[dependabot]

Bumps the pip-patch-and-minor group with 8 updates:

Package	From	To
aiogram	3.30.0	3.31.0
sqlalchemy	2.0.51	2.0.52
idna	3.18	3.19
multidict	6.7.1	6.8.0
pydantic	2.13.4	2.13.5
pydantic-core	2.46.4	2.49.0
python-dotenv	1.2.2	1.2.3
typing-inspection	0.4.3	0.4.4

Updates aiogram from 3.30.0 to 3.31.0

Release notes

Sourced from aiogram's releases.

Telegram Bot API 10.3

What's Changed

• Fix content type detection for live photos by @​JrooTJunior in aiogram/aiogram#1871
• Reuse type namespace when rebuilding models by @​patrick91 in aiogram/aiogram#1861
• Fix missing dispatcher contextual argument on webhook feed path by @​JrooTJunior in aiogram/aiogram#1856
• Bump vulnerable dependencies to patched versions by @​JrooTJunior in aiogram/aiogram#1872
• Fix bot-level parse_mode default not applied to recently added entities by @​JrooTJunior in aiogram/aiogram#1873
• Added full support for the Bot API 10.3 by @​JrooTJunior in aiogram/aiogram#1888
• Rewrite the 2.x -> 3.x migration guide: fix factual errors, cover silent breakages by @​Olegt0rr in aiogram/aiogram#1883
• fix(i18n): resolve territory-specific locales from Telegram language_code by @​Mukller in aiogram/aiogram#1881

New Contributors

• @​patrick91 made their first contribution in aiogram/aiogram#1861
• @​Mukller made their first contribution in aiogram/aiogram#1881

Full Changelog: aiogram/aiogram@v3.30.0...v3.31.0

Changelog

Sourced from aiogram's changelog.

3.31.0 (2026-08-26)

Bugfixes

• Fixed :class:aiogram.utils.i18n.SimpleI18nMiddleware never resolving territory-specific locales: a Telegram language_code like pt-br now selects an available pt_BR translations directory (falling back to the bare language when only it exists), instead of always resolving to the bare language and missing the territory directory. [#1755](https://github.com/aiogram/aiogram/issues/1755) <https://github.com/aiogram/aiogram/issues/1755>_

• Fixed :code:Message.content_type returning :code:photo for Live Photo messages. Telegram sends a regular :code:photo alongside :code:live_photo, so :code:live_photo is now checked first and :code:ContentType.LIVE_PHOTO is returned. :code:Message.send_copy also copies such messages via :class:aiogram.methods.send_live_photo.SendLivePhoto instead of sending a static photo. [#1841](https://github.com/aiogram/aiogram/issues/1841) <https://github.com/aiogram/aiogram/issues/1841>_

• Fixed missing dispatcher contextual argument for filters, handlers and middlewares when updates are fed via webhook (:class:aiogram.webhook.aiohttp_server.SimpleRequestHandler, :class:aiogram.webhook.aiohttp_server.TokenBasedRequestHandler) or direct :meth:aiogram.dispatcher.dispatcher.Dispatcher.feed_update calls. Previously it was only injected by start_polling, so a callback declaring a required dispatcher parameter worked in polling mode but failed with TypeError in webhook mode, aborting event propagation for sibling handlers as well. [#1855](https://github.com/aiogram/aiogram/issues/1855) <https://github.com/aiogram/aiogram/issues/1855>_

• Improved import performance by reusing the type namespace when rebuilding Telegram object models. [#1861](https://github.com/aiogram/aiogram/issues/1861) <https://github.com/aiogram/aiogram/issues/1861>_

• Fixed bot-level parse_mode default not being applied to recently added methods and types. sendGift, giftPremiumSubscription, sendPaidMedia, sendLivePhoto, sendMessageDraft, postStory, editStory, editEphemeralMessageText, editEphemeralMessageCaption, :class:aiogram.types.input_checklist.InputChecklist, :class:aiogram.types.input_checklist_task.InputChecklistTask, :class:aiogram.types.input_media_live_photo.InputMediaLivePhoto and :class:aiogram.types.input_media_voice_note.InputMediaVoiceNote were missing the Default("parse_mode") sentinel, so Bot(default=DefaultBotProperties(parse_mode=...)) was silently ignored and captions were sent unformatted. [#1873](https://github.com/aiogram/aiogram/issues/1873) <https://github.com/aiogram/aiogram/issues/1873>_

• Fixed bot-level defaults being ignored by ten generated entities.

  :code:Bot(default=DefaultBotProperties(protect_content=..., show_caption_above_media=..., link_preview=...)) was silently dropped by :class:aiogram.methods.copy_messages.CopyMessages, :class:aiogram.methods.forward_messages.ForwardMessages, :class:aiogram.methods.post_story.PostStory, :class:aiogram.methods.repost_story.RepostStory, :class:aiogram.methods.send_checklist.SendChecklist, :class:aiogram.methods.send_live_photo.SendLivePhoto, :class:aiogram.methods.send_paid_media.SendPaidMedia, :class:aiogram.methods.send_rich_message.SendRichMessage, :class:aiogram.methods.edit_ephemeral_message_text.EditEphemeralMessageText and

... (truncated)

Commits

• 97cfe79 Bump changelog
• 4d281df fix(i18n): resolve territory-specific locales from Telegram language_code (#1...
• 8a4f322 Rewrite the 2.x -> 3.x migration guide: fix factual errors, cover silent brea...
• c2af7b3 Added full support for the Bot API 10.3 (#1888)
• bea6716 Add Claude agent skills for pre-PR reviews, testing, codegen, and FSM dispatc...
• 7a7c350 Fix bot-level parse_mode default not applied to recently added entities (#1873)
• aaac433 Bump vulnerable dependencies to patched versions (#1872)
• ba098a5 Fix missing dispatcher contextual argument on webhook feed path (#1855) (#1856)
• c0c48ed Reuse type namespace when rebuilding models (#1861)
• fc6e5bc Fix content type detection for live photos (#1871)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits

• 03a9a11 Release 3.19
• 2d2a7ef Pre-release 3.19rc0
• 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
• 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
• ce9fd98 Merge pull request #267 from kjd/housekeeping
• 809240c Fail CI when the license copyright year is behind the current year
• d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
• ef30fee Remove dead code and pare back superfluous comments
• b907913 Tighten the version support and Unicode notes in the README
• 6204cbe Ignore local build artifacts and stop packaging stray tooling config
• Additional commits viewable in compare view

Updates multidict from 6.7.1 to 6.8.0

Release notes

Sourced from multidict's releases.

6.8.0

Bug fixes

• A segmentation fault that could be triggered when getting an item is now fixed -- by :user:Vizonex.

  Related issues and pull requests on GitHub: #1310.

• Fixed reference leak in iterators, views and istr -- by :user:Vizonex.

  Related issues and pull requests on GitHub: #1311.

• Fixed the pure-Python :class:~multidict.MultiDict constructor and :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.update, and :py:meth:~multidict.MultiDict.merge methods over-allocating their internal hash table when called with both a positional argument and keyword arguments, because keyword arguments were counted twice in the size estimate -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub: #1338.

• Fixed __repr__ of :class:~multidict.MultiDict, :class:~multidict.CIMultiDict, their proxies, and the keys/items views producing invalid output when keys contained quote characters -- keys are now formatted with :func:repr so the result is a valid Python string literal -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub: #1342.

• Fixed a segfault when calling :py:meth:~multidict.MultiDict.add with only one of its two required arguments supplied by keyword, e.g. d.add(key="k"). Extra keyword arguments passed to the lookup and removal methods are also now rejected with :exc:TypeError instead of being silently ignored.

  -- by :user:devdanzin

  Related issues and pull requests on GitHub: #1376.

• Fixed a segfault when constructing a multidict iterator type directly, e.g. type(iter(md.keys())).__new__(...). Such an iterator had a NULL internal pointer that next() dereferenced. The iterator types now forbid direct instantiation, the same way the view types were fixed in #1163.

  -- by :user:devdanzin

  Related issues and pull requests on GitHub: #1377.

... (truncated)

Changelog

Sourced from multidict's changelog.

6.8.0

(2026-09-09)

Bug fixes

• A segmentation fault that could be triggered when getting an item is now fixed -- by :user:Vizonex.

  Related issues and pull requests on GitHub: :issue:1310.

• Fixed reference leak in iterators, views and istr -- by :user:Vizonex.

  Related issues and pull requests on GitHub: :issue:1311.

• Fixed the pure-Python :class:~multidict.MultiDict constructor and :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.update, and :py:meth:~multidict.MultiDict.merge methods over-allocating their internal hash table when called with both a positional argument and keyword arguments, because keyword arguments were counted twice in the size estimate -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub: :issue:1338.

• Fixed __repr__ of :class:~multidict.MultiDict, :class:~multidict.CIMultiDict, their proxies, and the keys/items views producing invalid output when keys contained quote characters -- keys are now formatted with :func:repr so the result is a valid Python string literal -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub: :issue:1342.

• Fixed a segfault when calling :py:meth:~multidict.MultiDict.add with only one of its two required arguments supplied by keyword, e.g. d.add(key="k"). Extra keyword arguments passed to the lookup and removal methods are also now rejected with :exc:TypeError instead of being silently ignored.

  -- by :user:devdanzin

  Related issues and pull requests on GitHub: :issue:1376.

• Fixed a segfault when constructing a multidict iterator type directly, e.g. type(iter(md.keys())).__new__(...). Such an iterator had a NULL internal pointer that next() dereferenced. The iterator types now forbid direct instantiation, the same way the view types were fixed in :issue:1163.

... (truncated)

Commits

• a8d89e4 Use plain build frontend for iOS wheels in cibuildwheel (#1429)
• afa2e97 Release 6.8.0 (#1428)
• 265d3e5 Mark temporarily-removed entries via the hash's high bit, not -1 (#1426)
• 64a7046 Bump pypa/cibuildwheel from 4.2.0 to 4.2.1 (#1427)
• 5ef9f06 Remove useless pp* skip selector in cibuildwheel configs
• 884e0db Document design principle for pure-Python istr (#1425)
• ec2ec22 Fix changelog entries to use past tense (#1424)
• f3cebdc Drop dead code, _md_del_at and _md_del_at_for_update never fails (#1423)
• cd511da Fix missing decref for None on error in setdefault (#1421)
• d74a504 Add reversed() support to MultiDict views (C-ext + pure-Python) (#1340)
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates pydantic-core from 2.46.4 to 2.49.0

Commits

• See full diff in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates typing-inspection from 0.4.3 to 0.4.4

Changelog

Sourced from typing-inspection's changelog.

v0.4.4 (2026-08-12)

• Add typing_objects.DEPRECATED_ALIASES_ID by @​Viicos in #63

Commits

• 83d4dbb Prepare release v0.4.4 (#64)
• 3ac9791 Fixes to DEPRECATED_ALIASES_IDS (#65)
• 382616c Add typing_objects.DEPRECATED_ALIASES_IDS (#63)
• cef71ba Fix docs publish CI job (#62)
• 7b09e7a Fix coverage CI job (#61)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.