Skip to content

chore(deps): bump the backend-dependencies group across 1 directory with 8 updates - #79

Merged
evilguy4000 merged 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-1c85f3f745
Oct 6, 2026
Merged

chore(deps): bump the backend-dependencies group across 1 directory with 8 updates#79
evilguy4000 merged 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-1c85f3f745

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-dependencies group with 8 updates in the /backend directory:

Package From To
fastapi 0.141.1 0.142.2
uvicorn 0.53.0 0.54.0
sqlalchemy 2.0.53 2.1.2
psycopg 3.3.5 3.3.6
pillow-heif 1.7.0 1.8.0
sentry-sdk 2.69.1 2.71.0
google-auth 2.58.0 2.59.1
ruff 0.16.7 0.16.10

Updates fastapi from 0.141.1 to 0.142.2

Release notes

Sourced from fastapi's releases.

0.142.2

Fixes

  • 🐛 Allow startup when automatic OpenTelemetry configuration fails. PR #16418 by @​tiangolo.

0.142.1

Fixes

0.142.0

Features

Refactors

Docs

Translations

Internal

... (truncated)

Commits

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates sqlalchemy from 2.0.53 to 2.1.2

Release notes

Sourced from sqlalchemy's releases.

2.1.2

Released: October 2, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #5987 where the selectinload() loader strategy would ignore additional criteria present in the _orm.relationship.primaryjoin of a many-to-many relationship, such as a comparison against a column on the association table or on the parent table, loading related rows that should have been excluded. The omit_join optimization for many-to-many relationships is now only used when the primaryjoin consists solely of comparisons between the parent's primary key columns and the association table.

    References: #13626

engine

  • [engine] [bug] [regression] Fixed regression where result rows delivered by the DBAPI as a subclass of tuple would fail to be processed when the Cython extensions were in use, raising TypeError: Expected tuple. Such rows are now converted to a plain tuple, as was the case in 2.0. Rows delivered as a plain tuple, or as a sequence that is not a tuple at all such as asyncpg's Record, were not affected. Drivers such as the Databricks SQL connector return rows that are tuple subclasses.

    References: #13619

sql

  • [sql] [bug] The plain string portions of a _sql.tstring() construct are no longer scanned for bound parameter names in the :name format, and no longer interpret the \: escape sequence; the text is now rendered exactly as given. Previously, each string portion was parsed in the same way as _sql.text(), so that a colon within a quoted SQL string, such as 'time is :now', would be rendered as a bound parameter, failing at execution time.

    This change is a breaking change in the behavior of the newly introduced _sql.tstring() feature, as the former use of text() inadvertently provided a behavior that wasn't intended. In order to embed an explicit parameter in the SQL generated by _sql.tstring(), _sql.bindparam() may be used directly, e.g. tstring(t"SELECT {bindparam('p')}").

    References: #13616

... (truncated)

Commits

Updates psycopg from 3.3.5 to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.7 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix segfault fetching arrays of strings or timestamps after closing the connection (:ticket:[#1428](https://github.com/psycopg/psycopg/issues/1428)).

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
  • Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).
  • Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
  • Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
  • Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
  • Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
  • Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
  • Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
  • Fix !DataError messages leaking the literal {...} placeholder instead

... (truncated)

Commits
  • a67654d chore: bump psycopg package version to 3.3.6
  • 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
  • 42966e9 test: add helpful comments to some tests
  • 5e8797f test: add reasonable connect_timeout to most tests
  • c81ba62 perf: reduce the overhead of wait_async()
  • d2bbfe4 refactor: use get_running_loop() in the async wait functions
  • 2b1484a test: add a script to measure the async wait functions
  • 573cf4a test: fix incorrect wait timing test
  • 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
  • 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
  • Additional commits viewable in compare view

Updates pillow-heif from 1.7.0 to 1.8.0

Release notes

Sourced from pillow-heif's releases.

v1.8.0

Added

  • Reading of entity groups: entity_groups key in info dictionary, tells which images form a stereo pair in spatial photos. #476
  • Decoding of embedded thumbnails: HeifImage.get_thumbnail method and draft in the Pillow plugin, Image.thumbnail() uses them instead of decoding the full image. #477

Changed

  • Minimum required libheif version is 1.23.4. #480
  • libheif was updated from the 1.23.3 to 1.23.4 version. #479
  • libde265 was updated from the 1.1.2 to 1.1.3 version. #483

Fixed

  • Segmentation fault when opening a file whose metadata item type is not valid UTF-8. #478
  • Pillow plugin: load() of a multi-frame image reloaded the frame data on every call, discarding in-place changes and failing after thumbnail(). #477
  • A depth image of an item type that libheif cannot decode made the whole file unreadable with libheif 1.23.4, such depth images are now skipped. #480
  • Type checkers treated the names imported from pillow_heif as private since the py.typed marker was added in 1.7.0: Pyright/Pylance and mypy --strict reported them as not exported, Pyright/Pylance autocompletion did not offer them. #490 Thanks to @​BetoFernandez123
Changelog

Sourced from pillow-heif's changelog.

[1.8.0 - 2026-09-22]

Added

  • Reading of entity groups: entity_groups key in info dictionary, tells which images form a stereo pair in spatial photos. #476
  • Decoding of embedded thumbnails: HeifImage.get_thumbnail method and draft in the Pillow plugin, Image.thumbnail() uses them instead of decoding the full image. #477

Changed

  • Minimum required libheif version is 1.23.4. #480
  • libheif was updated from the 1.23.3 to 1.23.4 version. #479
  • libde265 was updated from the 1.1.2 to 1.1.3 version. #483

Fixed

  • Segmentation fault when opening a file whose metadata item type is not valid UTF-8. #478
  • Pillow plugin: load() of a multi-frame image reloaded the frame data on every call, discarding in-place changes and failing after thumbnail(). #477
  • A depth image of an item type that libheif cannot decode made the whole file unreadable with libheif 1.23.4, such depth images are now skipped. #480
  • Type checkers treated the names imported from pillow_heif as private since the py.typed marker was added in 1.7.0: Pyright/Pylance and mypy --strict reported them as not exported, Pyright/Pylance autocompletion did not offer them. #490 Thanks to @​BetoFernandez123
Commits
  • 1486e9f v1.8.0
  • 1ffdd5d fix: names imported from pillow_heif were private for type checkers (#490)
  • c775daf [pre-commit.ci] pre-commit autoupdate (#484)
  • 8f2c0f6 fix(tests): Pillow 13 resize order changes one hash bit (#489)
  • abcfd35 chore(deps): update dependency strukturag/libde265 to v1.1.3 (#483)
  • fa18f51 fix: a depth image of an unsupported item type made the file unreadable (#480)
  • efdbf03 [pre-commit.ci] pre-commit autoupdate (#481)
  • 07f7203 feat: decode embedded thumbnails, draft() in the Pillow plugin (#477)
  • d60dcd2 chore(deps): update dependency strukturag/libheif to v1.23.4 (#479)
  • 07334a0 fix: segfault on a metadata item type that is not valid UTF-8 (#478)
  • Additional commits viewable in compare view

Updates sentry-sdk from 2.69.1 to 2.71.0

Release notes

Sourced from sentry-sdk's releases.

2.71.0

New Features ✨

import sentry_sdk
from sentry_sdk.integrations.typesafe import TypeSafeIntegration
sentry_sdk.init(
dsn="...",
traces_sample_rate=1.0,
integrations=[
TypeSafeIntegration(),
]
)

Typesafe

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

2.70.0

New Features ✨

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.71.0

New Features ✨

import sentry_sdk
from sentry_sdk.integrations.typesafe import TypeSafeIntegration
sentry_sdk.init(
dsn="...",
traces_sample_rate=1.0,
integrations=[
TypeSafeIntegration(),
]
)

Typesafe

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

2.70.0

New Features ✨

... (truncated)

Commits

Updates google-auth from 2.58.0 to 2.59.1

Commits
  • a7aeded chore(main): release google-auth 2.59.1 (#18505)
  • a3b4ef6 chore(storage): rename zonal buckets to rapid buckets in microbenchmarks (#18...
  • 8775794 chore: regenerate libraries with gapic-generator @ 78ff458 (#18496)
  • 590376d fix(auth): support mTLS in requests.Request for token refresh and impersonati...
  • 54dbd12 fix: repair broken and stale repository URLs in package metadata (#18498)
  • 980539d chore: update dependencies (#18502)
  • d6bed5a chore: release main (#18464)
  • 78ff458 feat(gapic-generator): add schema support for resumable uploads (#18480)
  • af2100a tests: add showcase to golden files (#18479)
  • e1d306a fix: resolve error where google/longrunning/operations.proto is missing (#18477)
  • Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

0.16.9

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits
  • 3265ed1 Bump version to 0.16.10 (#29055)
  • e786964 Authorize shared PR security-review workflow to publish findings (#29052)
  • a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
  • b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
  • 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
  • 317e0a3 [ty] Bound nested callable signature display (#29049)
  • 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
  • 56180bc [ty] Specialize instance members once (#29043)
  • aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
  • 2d25346 [ty] Improve unresolved-import documentation (#29039)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the backend-dependencies group across 1 directory w…
0e0c8ea 
…ith 8 updates

Bumps the backend-dependencies group with 8 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.53.0` | `0.54.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.53` | `2.1.2` |
| [psycopg](https://github.com/psycopg/psycopg) | `3.3.5` | `3.3.6` |
| [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.7.0` | `1.8.0` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.69.1` | `2.71.0` |
| [google-auth](https://github.com/googleapis/google-cloud-python) | `2.58.0` | `2.59.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.7` | `0.16.10` |



Updates `fastapi` from 0.141.1 to 0.142.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.142.2)

Updates `uvicorn` from 0.53.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.53.0...0.54.0)

Updates `sqlalchemy` from 2.0.53 to 2.1.2
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `psycopg` from 3.3.5 to 3.3.6
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.5...3.3.6)

Updates `pillow-heif` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/bigcat88/pillow_heif/releases)
- [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md)
- [Commits](bigcat88/pillow_heif@v1.7.0...v1.8.0)

Updates `sentry-sdk` from 2.69.1 to 2.71.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.69.1...2.71.0)

Updates `google-auth` from 2.58.0 to 2.59.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.58.0...google-auth-v2.59.1)

Updates `ruff` from 0.16.7 to 0.16.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.7...0.16.10)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: sqlalchemy
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: psycopg
  dependency-version: 3.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: pillow-heif
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: google-auth
  dependency-version: 2.59.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 5, 2026
@evilguy4000
evilguy4000 merged commit a59c1cb into main Oct 6, 2026
3 of 4 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/backend/backend-dependencies-1c85f3f745 branch October 6, 2026 18:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@evilguy4000