chore(deps): bump the ci-toolchain group across 1 directory with 5 updates

[dependabot]

Bumps the ci-toolchain group with 5 updates in the /requirements directory:

Package	From	To
cyclonedx-bom	7.3.0	7.4.0
coverage	7.16.0	7.16.1
httpcore2	2.12.0	2.13.0
httpx2	2.12.0	2.13.0
uvicorn	0.52.4	0.53.0

Updates cyclonedx-bom from 7.3.0 to 7.4.0

Release notes

Sourced from cyclonedx-bom's releases.

v7.4.0 (2026-09-15)

Features

• Respect env var SOURCE_DATE_EPOCH when generating reproducible output (#1084, 51813c7)

---

What's Changed

• chore(deps): Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1088
• chore(deps): Bump actions/setup-python from 6.3.0 to 7.0.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1085
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1082
• chore(deps): Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1087
• chore(deps-dev): Update uv requirement from 0.11.17 to 0.11.32 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1089
• chore(deps): Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1091
• chore(deps-dev): Update uv requirement from 0.11.32 to 0.12.10 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1101
• chore(deps): Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1090
• chore(deps): Bump docker/login-action from 3.7.0 to 4.6.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1092
• feat: respect env var SOURCE_DATE_EPOCH when generating reproducible output by @​Yusuf-Gadelrab in CycloneDX/cyclonedx-python#1084
• chore(deps): Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1100
• chore(deps): Bump python from 3.14-slim to 3.14.6-slim by @​dependabot[bot] in CycloneDX/cyclonedx-python#1065
• chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1048
• chore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1046

New Contributors

• @​Yusuf-Gadelrab made their first contribution in CycloneDX/cyclonedx-python#1084

Full Changelog: CycloneDX/cyclonedx-python@v7.3.1...v7.4.0

v7.3.1 (2026-07-23)

Bug Fixes

• Improve error message for non-PEP 621 pyproject.toml (#1080, 6715bd9)

Documentation

• Update docs (#1034, e42d0fe)

• Usage cyclonedx-py environment help page add -S (#1033, d4a0d50)

---

What's Changed

• docs: usage cyclonedx-py environment help page add -S by @​jkowalleck in CycloneDX/cyclonedx-python#1033
• docs: update docs by @​jkowalleck in CycloneDX/cyclonedx-python#1034
• chore(deps-dev): Update uv requirement from 0.10.10 to 0.11.6 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1039
• chore(ci): pin GitHub Actions to immutable commit SHAs by @​jkowalleck with @​Copilot in CycloneDX/cyclonedx-python#1043
• chore: harden all GitHub workflows using zizmor by @​jkowalleck with @​Copilot in CycloneDX/cyclonedx-python#1054
• chore(deps-dev): Update uv requirement from 0.11.6 to 0.11.8 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1051

... (truncated)

Changelog

Sourced from cyclonedx-bom's changelog.

v7.4.0 (2026-09-15)

Features

• Respect env var SOURCE_DATE_EPOCH when generating reproducible output (#1084, 51813c7)

v7.3.1 (2026-07-23)

Bug Fixes

• Improve error message for non-PEP 621 pyproject.toml (#1080, 6715bd9)

Documentation

• Update docs (#1034, e42d0fe)

• Usage cyclonedx-py environment help page add -S (#1033, d4a0d50)

Commits

• f6f4941 chore(release): 7.4.0
• f97a9a9 chore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.1 (#1046)
• 0fd16c3 chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.1 (#1048)
• d48f71c chore(deps): Bump python from 3.14-slim to 3.14.6-slim (#1065)
• 2abed0f chore(deps): Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#1100)
• 51813c7 feat: respect env var SOURCE_DATE_EPOCH when generating reproducible output...
• 0e4de7a chore(deps): Bump docker/login-action from 3.7.0 to 4.6.0 (#1092)
• b51c001 chore(deps): Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#1090)
• 25bfa4c chore(deps-dev): Update uv requirement from 0.11.32 to 0.12.10 (#1101)
• 20a8345 chore(deps): Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#1091)
• Additional commits viewable in compare view

Updates coverage from 7.16.0 to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

• Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Commits

• ccbb992 docs: prep for 7.16.1
• 0697ccc chore: make upgrade
• 12f3595 chore: bump docker/setup-qemu-action in the action-dependencies group (#2280)
• 35b58d3 fix: CoverageData.update() can be called twice on an in-memory database. #2279
• 92e1ce9 chore: bump the action-dependencies group with 4 updates (#2278)
• bf07310 build: quote var expansion (actionlint SC2086)
• 3c434f5 quality: use shellcheck-py to get shellcheck in GitHub CI
• 632f397 build: use .txt instead of .pip, even though it's a stupid extension
• ffc6a4a test: only run diff-cover on pull requests
• 33553b3 fix: exclude the case line when an irrefutable case body is excluded (#2269)
• Additional commits viewable in compare view

Updates httpcore2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpcore2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart in pydantic/httpx2#1140 and pydantic/httpx2#1186
• Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

httpcore2

Changed

• Require Trio 0.34.0 or later for the trio extra in pydantic/httpx2#1179

Fixed

• Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Commits

• f295185 Prepare version 2.13.0 (#1208)
• c518f71 Avoid nested async generator finalization errors (#1204)
• 8f215b5 Use portable links in API docstrings (#1202)
• 81c523f Revert "Maintain connection reservations incrementally in the pool" (#1197)
• 23a24f0 Maintain connection reservations incrementally in the pool (#1076)
• 36d636a Group httpx2.__all__ exports by source module (#1188)
• f1064aa Bump the python-packages group across 1 directory with 11 updates (#1179)
• bc27137 Update uv-dynamic-versioning requirement from >=0.14.0 to >=0.14.1 (#1180)
• 62e0827 Restore --no-verify CLI flag (#1186)
• c9b1d33 Replace --no-verify flag with --verify (#1140)
• Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpx2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart in pydantic/httpx2#1140 and pydantic/httpx2#1186
• Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

httpcore2

Changed

• Require Trio 0.34.0 or later for the trio extra in pydantic/httpx2#1179

Fixed

• Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Changelog

Sourced from httpx2's changelog.

2.13.0 (September 14th, 2026)

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
• Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)

Commits

• f295185 Prepare version 2.13.0 (#1208)
• 8f215b5 Use portable links in API docstrings (#1202)
• 36d636a Group httpx2.__all__ exports by source module (#1188)
• f1064aa Bump the python-packages group across 1 directory with 11 updates (#1179)
• bc27137 Update uv-dynamic-versioning requirement from >=0.14.0 to >=0.14.1 (#1180)
• 62e0827 Restore --no-verify CLI flag (#1186)
• c9b1d33 Replace --no-verify flag with --verify (#1140)
• e3a87b1 Convert Timeout and Limits to dataclasses (#1167)
• 4c02c4b Fixed a grammatical mistake. (#1154)
• See full diff in compare view

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.