Skip to content

chore(deps): bump the backend group across 1 directory with 8 updates - #377

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-9ec84a7636
Open

chore(deps): bump the backend group across 1 directory with 8 updates#377
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-9ec84a7636

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend group with 8 updates in the /backend directory:

Package From To
alembic 1.19.1 1.20.0
fastapi 0.141.1 0.142.2
python-dotenv 1.2.3 1.2.4
pyjwt 2.13.0 2.15.1
sqlalchemy 2.0.52 2.1.2
strawberry-graphql 0.327.2 0.328.2
uvicorn 0.52.4 0.54.0
tzdata 2026.3 2026.4

Updates alembic from 1.19.1 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

  • [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

    References: #1846

  • [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

    References: #916

bug

  • [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

    References: #1768

  • [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

Updates fastapi from 0.141.1 to 0.142.2

Release notes

Sourced from fastapi's releases.

0.142.2

Fixes

  • 🐛 Allow startup when automatic OpenTelemetry configuration fails. PR #16418 by @​tiangolo.

0.142.1

Fixes

0.142.0

Features

Refactors

Docs

Translations

Internal

... (truncated)

Commits

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • See full diff in compare view

Updates pyjwt from 2.13.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed


- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).

v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__


Security

  • Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
  • PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table>

... (truncated)

Commits
  • 7d5ef55 chore: prepare 2.15.1 release
  • 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
  • 1d41a64 chore: prepare 2.15.0 release
  • 9bc0665 fix: make recursive payload tests deterministic
  • 5fde08a fix: normalize recursive JWT payload errors
  • 171062d utils: mention bytes in force_bytes type error (#1173)
  • c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
  • 2763752 Add support for Python 3.15 (#1202)
  • 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
  • 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.52 to 2.1.2

Release notes

Sourced from sqlalchemy's releases.

2.1.2

Released: October 2, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #5987 where the selectinload() loader strategy would ignore additional criteria present in the _orm.relationship.primaryjoin of a many-to-many relationship, such as a comparison against a column on the association table or on the parent table, loading related rows that should have been excluded. The omit_join optimization for many-to-many relationships is now only used when the primaryjoin consists solely of comparisons between the parent's primary key columns and the association table.

    References: #13626

engine

  • [engine] [bug] [regression] Fixed regression where result rows delivered by the DBAPI as a subclass of tuple would fail to be processed when the Cython extensions were in use, raising TypeError: Expected tuple. Such rows are now converted to a plain tuple, as was the case in 2.0. Rows delivered as a plain tuple, or as a sequence that is not a tuple at all such as asyncpg's Record, were not affected. Drivers such as the Databricks SQL connector return rows that are tuple subclasses.

    References: #13619

sql

  • [sql] [bug] The plain string portions of a _sql.tstring() construct are no longer scanned for bound parameter names in the :name format, and no longer interpret the \: escape sequence; the text is now rendered exactly as given. Previously, each string portion was parsed in the same way as _sql.text(), so that a colon within a quoted SQL string, such as 'time is :now', would be rendered as a bound parameter, failing at execution time.

    This change is a breaking change in the behavior of the newly introduced _sql.tstring() feature, as the former use of text() inadvertently provided a behavior that wasn't intended. In order to embed an explicit parameter in the SQL generated by _sql.tstring(), _sql.bindparam() may be used directly, e.g. tstring(t"SELECT {bindparam('p')}").

    References: #13616

... (truncated)

Commits

Updates strawberry-graphql from 0.327.2 to 0.328.2

Commits

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits

Updates tzdata from 2026.3 to 2026.4

Release notes

Sourced from tzdata's releases.

2026.4: Release of upstream tzdata 2026d

Version 2026.4

Upstream version 2026d released 2026-09-11T22:21:07+00:00

Briefly:

Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. Fix security, performance and porting bugs in zic and localtime.

Changes to future timestamps

Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on -06 year-round, matching Alberta’s recent change. Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c.

Changes to past timestamps

Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.

Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)

The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now conform better to POSIX. For example, EST5EDT now always uses the abbreviation "EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight saving time, whereas it formerly had different UT offsets before standard time was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all contrary to POSIX. Also, though not required by POSIX these names now use US federal rules rather than rules of places like New York, reverting to 2024a behavior. This change affects only timestamps before 1966-10-30 at 01:00 standard time.

Other data changes

The temporary hacks used for North American timekeeping changes now work around a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug 124851. This data change does not affect TZif files or timestamps. The change does not work around the related but less serious GCC bugs 116110 and 124513. These GCC bugs are all fixed in GCC 16.2.

Changes to documentation

URLs for release tarballs in tz-link.html have been updated to reflect their new canonical URLs on data.iana.org.

Changelog

Sourced from tzdata's changelog.

Version 2026.4

Upstream version 2026d released 2026-09-11T22:21:07+00:00

Briefly:

Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. Fix security, performance and porting bugs in zic and localtime.

Changes to future timestamps

Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on -06 year-round, matching Alberta’s recent change. Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c.

Changes to past timestamps

Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.

Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)

The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now conform better to POSIX. For example, EST5EDT now always uses the abbreviation "EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight saving time, whereas it formerly had different UT offsets before standard time was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all contrary to POSIX. Also, though not required by POSIX these names now use US federal rules rather than rules of places like New York, reverting to 2024a behavior. This change affects only timestamps before 1966-10-30 at 01:00 standard time.

Other data changes

The temporary hacks used for North American timekeeping changes now work around a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug 124851. This data change does not affect TZif files or timestamps. The change does not work around the related but less serious GCC bugs 116110 and 124513. These GCC bugs are all fixed in GCC 16.2.

Changes to documentation

URLs for release tarballs in tz-link.html have been updated to reflect their new canonical URLs on data.iana.org.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the backend group across 1 directory with 8 updates
970cb4e 
Bumps the backend group with 8 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.19.1` | `1.20.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.3` | `1.2.4` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.1` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.52` | `2.1.2` |
| [strawberry-graphql](https://github.com/sponsors/strawberry-graphql) | `0.327.2` | `0.328.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.4` |



Updates `alembic` from 1.19.1 to 1.20.0
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `fastapi` from 0.141.1 to 0.142.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.142.2)

Updates `python-dotenv` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4)

Updates `pyjwt` from 2.13.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.15.1)

Updates `sqlalchemy` from 2.0.52 to 2.1.2
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `strawberry-graphql` from 0.327.2 to 0.328.2
- [Commits](https://github.com/sponsors/strawberry-graphql/commits)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.54.0)

Updates `tzdata` from 2026.3 to 2026.4
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.3...2026.4)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: sqlalchemy
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: strawberry-graphql
  dependency-version: 0.328.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: tzdata
  dependency-version: '2026.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants