build(deps): bump the python-deps group with 7 updates

[dependabot]

Bumps the python-deps group with 7 updates:

Package	From	To
filelock	3.32.6	3.32.7
pypdf	6.18.1	6.19.0
azure-storage-blob	12.30.1	12.30.2
boto3	1.43.93	1.43.96
granian	2.8.2	2.8.3
litellm-proxy-extras	0.4.97	0.4.98
uvicorn	0.52.4	0.53.0

Updates filelock from 3.32.6 to 3.32.7

Release notes

Sourced from filelock's releases.

3.32.7

What's Changed

• Fix final symlink test on musl by @​lprnmns in tox-dev/filelock#737
• 📝 docs: say acquire() falls back to the lock's blocking attribute by @​hxperl in tox-dev/filelock#733

New Contributors

• @​hxperl made their first contribution in tox-dev/filelock#733

Full Changelog: tox-dev/filelock@3.32.6...3.32.7

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.1 (2026-09-19)

---

• poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

---

4.0.0 (2026-09-17)

---

• The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
• :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
• :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

---

3.32.7 (2026-09-16)

---

• Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
• Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

---

3.32.6 (2026-09-08)

---

• SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
• Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits

• 20929f7 Release 3.32.7
• 35f07c4 [pre-commit.ci] pre-commit autoupdate (#736)
• e860d39 📝 docs: say acquire() falls back to the lock's blocking attribute (#733)
• c530efe Fix final symlink test on musl (#737)
• See full diff in compare view

Updates pypdf from 6.18.1 to 6.19.0

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @​stefan6419846

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979) by @​j-t-1

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087) by @​stefan6419846
• Reduce number of full data lookups for attachment mapping API (#4081) by @​stefan6419846

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @​anandghegde
• Use page reference for existing internal link targets (#4076) by @​r-kamei
• Arabic-Indic digits are reversed during text extraction (#4077) by @​Syamjith-NK
• Parse a string rect for add_uri into a rectangle (#4074) by @​RavSinghChandan

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

• Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087)
• Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
• Use page reference for existing internal link targets (#4076)
• Arabic-Indic digits are reversed during text extraction (#4077)
• Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Commits

• d62cb58 REL: 6.19.0
• 0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
• 959467a PI: Move static value out of loop body for appearance stream data (#4087)
• 20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
• 25f2301 DEP: Replace PdfWriter method add_js (#3979)
• a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
• cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
• 96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
• 2d21901 DEV: Fix Color class for latest mypy (#4082)
• 893a010 MAINT: Split PdfDocCommon._flatten (#4070)
• Additional commits viewable in compare view

Updates azure-storage-blob from 12.30.1 to 12.30.2

Release notes

Sourced from azure-storage-blob's releases.

azure-storage-blob_12.30.2

12.30.2 (2026-09-16)

Bugs Fixed

• Fixed an issue where a header name or value containing a \r or \n was written directly into a batch request body. Such headers are now rejected with a ValueError.

Commits

• 95fcf4d [Storage] Prepare 12.30.2 release for azure-storage-blob (#49047)
• See full diff in compare view

Updates boto3 from 1.43.93 to 1.43.96

Commits

• 2be9967 Merge branch 'release-1.43.96'
• 6e1774a Bumping version to 1.43.96
• ef6f957 Add changelog entries from botocore
• 238d6ec Update PyPI package summary to add Boto3 (#4846)
• 2d18ca8 Add root workspace folder to gitignore (#4847)
• 3061d22 Merge branch 'release-1.43.95'
• 5dc82d9 Merge branch 'release-1.43.95' into develop
• 70cfb81 Bumping version to 1.43.95
• 95ba0d9 Add changelog entries from botocore
• ec50e6e Merge branch 'release-1.43.94'
• Additional commits viewable in compare view

Updates granian from 2.8.2 to 2.8.3

Release notes

Sourced from granian's releases.

Granian 2.8.3

Patch release

Changes since 2.8.2:

• Notify ASGI/RSGI apps of client disconnection on HTTP/2 stream close
• Bump dependencies

Commits

• c0b1e0b Bump dependencies
• 7301d21 Notify client disconnection on HTTP/2 stream close (#918)
• 7ca1920 Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#912)
• a51a1bf Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#911)
• ca5a97e Bump version to 2.8.3
• See full diff in compare view

Updates litellm-proxy-extras from 0.4.97 to 0.4.98

Commits

• See full diff in compare view

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions