updates uvicorn from 0.52.1 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.53

Release notes

Sourced from sqlalchemy's releases.

2.0.53

Released: September 14, 2026

orm

• [orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

  References: #13560

• [orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an Index established against an ORM-annotated expression.

  References: #13566

• [orm] [bug] Fixed issue where pickling an ORM object that had an instance level lazy loader established, such as when the _orm.raiseload() option is used, would emit a spurious warning regarding the loader containing additional criteria, if the object had itself been unpickled from a previous serialization. This would occur for objects that cross more than one serialization boundary, such as when using multiprocessing.

  References: #13574

• [orm] [bug] Fixed issue where calling _orm.aliased() against an existing _orm.aliased() construct, without passing an explicit selectable, would disregard the selectable of the existing construct and produce an alias of the mapped table instead, if that selectable were anything other than a table or a plain subquery, leading to incorrect results and/or non-working queries.

  This includes _orm.aliased() against a _orm.with_polymorphic() construct, which would previously produce an alias of the base mapped class only, discarding the polymorphic selectable and additional mappers. The new construct now retains these, so that criteria against subclass attributes and the innerjoin and selectable parameters of _orm.with_polymorphic() take effect, and subclass columns are loaded up front. The SQL rendered for these constructs now includes the

... (truncated)

Commits

• See full diff in compare view

Updates psycopg from 3.3.4 to 3.3.5

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.6 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
• Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
• Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
• Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
• Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
• Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
• Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).

Current release

Psycopg 3.3.5 ^^^^^^^^^^^^^

• Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
• Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
• Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
• Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
• Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
• Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
• Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
• Fix building C extension with Cython 3.3.

... (truncated)

Commits

• ea542c9 chore: bump psycopg package version to 3.3.5
• 8d31e47 chore(deps): bump the actions group across 1 directory with 4 updates
• 268f863 Merge pull request #1370 from Sanjays2402/fix/truncated-binary-copy-error
• a412fa4 docs: put together different issues fixed around copy parsing
• f757307 fix: clearer error messages according to truncated copy message part
• b1f17c4 test: move existing COPY format parsing tests into a single module
• 21eba57 test: drop useless parametrization of copy binary parsigh test
• 6780e17 fix(copy): handle truncated binary row headers
• 2f2fcfb Merge pull request #1364 from DylanYoung/fix_client_encoding_aliases
• ccc351e refactor: don't store the encodings raw table as a dict
• Additional commits viewable in compare view

Updates pillow-heif from 1.5.0 to 1.7.0

Release notes

Sourced from pillow-heif's releases.

v1.7.0

Added

• Reading and writing nominal diffuse white luminance HDR metadata: nominal_diffuse_white_luminance key in info dictionary. #468
• py.typed marker, the package type annotations are now visible to type checkers. #475

Changed

• libheif was updated from the 1.23.2 to 1.23.3 version. #470
• libde265 was updated from the 1.1.1 to 1.1.2 version. #471

Fixed

• Out-of-bounds read in encode() when stride was smaller than the image row width. (GHSA-ccw6-q225-c975) Thanks to @​arpitjain099 for finding this!
• TypeError when saving an image whose info dictionary contains non-string keys. #475

v1.6.0

Added

• Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456
• Python 3.15 and 3.15t wheels added.

Changed

• libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

• Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453
• Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455

Changelog

Sourced from pillow-heif's changelog.

[1.7.0 - 2026-09-06]

Added

• Reading and writing nominal diffuse white luminance HDR metadata: nominal_diffuse_white_luminance key in info dictionary. #468
• py.typed marker, the package type annotations are now visible to type checkers. #475

Changed

• libheif was updated from the 1.23.2 to 1.23.3 version. #470
• libde265 was updated from the 1.1.1 to 1.1.2 version. #471

Fixed

• Out-of-bounds read in encode() when stride was smaller than the image row width. (GHSA-ccw6-q225-c975) Thanks to @​arpitjain099 for finding this!
• TypeError when saving an image whose info dictionary contains non-string keys. #475

[1.6.0 - 2026-08-31]

Added

• Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456
• Python 3.15 and 3.15t wheels added.

Changed

• libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

• Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453
• Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455

Commits

• f65a9ac v1.7.0
• a327768 feat: py.typed marker; fix the mypy errors it exposes (#475)
• b7d8f39 fix: out-of-bounds read in encode() when stride is smaller than the row (#474)
• cb0edae chore(deps): update pypa/cibuildwheel action to v4.2.1 (#472)
• 9a25554 chore(deps): update dependency strukturag/libheif to v1.23.3 (#470)
• fb3a384 ci: let renovate update every bundled library version reference (#473)
• 14c0c24 chore(deps): update dependency strukturag/libde265 to v1.1.2 (#471)
• 1460a21 feat: read and write nominal diffuse white luminance (ndwt) (#468)
• e7b4151 [pre-commit.ci] pre-commit autoupdate (#469)
• 5695650 bump version to 1.7.0.dev0
• Additional commits viewable in compare view

Updates alembic from 1.19.0 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

• [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

  References: #1846

• [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

  References: #916

bug

• [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

  References: #1768

• [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

• See full diff in compare view

Updates onnxruntime from 1.28.0 to 1.30.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

• Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
• Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
• Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
• Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

• FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
• CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
• CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
• WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

• Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
• Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
• Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
• Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
• Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
• Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

• Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
• Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
• Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
• Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

• Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
• Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
• Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

• Added Go bindings for the ONNX Runtime C API (#29615).
• Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
• Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
• Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

... (truncated)

Commits

• f2c39fe [CUDA] Add INT4 paged KV cache with per-channel scales (#32515)
• 5894ba8 Add portable random-access file reads to Env (#32503)
• a2ee3eb Fix CUDA plugin device discovery on WSL (#32517)
• b652e59 [WebGPU] Prepack Conv weights for the im2col-matmul path (#32420)
• 0f0f29f Get rid of spurious warning about not being able to find spectre mitigation (...
• 23dd651 Register ONNX schemas only when static registration is disabled (#32353)
• 33af5d3 Release external data loaders after graph initialization (#32502)
• 2e3c24d Clarify external initializer and EP context path interaction (#32442)
• e76036b [CUDA] Pin FP8 GEMV residency for grids just past two blocks per SM (#32433)
• 82583c5 Add session option for a BNHS GroupQueryAttention Value cache layout (#32139)
• Additional commits viewable in compare view

Updates numpy from 2.5.1 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

• Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

  (gh-32296)

• MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

  (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Charles Harris
• Iason Krommydas
• James Davies +
• Joren Hammudoglu
• Maanas Arora
• Matti Picus
• Nathan Goldbaum
• Shikhar Goel +
• Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

• #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits

• dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
• edcac6a REL: Prepare for the NumPy 2.5.3 release
• fd4d908 Merge pull request #32509 from charris/backport-32496
• 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
• 294956e Merge pull request #32506 from charris/backport-32503
• 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
• 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
• 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
• 8972f70 Merge pull request #32478 from charris/backport-32466
• ab1b589 Merge pull request #32477 from charris/backport-32423
• Additional commits viewable in compare view

Updates sentry-sdk from 2.66.1 to 2.69.1

Release notes

Sourced from sentry-sdk's releases.

2.69.1

New Features ✨

• (django) Add http.route attribute by @​alexander-alderman-webb in #7428

Bug Fixes 🐛

• (aiohttp) Preserve SigV4-signed propagation headers by @​Robinbinu in #7427

Internal Changes 🔧

Mcp

• Parametrize tests on the streaming trace lifecycle by @​alexander-alderman-webb in #7424
• Remove vacuous tests by @​alexander-alderman-webb in #7420

Other

• (cohere) Parametrize tests on the streaming trace lifecycle by @​alexander-alderman-webb in #7419
• (openai-agents) Parametrize tests on stream_gen_ai_spans and the streaming trace lifecycle by @​alexander-alderman-webb in #7405

2.69.0

New Features ✨

Other

• (aiohttp) Add http.route attribute by @​alexander-alderman-webb in #7341
• (bottle) Add http.route attribute by @​alexander-alderman-webb in #7343
• (clickhouse_driver) Set breadcrumbs in the streaming trace lifecycle by @​alexander-alderman-webb in #7325
• (docs) Add Plausible analytics to Sphinx docs by @​ericapisani in #7319
• (falcon) Add http.route attribute by @​alexander-alderman-webb in #7340
• (fastapi) Add http.route attribute by @​alexander-alderman-webb in #7322
• (flask) Add http.route attribute by @​alexander-alderman-webb in #7344
• (pyramid) Add http.route attribute by @​alexander-alderman-webb in #7347
• (quart) Add http.route attribute by @​alexander-alderman-webb in #7348
• (sqlalchemy) Add more db system names for span data by @​ericapisani in #7329
• (starlette) Add http.route attribute by @​alexander-alderman-webb in #7338
• (types) Export SpanJSON type by @​ericapisani in #7331
• Add Python 3.15 to test matrix by @​sentrivana in #7326

Bug Fixes 🐛

Mcp

• Handle None arguments in tool and prompt handlers by @​alexander-alderman-webb in #7387
• Don't report stateless StreamableHTTP servers as stdio by @​Snaylaker in #7224

Openai

• Read input_text parts for the Responses API by @​alexander-alderman-webb in #7333

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.69.1

New Features ✨

• (django) Add http.route attribute by @​alexander-alderman-webb in #7428

Bug Fixes 🐛

• (aiohttp) Preserve SigV4-signed propagation headers by @​Robinbinu in #7427

Internal Changes 🔧

Mcp

• Parametrize tests on the streaming trace lifecycle by @​alexander-alderman-webb in #7424
• Remove vacuous tests by @​alexander-alderman-webb in #7420

Other

• (cohere) Parametrize tests on the streaming trace lifecycle by @​alexander-alderman-webb in #7419
• (openai-agents) Parametrize tests on stream_gen_ai_spans and the streaming trace lifecycle by @​alexander-alderman-webb in #7405

2.69.0

New Features ✨

Other

• (aiohttp) Add http.route attribute by @​alexander-alderman-webb in #7341
• (bottle) Add http.route attribute by @​alexander-alderman-webb in #7343
• (clickhouse_driver) Set breadcrumbs in the streaming trace lifecycle by @​alexander-alderman-webb in #7325
• (docs) Add Plausible analytics to Sphinx docs by @​ericapisani in #7319
• (falcon) Add http.route attribute by @​alexander-alderman-webb in #7340
• (fastapi) Add http.route attribute by @​alexander-alderman-webb in #7322
• (flask) Add http.route attribute by @​alexander-alderman-webb in #7344
• (pyramid) Add http.route attribute by @​alexander-alderman-webb in #7347
• (quart) Add http.route attribute by @​alexander-alderman-webb in #7348
• (sqlalchemy) Add more db system names for span data by @​ericapisani in #7329
• (starlette) Add http.route attribute by @​alexander-alderman-webb in #7338
• (types) Export SpanJSON type by @​ericapisani in #7331
• Add Python 3.15 to test matrix by @​sentrivana in #7326

Bug Fixes 🐛

Mcp

• Handle None arguments in tool and prompt handlers by @​alexander-alderman-webb in #7387
• Don't report stateless StreamableHTTP servers as stdio by @​Snaylaker in #7224

Openai

... (truncated)

Commits

• bd30ffb release: 2.69.1
• f4d4af7 fix(aiohttp): Preserve SigV4-signed propagation headers
• 5e2fcf1 feat(django): Add http.route attribute (#7428)
• 611584b test(mcp): Parametrize tests on the streaming trace lifecycle (#7424)
• bb53bac test(mcp): Remove vacuous tests (#7420)
• 42aa532 test(cohere): Parametrize tests on the streaming trace lifecycle (#7419)
• f1c098a Merge branch 'release/2.69.0'
• f186a62 Update changelog
• 131e307 test(openai-agents): Parametrize tests on stream_gen_ai_spans and the strea...
• 54404e1 release: 2.69.0
• Additional commits viewable in compare view

Updates pywebpush from 2.4.0 to 2.5.0

Changelog

Sourced from pywebpush's changelog.

2.5.0

• Add common status_code and retry_after accessors to WebPushException for synchronous and asynchronous responses.

2.3.0 (2026-02-09)

• Cleanup from @​Rotzbua
  • Use modern typing for annotations
  • Remove legacy python 2 import
  • remove redundant :type annotations
  • use [.dev] extras in CI

2.2.1 (2026-02-06)

• add'l typing info (Thanks @​rotzbua)

2.2.0 (2026-)

• Update rst files to reflect md file changes

Add comment discussing additional work for Windows Notification Service (WNS)

• Update the README.md file to mention the required, non-standard headers.

BREAKING_CHANGE This version also drops legacy support for GCM/FCM authorization keys, since those items are obsolete according to Google. See https://firebase.google.com/docs/cloud-messaging/auth-server#authorize-legacy-protocol-send-requests

2.1.2 (2025-11-10)

chore: fix formatting chore: update CHANGELOG chore: note admin update

2.1.1 (2025-10-14)

This was an administrative push to test a new publication system.

2.1.0 (2025-09-29)

feat: Add a async_webpush one call func and tests (15cf848)[https://github.com/web-push-libs/pywebpush/commit/15cf84885b4bc1cd4e8e58a8fc8f84bfc9b3387e] (thanks (@​AlexUnder2003)[https://github.com/web-push-libs/pywebpush/commits?author=AlexUnder2003])

2.0.1 (2024-10-14)

docs: Use License classifiers in pyproject.toml (thanks @​sevdog)

2.0.0 (2024-01-02)

... (truncated)

Commits

• See full diff in compare view

Updates google-auth from 2.56.3 to 2.58.0

Release notes

Sourced from google-auth's releases.

google-auth: v2.58.0

Description has been truncated