[dependabot]

Bumps the deploy-python-dependencies group with 19 updates in the /deploy directory:

Package	From	To
alembic	1.20.0	1.20.1
certifi	2026.7.22	2026.10.23
fastapi	0.142.4	0.162.0
httptools	0.8.0	0.9.0
markupsafe	3.0.3	3.0.4
numpy	2.5.3	2.5.4
ome-types	0.6.3	0.7.0
opentelemetry-api	1.45.0	1.45.1
pillow	12.3.0	13.0.0
pycparser	3.0	3.12
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
pydantic-settings	2.15.0	2.16.1
sqlalchemy	2.0.54	2.1.6
starlette	1.7.0	1.10.0
tifffile	2026.9.20	2026.10.15
websockets	17.1	17.3
xsdata	26.2	26.10
oci-cli	3.94.1	3.95.1

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Updates fastapi from 0.142.4 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

• 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

• ✨ Add support for combining unions of form models. PR #16596 by @​tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

• 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @​dependabot[bot].

0.159.1

Features

• ✨ Add support for optional unions of form models. PR #16586 by @​tiangolo.

0.159.0

Features

• ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

• ✨ Add support for optional form models. PR #16582 by @​tiangolo.

0.158.1

... (truncated)

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• Additional commits viewable in compare view

Updates httptools from 0.8.0 to 0.9.0

Release notes

Sourced from httptools's releases.

v0.9.0

• Upgrade llhttp to 9.4.3 (#153) (by @​elprans in eab7f640)

• Build CPython 3.15 wheels (#148) (by @​edgarrmondragon in b03516d9)

• Add RISC-V 64-bit wheels (#137) (by @​gounthar in 1c6946dc)

• Add Windows ARM64 support in CI (#141) (by @​Harishmcw in 5a2bb07c)

• Build PPC64LE wheels (#143) (by @​Sunidhi-Gaonkar1 in ff08b99d)

• Modernize test and release workflows (#152) (by @​elprans in d80e26fe)

Commits

• 1041984 Merge pull request #154 from MagicStack/release-0.9.0
• aa5fbf9 httptools v0.9.0
• eab7f64 Upgrade llhttp to 9.4.3 (#153)
• d80e26f Modernize test and release workflows (#152)
• b03516d Build CPython 3.15 wheels (#148)
• ff08b99 Build PPC64LE wheels (#143)
• 5a2bb07 Add Windows ARM64 support in CI (#141)
• 1c6946d ci: add riscv64 to wheel build matrix (#137)
• See full diff in compare view

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. :issue:521

Commits

• ece2607 release version 3.0.4
• 620bc80 split archs
• 73c3be1 fix wheel builds (#536)
• d8ae19e fix wheel builds
• ff1eaff Build Android and iOS wheels (#516)
• 87e64f9 build Android and iOS wheels
• bc33c55 Build ppc64le wheels (#518)
• 0ddd6ea build ppc64le wheels
• 3e07758 Build armv7l wheels (#514)
• 39b9aae build armv7l wheels
• Additional commits viewable in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates ome-types from 0.6.3 to 0.7.0

Release notes

Sourced from ome-types's releases.

v0.7.0

What's Changed

• chore: update ome-xml XSD by @​tlambert03 in imaging-formats/ome-types#301
• chore: move org by @​tlambert03 in imaging-formats/ome-types#303
• ci: fix tests for pytest-mypy-plugins 4.0 by @​tlambert03 in imaging-formats/ome-types#309
• chore: repo refresh (2026-10) by @​tlambert03 in imaging-formats/ome-types#310
• ci: fix PySide6 widget test crash by @​tlambert03 in imaging-formats/ome-types#311
• fix: handle 2013-06s namespace typo from python-bioformats by @​tlambert03 in imaging-formats/ome-types#308
• ci: fix readthedocs build and pre-commit mypy by @​tlambert03 in imaging-formats/ome-types#312
• Ci/modernize tooling by @​tlambert03 in imaging-formats/ome-types#313

Full Changelog: imaging-formats/ome-types@v0.6.3...v0.7.0

Commits

• b220a87 Ci/modernize tooling (#313)
• 40c4b67 ci: fix readthedocs build and pre-commit mypy (#312)
• ef0b395 fix: handle 2013-06s namespace typo from python-bioformats (#308)
• 690b8c9 ci: fix PySide6 widget test crash (#311)
• 2fa7656 chore: repo refresh (2026-10) (#310)
• 6a2f40b ci: fix tests for pytest-mypy-plugins 4.0 (#309)
• c9c5438 chore: move org (#303)
• 2185f54 ci: dependabot quarterly interval and group actions
• c6c20d6 chore: update schema (#301)
• See full diff in compare view

Updates opentelemetry-api from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Commits

• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• See full diff in compare view

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

• Remove undocumented GifImagePlugin._save_netpbm #9901 [@​akx]
• Remove ExifTags.IFD.Makernote #9850 [@​radarhere]
• Drop support for Python 3.10 #9750 [@​hugovk]
• Remove deprecations for Pillow 13.0.0 #9751 [@​radarhere]

Deprecations

• Deprecate IM image format #9849 [@​radarhere]
• Deprecate ImageQt align8to32() in favour of raw encoder stride #9940 [@​akx]
• Deprecate JpegImageFile.load_djpeg #9924 [@​akx]

Documentation

• Update release notes for Pillow 13.0.0 #10223 [@​hugovk]
• Correct the ImageOps.fit centering corner documentation #10118 [@​FanWu-ai]
• Update Tidelift links #10102 [@​radarhere]
• Correct bullet point syntax in release notes #10069 [@​radarhere]
• Update ImageDraw signatures in docs #10065 [@​ZainnQureshii]
• Update macOS tested Pillow versions #10048 [@​hugovk]
• Add pillow-wmf and pillow-zx-spectrum to third-party plugins list #10037 [@​bitplane]
• Delete CLAUDE.md #10027 [@​hugovk]
• Add pillow-lunasvg to third-party plugins list #10016 [@​Maksim-Burtsev]
• Extend security policy #10018 [@​hugovk]
• Update Color3DLUT description #10004 [@​radarhere]
• Document the internal image distinctness constraints #9752 [@​akx]
• Update macOS tested Pillow versions #10000 [@​radarhere]
• Link security policy in project metadata #9980 [@​hugovk]
• Image.new(): correct docstring and comment about uninitialized memory #9960 [@​akx]
• Add AGENTS.md #9582 [@​aclark4life]
• Add release notes for #8811 #9937 [@​radarhere]
• Fixed typo #9923 [@​radarhere]
• Fixed typo #9922 [@​radarhere]
• C interface is internal #9879 [@​radarhere]
• Correct function references #9895 [@​radarhere]
• Revert move from python-pillow.org to python-pillow.github.io #9830 [@​aclark4life]
• Add additional CVE numbers to 12.3.0 release notes #9777 [@​radarhere]
• Remove remaining :rtype:s from docstrings #9742 [@​akx]
• Update macOS tested Pillow versions #9759 [@​radarhere]

Dependencies

• Update dependency cibuildwheel to v4.3.1 #10175 [@renovate[bot]]
• Update dependency cibuildwheel to v4.3.0 #10132 [@renovate[bot]]
• Update dependency harfbuzz to v14.5.0 #10108 [@renovate[bot]]
• Update github-actions #10111 [@renovate[bot]]

... (truncated)

Commits

• 293218a 13.0.0 version bump
• 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
• af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
• 0a87417 Bound retained TIFF tag data by stream size (#10225)
• 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
• 8501adc Fix test
• ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
• 4b63dff Share TIFF tag data budget across frames
• Additional commits viewable in compare view

Updates pycparser from 3.0 to 3.12

Release notes

Sourced from pycparser's releases.

release_v3.12

What's Changed

• Emit one type definition for declarators that share it by @​Cherith1222 in eliben/pycparser#621
• raise ParseError for _Atomic applied to array or function type by @​arfa-21 in eliben/pycparser#623
• Fix code generation for the _Pragma operator by @​hulkbig in eliben/pycparser#625
• Parse GNU statement expressions as primary expressions by @​hulkbig in eliben/pycparser#628
• Fix shared type declarations in switch cases by @​hulkbig in eliben/pycparser#630
• raise ParseError for typedef in a parameter declaration by @​arfa-21 in eliben/pycparser#631
• Scope for loop init declarations to the loop by @​arfa-21 in eliben/pycparser#634

Full Changelog: eliben/pycparser@release_v3.11...release_v3.12

release_v3.11

Enhanced C11 support

Full Changelog: eliben/pycparser@release_v3.01...release_v3.11

release_v3.01

What's Changed

• Drop an unneeded direct build depndency on wheel by @​hroncok in eliben/pycparser#597
• fix: handle integer suffix in #line directive without crashing by @​SAY-5 in eliben/pycparser#601
• Update default branch to main by @​myd7349 in eliben/pycparser#602
• fix: raise ParseError instead of AssertionError on unmatched '}' by @​patchwright in eliben/pycparser#604
• Add support for Python 3.15 by @​kytta in eliben/pycparser#605
• Fix empty compound literal (type){} raising ParseError by @​IMGillusion in eliben/pycparser#606
• Fix compound literal statements in C generator by @​Rayan-and-beyond in eliben/pycparser#607
• Keep the contents of adjacent u8 string literals by @​SashaMIT in eliben/pycparser#609

Full Changelog: eliben/pycparser@release_v3.00...release_v3.01

Commits

• 3ec766b Tweak build
• 1771cbf Prepare to release 3.12
• 51715bf Add documentation on using methods of ast node
• 878c289 Support va_arg properly
• 840fe55 Add some Linux kernel headers to benchmark
• 8fd2299 Add ArrayDesignator AST node to distinguish array indices in designators
• aa32af5 Fix crashes in generator with empty case bodies
• f29e8ef Regression test for #215
• a74aa74 Support form feed and vertical tabs as whitespace
• 02380d0 Comment fixes
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

Two security fixes are fixed by this release: GHSA-gj4f-r7mf-jjxh and GHSA-955g-x97g-8mcp.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Reject large exponents in Fraction validation by @​Viicos in #13944. Addresses GHSA-gj4f-r7mf-jjxh.
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945. Addresses GHSA-955g-x97g-8mcp.
• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef ...

  Description has been truncated

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T22:39:23.709315Z	023ceeb	PR opened
🔒 Security Review	✅ Completed 2026-10-29T22:40:11.143097Z	023ceeb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 023ceeb6f8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep the backend lock within project constraints

When any CI job runs its “Install tests with the production SQLAlchemy version” step, the sed expression in .github/workflows/ci.yml passes sqlalchemy==2.1.6 alongside the local package, whose pyproject.toml still requires sqlalchemy>=2.0,<2.1; pip therefore reports incompatible requirements before the tests can run. The same regenerated lock also exceeds the declared FastAPI, Pillow, and tifffile constraints, and the deployment's later --no-deps install merely hides those metadata conflicts. Regenerate the lock within the existing project constraints or update the project constraints and their pinned-version tests together.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Regenerate the dependency and software inventories

When CI reaches scripts/validate_dependency_inventory.py, this new pypi:oci-cli@3.95.1 ID (and the other upgraded Python IDs) is absent from docs/supply-chain/dependency-inventory.json, which still records oci-cli@3.94.1; the validator compares the lock-derived and recorded ID sets and fails with a Python reconciliation mismatch. The derived SBOMs and THIRD_PARTY_NOTICES.txt are stale as well, so the production image embeds notices for the old artifacts instead of the upgraded runtime. Regenerate the dependency inventory and all derived software inventories with the lock changes.

Useful? React with 👍 / 👎.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.