Skip to content

chore(deps): bump the runtime-dependencies group across 1 directory with 13 updates - #111

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/runtime-dependencies-075adb6067
Open

chore(deps): bump the runtime-dependencies group across 1 directory with 13 updates#111
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/runtime-dependencies-075adb6067

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown

Bumps the runtime-dependencies group with 13 updates in the / directory:

Package From To
aiohttp 3.14.3 3.14.5
pydantic 2.13.5 2.14.0
python-dotenv 1.2.3 1.2.4
sqlalchemy 2.0.54 2.1.4
msgspec 0.21.1 0.22.0
typer 0.27.2 0.27.3
fastapi 0.141.1 0.143.0
ruff 0.16.7 0.17.0
mypy 2.3.1 2.4.0
types-jsonschema 4.26.0.20260518 4.26.0.20261006
types-requests 2.33.0.20260906 2.33.0.20261006
openai-agents 0.22.2 0.23.1
bump-my-version 1.5.1 1.6.0

Updates aiohttp from 3.14.3 to 3.14.5
Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • See full diff in compare view

Updates sqlalchemy from 2.0.54 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

    References: #13659

engine

  • [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

    This change is also backported to: 2.0.55

    References: #13640

  • [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

    This change is also backported to: 2.0.55

    References: #13641

  • [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

Updates msgspec from 0.21.1 to 0.22.0

Release notes

Sourced from msgspec's releases.

Version 0.22.0 (2026-09-29)

  • BREAKING: Setting gc=False on a struct type that has a weakref slot, whether from weakref=True or from a base class, now raises ValueError. On CPython 3.12 and later the weakref slot is stored in a pre-header in front of the instance, so releasing an instance of a gc=False type with that slot corrupted memory, in most builds crashing the interpreter outright. The combination worked on 3.10 and 3.11, and the restriction applies there as well, so that the same class definition behaves the same way on every supported version (#1207).
  • Add frozendict support on Python 3.15+ (#1052, #1105).
  • Support passing a callable as decimal_format to msgspec.json.Encoder and msgspec.msgpack.Encoder for custom Decimal encoding (#978).
  • Support Literal[True] and Literal[False] types (#1004).
  • Publish CPython 3.15 wheels, including freethreaded builds (#1152).
  • Publish Linux riscv64 wheels (#987).
  • Support the PyEmscripten (Pyodide) platform (#1083).
  • Fix handling of PEP 695 type parameter syntax (class Foo[T]) and of types.GenericAlias instances in type annotations (#962).
  • Fix NameError when creating a Struct with an unquoted forward reference on Python 3.14 (#1165).
  • Fix a crash on incorrect typing.ClassVar annotations (#1097).
  • Fix an AttributeError when converting to a Struct type defined in a namespace without a __name__ (#1072).
  • Fix overriding an inherited field alias back to the field's own name (#1133).
  • Raise ValidationError instead of SystemError when convert receives an out-of-range int for a float target (#1162).
  • Report raw rather than the misleading any as the expected type when a non-Raw value is given for a Raw field in convert, and therefore in yaml.decode and toml.decode (#1169).
  • Fix an empty expected-type name in validation errors for a required Raw field in a TypedDict, or a Raw field with a default_factory on a dataclass or an attrs class (#1176).
  • Correct the error messages for out-of-range Meta length bounds (#1172).
  • Fix a reference leak when decoding msgpack Ext payloads (#1109).
  • Fix backing type declaration of Ext.code (#1135).
  • Fix a reference leak in msgspec.to_builtins, and therefore in yaml.encode, for array_like=True structs (#1177).
  • Fix reference leaks in typenode_collect_literal, Meta.__rich_repr__, ms_decode_bigint, and Encoder.__init__ (#1021, #1022, #1023, #1040).
  • Fix msgspec.inspect.type_info and msgspec.json.schema crashing on mixed-type Literals such as Literal[1, None] (#1080).
  • Place null last in the anyOf generated for optional unions in JSON schemas (#1028).
  • Fix minItems in the JSON schema for array_like=True structs whose fields are all optional (#1124).
  • Use [] or "" rather than a Python set or bytearray object as the JSON schema default for Struct fields with a set or bytearray

... (truncated)

Changelog

Sourced from msgspec's changelog.

Version 0.22.0 (2026-09-29)

  • BREAKING: Setting gc=False on a struct type that has a weakref slot, whether from weakref=True or from a base class, now raises ValueError. On CPython 3.12 and later the weakref slot is stored in a pre-header in front of the instance, so releasing an instance of a gc=False type with that slot corrupted memory, in most builds crashing the interpreter outright. The combination worked on 3.10 and 3.11, and the restriction applies there as well, so that the same class definition behaves the same way on every supported version ({pr}1207).
  • BREAKING: Encode an object as a dataclass only when its type defines __dataclass_fields__, as dataclasses.is_dataclass does. Objects that expose it only through instance attribute access, such as proxies wrapping a dataclass instance, are now passed to enc_hook, and encoding them raises TypeError when no enc_hook is given. An enc_hook can return the wrapped instance, which is then encoded as a dataclass. Objects with a Python-level __getattr__, such as pydantic models, now reach enc_hook without that __getattr__ being called ({pr}1196).
  • Add frozendict support on Python 3.15+ ({pr}1052, {pr}1105).
  • Support passing a callable as decimal_format to msgspec.json.Encoder and msgspec.msgpack.Encoder for custom Decimal encoding ({pr}978).
  • Support Literal[True] and Literal[False] types ({pr}1004).
  • Publish CPython 3.15 wheels, including freethreaded builds ({pr}1152).
  • Publish Linux riscv64 wheels ({pr}987).
  • Support the PyEmscripten (Pyodide) platform ({pr}1083).
  • Fix handling of PEP 695 type parameter syntax (class Foo[T]) and of types.GenericAlias instances in type annotations ({pr}962).
  • Fix NameError when creating a Struct with an unquoted forward reference on Python 3.14 ({issue}1165).
  • Fix a crash on incorrect typing.ClassVar annotations ({pr}1097).
  • Raise TypeError instead of crashing when a base class of a Struct type is a C extension type that has not been initialized with PyType_Ready yet ({pr}1199).
  • Fix an AttributeError when converting to a Struct type defined in a namespace without a __name__ ({pr}1072).
  • Fix overriding an inherited field alias back to the field's own name ({pr}1133).
  • Raise ValidationError instead of SystemError when convert receives an out-of-range int for a float target ({pr}1162).
  • Report raw rather than the misleading any as the expected type when a non-Raw value is given for a Raw field in convert, and therefore in yaml.decode and toml.decode ({pr}1169).
  • Fix an empty expected-type name in validation errors for a required Raw field in a TypedDict, or a Raw field with a default_factory on a dataclass or an attrs class ({pr}1176).
  • Correct the error messages for out-of-range Meta length bounds ({pr}1172).
  • Fix a reference leak when decoding msgpack Ext payloads ({pr}1109).
  • Fix backing type declaration of Ext.code ({pr}1135).
  • Raise DecodeError instead of TypeError when a decoded msgpack map key is

... (truncated)

Commits
  • 6d3443f Fix a reference leak of a non-Struct base's type dict (#1199)
  • 2f0b50d Correct the reported signatures of several public callables (#1197)
  • 8a25471 Skip instance __dataclass_fields__ lookup for non-dataclass types (#1196)
  • 7930780 Fix reference leak when defining a Struct type (#1194)
  • 55f5cdd fix(msgpack): raise DecodeError for unhashable map keys (#1209)
  • b2d1b7a Reject gc=False on struct types with a weakref slot (#1207)
  • f2bbec5 Move the unreleased changes into the 0.22.0 changelog (#1211)
  • c23e150 Fix json schema defaults for set / bytearray default_factory fields (#1183)
  • fed9fc3 Skip recursive type alias test on Windows ARM64 with Python 3.12 (#1210)
  • e7552f0 Bump msgpack from 1.2.1 to 1.2.2 (#1202)
  • Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates fastapi from 0.141.1 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates ruff from 0.16.7 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (

@dependabot
chore(deps): bump the runtime-dependencies group across 1 directory w…
74e5380 
…ith 13 updates

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: sqlalchemy
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: msgspec
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: types-jsonschema
  dependency-version: 4.26.0.20261006
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: types-requests
  dependency-version: 2.33.0.20261006
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: openai-agents
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: bump-my-version
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 14, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants