deps: bump the pip-minor-patch group across 1 directory with 19 updates by dependabot[bot] · Pull Request #175 · KayzenRoot/hive

dependabot · 2026-10-12T04:27:15Z

Bumps the pip-minor-patch group with 19 updates in the / directory:

Package	From	To
alembic	`1.15.1`	`1.20.0`
fastapi	`0.133.0`	`0.143.0`
python-multipart	`0.0.31`	`0.0.32`
pypdf	`6.16.2`	`6.19.0`
anyio	`4.14.2`	`4.15.1`
idna	`3.19`	`3.20`
pydantic	`2.13.5`	`2.14.0`
pydantic-core	`2.46.5`	`2.50.0`
pydantic-settings	`2.7.1`	`2.15.0`
psycopg	`3.2.4`	`3.3.6`
psycopg-binary	`3.2.4`	`3.3.6`
sqlalchemy	`2.0.38`	`2.1.4`
python-dotenv	`1.2.3`	`1.2.4`
starlette	`1.3.1`	`1.7.0`
tzdata	`2026.3`	`2026.5`
uvicorn	`0.34.0`	`0.54.0`
mako	`1.3.12`	`1.4.3`
jsonschema	`4.23.0`	`4.26.0`
ruff	`0.9.4`	`0.16.10`

Updates alembic from 1.15.1 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

[usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

References: #1846

[usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

References: #916

bug

[bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

References: #1768

[bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

See full diff in compare view

Updates fastapi from 0.133.0 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @tiangolo.

0.142.4

Fixes

🐛 Isolate FastAPI telemetry for excluded requests. PR #16470 by @tiangolo.

0.142.3

Fixes

🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @tiangolo.

Docs

📝 Remove HTML title from newsletter to avoid the tooltip. PR #16461 by @tiangolo.

📝 Embed the FastAPI and friends newsletter signup form. PR #16459 by @tiangolo.

📝 Update skill, use Asyncer for blocking code in threads. PR #16420 by @tiangolo.

Translations

🌐 Update translations for fr (add-missing). PR #16436 by @pr-submit[bot].

🌐 Update translations for hi (add-missing). PR #16435 by @pr-submit[bot].

🌐 Update translations for tr (add-missing). PR #16434 by @pr-submit[bot].

🌐 Update translations for zh (add-missing). PR #16433 by @pr-submit[bot].

🌐 Update translations for zh-hant (add-missing). PR #16432 by @pr-submit[bot].

🌐 Update translations for pt (add-missing). PR #16431 by @pr-submit[bot].

🌐 Update translations for de (add-missing). PR #16430 by @pr-submit[bot].

🌐 Update translations for uk (add-missing). PR #16429 by @pr-submit[bot].

🌐 Update translations for ja (add-missing). PR #16428 by @pr-submit[bot].

🌐 Update translations for ko (add-missing). PR #16425 by @pr-submit[bot].

🌐 Update translations for es (add-missing). PR #16426 by @pr-submit[bot].

🌐 Update translations for ru (add-missing). PR #16427 by @pr-submit[bot].

🌐 Update Russian LLM-prompt. PR #16449 by @YuriiMotov.

Internal

👷 Fix deprecated command in bump-pre-commit-hooks workflow. PR #16463 by @YuriiMotov.

🔧 Update sponsors: remove Render. PR #16457 by @tiangolo.

🔨 Use gpt-6-astra model for translations. PR #16453 by @YuriiMotov.

⬆ Bump the python-packages group across 1 directory with 14 updates. PR #16447 by @dependabot[bot].

⬆ Bump starlette from 1.6.0 to 1.7.0. PR #16440 by @dependabot[bot].

⬆ Bump pyjwt from 2.13.0 to 2.15.0. PR #16423 by @dependabot[bot].

⬆ Bump gitpython from 3.1.60 to 3.1.62. PR #16444 by @dependabot[bot].

... (truncated)

Commits

f5c6e9b 🔖 Release version 0.143.0 (#16477)
182c8b8 📝 Update release notes
af889e4 💥 Require opt-in for automatic OpenTelemetry exporter setup (#16476)
9269f17 🔖 Release version 0.142.4 (#16471)
78ede01 📝 Update release notes
4e31a07 🐛 Isolate FastAPI telemetry for excluded requests (#16470)
cb8dabc 🔖 Release version 0.142.3 (#16469)
787dc56 📝 Update release notes
6eae2f3 🐛 Cache OpenTelemetry tracers to preserve warning deduplication (#16468)
94918c1 📝 Update release notes
Additional commits viewable in compare view

Updates python-multipart from 0.0.31 to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

Replace per-byte partial-boundary scan with rfind lookbehind by @Kludex in Kludex/python-multipart#300

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

Speed up partial-boundary scanning for CR/LF-dense part data #300.

Commits

238ead6 Version 0.0.32 (#302)
8672979 Replace per-byte partial-boundary scan with rfind lookbehind (#300)
8190779 Bump the python-packages group with 7 updates (#301)
0d3c086 Use uv package ecosystem for Dependabot (#299)
See full diff in compare view

Updates pypdf from 6.16.2 to 6.19.0

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

Limit size of alphabetical page labels (#4096) by @stefan6419846

Deprecations (DEP)

Replace PdfWriter method add_js (#3979) by @j-t-1

Performance Improvements (PI)

Move static value out of loop body for appearance stream data (#4087) by @stefan6419846

Reduce number of full data lookups for attachment mapping API (#4081) by @stefan6419846

Bug Fixes (BUG)

Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @anandghegde

Use page reference for existing internal link targets (#4076) by @r-kamei

Arabic-Indic digits are reversed during text extraction (#4077) by @Syamjith-NK

Parse a string rect for add_uri into a rectangle (#4074) by @RavSinghChandan

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

Further restrict FlateDecode recovery (#4073) by @stefan6419846

Limit entry count for TrueType and Type1 font /Widths (#4072) by @stefan6419846

Limit allowed length of tokens in parse_bfchar (#4071) by @stefan6419846

Bug Fixes (BUG)

Use current text matrix for visitor_text (#4062) by @r-kamei

Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @youdie006

Use font color for FreeText default appearance (#4051) by @Yuki9814

Robustness (ROB)

Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @MeggyCal and @stefan6419846

Documentation (DOC)

Use combined matrix in visitor examples (#4066) by @r-kamei

Full Changelog

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

Use apply_configuration as a context manager to temporarily overwrite configuration values.

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

Move static value out of loop body for appearance stream data (#4087)

Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

Do not copy unrelated pages when appending pages with non-terminal fields (#4078)

Use page reference for existing internal link targets (#4076)

Arabic-Indic digits are reversed during text extraction (#4077)

Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

Further restrict FlateDecode recovery (#4073)

Limit entry count for TrueType and Type1 font /Widths (#4072)

Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

Use current text matrix for visitor_text (#4062)

Repeat the letter for /S /A and /S /a page labels past Z (#4065)

Use font color for FreeText default appearance (#4051)

Robustness (ROB)

Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

Use combined matrix in visitor examples (#4066)

Full Changelog

Version 6.18.0, 2026-09-07

Security (SEC)

Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

Rework configuration value handling (#4044)

New Features (ENH)

Draw borders and backgrounds for appearance streams and annotations (#4033)

... (truncated)

Commits

d62cb58 REL: 6.19.0
0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
959467a PI: Move static value out of loop body for appearance stream data (#4087)
20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
25f2301 DEP: Replace PdfWriter method add_js (#3979)
a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
2d21901 DEV: Fix Color class for latest mypy (#4082)
893a010 MAINT: Split PdfDocCommon._flatten (#4070)
Additional commits viewable in compare view

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

follow_symlinks on exists() (Python 3.12+)

follow_symlinks on is_dir() (Python 3.13+)

follow_symlinks on is_file() (Python 3.13+)

follow_symlinks on owner() (Python 3.13+)

follow_symlinks on group() (Python 3.13+)

newline on read_text() (Python 3.13+)

(#1286, #1293; PR by @jaideeppyne)

Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @Graeme22)

Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @EmmanuelNiyonshuti)

Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @Vizonex)

Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @nightcityblade)

Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @davidbrochart)

Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @gschaffner)

Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @EmmanuelNiyonshuti)

Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @c-tonneslan)

Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @Graeme22)

Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @gschaffner)

Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @tapetersen)

Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @Sanjays2402)

Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @alloutflo)

Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @matthewfeickert)

Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @hansu650)

Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @zelinewang)

... (truncated)

Commits

ffcd154 Bumped up the version
0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
9283662 Bumped up the version
d137692 Improved the instructions for AI agents
033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
b825c3b Fixed pyproject.toml changes not triggering the test suite
9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
b05fe6d Fixed wrong type in move_on_after (#1297)
44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
Additional commits viewable in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

Commits

d55e65e Release 3.20
0c0824a Pre-release 3.20rc0
bd7c316 Note Python 3.15 support in the 3.20 changelog
b6cce85 Merge pull request #276 from kjd/unicode-18
9a4bc59 Update to Unicode 18.0.0
dfab5a0 Merge branch 'python-3.15'
417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
cd17392 Merge pull request #274 from kjd/fix-decode-length-check
c5796d7 Skip the decode round-trip check for domains past encode's length limit
d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

Allow any CoreSchema to be used as serialization by @Viicos in #13680

Add support for frozendict type by @Viicos in #13634

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

fcdefa7 Correct v2.14.0 release date (#13952)
c821eac Revert "Respect config in TypeAdapter.json_schemas() (#13890)" (#13951)
a656b75 Prepare release v2.14.0 (#13948)
b4028f9 Avoid validating URL prefix multiple times in multi host URLs (#13945)
69ed168 Reject large exponents in Fraction validation (#13944)
895c0c2 Fix datetime parsing in custom validator examples (#13931)
d2cbaaa Bump virtualenv from 20.36.1 to 21.7.13 (#13943)
3fbc25a Bump pydantic-core dependencies (#13942)
027b5c7 Rebuild incomplete types during serialization inference (#13922)
2706d1f Handle exceptions during Decimal validation (#13940)
Additional commits viewable in compare view

Updates pydantic-core from 2.46.5 to 2.50.0

Commits

fcdefa7 Correct v2.14.0 release date (#13952)
c821eac Revert "Respect config in TypeAdapter.json_schemas() (#13890)" (#13951)
a656b75 Prepare release v2.14.0 (#13948)
b4028f9 Avoid validating URL prefix multiple times in multi host URLs (#13945)
69ed168 Reject large exponents in Fraction validation (#13944)
895c0c2 Fix datetime parsing in custom validator examples (#13931)
d2cbaaa Bump virtualenv from 20.36.1 to 21.7.13 (#13943)
3fbc25a Bump pydantic-core dependencies (#13942)
027b5c7 Rebuild incomplete types during serialization inference (#13922)
2706d1f Handle exceptions during Decimal validation (#13940)
Additional commits viewable in compare view

Updates pydantic-settings from 2.7.1 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.

Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.

Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.

PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.

toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.

Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.

GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.

Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.

Fix AliasPath on nested model fields not JSON-decoding env values (#898).

Fix case-insensitive matching for optional nested models (#905).

Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.

Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).

Fix Secret subclasses crashing when loaded from the environment (#920).

Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).

An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).

NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).

GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.

AWS: types-boto3[secretsmanager] is no longer required at runtime (

Bumps the pip-minor-patch group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [alembic](https://github.com/sqlalchemy/alembic) | `1.15.1` | `1.20.0` | | [fastapi](https://github.com/fastapi/fastapi) | `0.133.0` | `0.143.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.31` | `0.0.32` | | [pypdf](https://github.com/py-pdf/pypdf) | `6.16.2` | `6.19.0` | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` | | [idna](https://github.com/kjd/idna) | `3.19` | `3.20` | | [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.0` | | [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.5` | `2.50.0` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.7.1` | `2.15.0` | | [psycopg](https://github.com/psycopg/psycopg) | `3.2.4` | `3.3.6` | | [psycopg-binary](https://github.com/psycopg/psycopg) | `3.2.4` | `3.3.6` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.38` | `2.1.4` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.3` | `1.2.4` | | [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.7.0` | | [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.5` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.34.0` | `0.54.0` | | [mako](https://github.com/sqlalchemy/mako) | `1.3.12` | `1.4.3` | | [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.23.0` | `4.26.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.9.4` | `0.16.10` | Updates `alembic` from 1.15.1 to 1.20.0 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `fastapi` from 0.133.0 to 0.143.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.133.0...0.143.0) Updates `python-multipart` from 0.0.31 to 0.0.32 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.31...0.0.32) Updates `pypdf` from 6.16.2 to 6.19.0 - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.16.2...6.19.0) Updates `anyio` from 4.14.2 to 4.15.1 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.2...4.15.1) Updates `idna` from 3.19 to 3.20 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.19...v3.20) Updates `pydantic` from 2.13.5 to 2.14.0 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.13.5...v2.14.0) Updates `pydantic-core` from 2.46.5 to 2.50.0 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@core-v2.46.5...core-v2.50.0) Updates `pydantic-settings` from 2.7.1 to 2.15.0 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.7.1...v2.15.0) Updates `psycopg` from 3.2.4 to 3.3.6 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.2.4...3.3.6) Updates `psycopg-binary` from 3.2.4 to 3.3.6 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.2.4...3.3.6) Updates `sqlalchemy` from 2.0.38 to 2.1.4 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `python-dotenv` from 1.2.3 to 1.2.4 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4) Updates `starlette` from 1.3.1 to 1.7.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.3.1...1.7.0) Updates `tzdata` from 2026.3 to 2026.5 - [Release notes](https://github.com/python/tzdata/releases) - [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md) - [Commits](python/tzdata@2026.3...2026.5) Updates `uvicorn` from 0.34.0 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.34.0...0.54.0) Updates `mako` from 1.3.12 to 1.4.3 - [Release notes](https://github.com/sqlalchemy/mako/releases) - [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/mako/commits) Updates `jsonschema` from 4.23.0 to 4.26.0 - [Release notes](https://github.com/python-jsonschema/jsonschema/releases) - [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst) - [Commits](python-jsonschema/jsonschema@v4.23.0...v4.26.0) Updates `ruff` from 0.9.4 to 0.16.10 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/0.16.10/CHANGELOG.md) - [Commits](astral-sh/ruff@0.9.4...0.16.10) --- updated-dependencies: - dependency-name: alembic dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: fastapi dependency-version: 0.143.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: python-multipart dependency-version: 0.0.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-patch - dependency-name: pypdf dependency-version: 6.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: anyio dependency-version: 4.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: idna dependency-version: '3.20' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: pydantic dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: pydantic-core dependency-version: 2.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: pydantic-settings dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: psycopg dependency-version: 3.3.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: psycopg-binary dependency-version: 3.3.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: sqlalchemy dependency-version: 2.1.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: python-dotenv dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-patch - dependency-name: starlette dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: tzdata dependency-version: '2026.5' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: mako dependency-version: 1.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: jsonschema dependency-version: 4.26.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: ruff dependency-version: 0.16.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pip-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-12T04:27:23Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: be5c493f-31a5-46b6-a9db-b1ab12347664

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-10-12T04:28:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
pypi/psycopg@3.2.4 ⏵ 3.3.6	⁺¹
pypi/psycopg-binary@3.2.4 ⏵ 3.3.6
pypi/tzdata@2026.3 ⏵ 2026.5
pypi/sqlalchemy@2.0.38 ⏵ 2.1.4
pypi/anyio@4.14.2 ⏵ 4.15.1
pypi/mako@1.3.12 ⏵ 1.4.3	⁺¹	⁺²
pypi/alembic@1.15.1 ⏵ 1.20.0
pypi/uvicorn@0.34.0 ⏵ 0.54.0
pypi/jsonschema@4.23.0 ⏵ 4.26.0	⁺¹
pypi/python-dotenv@1.2.3 ⏵ 1.2.4	⁺¹
pypi/pypdf@6.16.2 ⏵ 6.19.0		⁺⁷⁵
pypi/python-multipart@0.0.31 ⏵ 0.0.32
pypi/pydantic@2.13.5 ⏵ 2.14.0	⁺¹
pypi/starlette@1.3.1 ⏵ 1.7.0	⁺¹
pypi/ruff@0.9.4 ⏵ 0.16.10	⁺¹
pypi/pydantic-core@2.46.5 ⏵ 2.50.0	⁺¹
pypi/fastapi@0.133.0 ⏵ 0.143.0	⁺¹
pypi/pydantic-settings@2.7.1 ⏵ 2.15.0	⁺¹
pypi/idna@3.19 ⏵ 3.20	⁺¹

View full report

dependabot Bot requested a review from KayzenRoot as a code owner October 12, 2026 04:27

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 12, 2026

Navigation Menu

Repository navigation

deps: bump the pip-minor-patch group across 1 directory with 19 updates - #175

deps: bump the pip-minor-patch group across 1 directory with 19 updates#175
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-minor-patch-008f44f2b1

dependabot Bot commented on behalf of github Oct 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

socket-security Bot commented Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.20.0

usecase

bug

0.143.0

Breaking Changes

0.142.4

Fixes

0.142.3

Fixes

Docs

Translations

Internal

Version 0.0.32

What's Changed

0.0.32 (2026-06-04)

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

Deprecations (DEP)

Performance Improvements (PI)

Bug Fixes (BUG)

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Documentation (DOC)

Version 6.18.0, 2026-09-07

What's new

Version 6.19.0, 2026-09-16

Security (SEC)

Deprecations (DEP)

Performance Improvements (PI)

Bug Fixes (BUG)

Version 6.18.1, 2026-09-11

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Documentation (DOC)

Version 6.18.0, 2026-09-07

Security (SEC)

Deprecations (DEP)

New Features (ENH)

4.15.1

4.15.0

v3.20

3.20 (2026-09-17)

v2.14.0 2026-10-08

What's Changed

New Features

Changes

Fixes

v2.14.0b2 2026-09-09

What's Changed

New Features

v2.14.0 (2026-10-08)

What's Changed

New Features

Changes

Fixes

New Contributors

v2.14.0b2 (2026-09-09)

v2.15.0

Highlights

Behavior changes

New features

Bug fixes

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

socket-security Bot commented Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

dependabot Bot commented on behalf of github Oct 12, 2026 •

edited

Loading