deps(uv): bump the uv-minor-patch group across 1 directory with 42 updates

[dependabot]

Bumps the uv-minor-patch group with 42 updates in the / directory:

Package	From	To
charset-normalizer	3.5.1	3.5.2
cryptography	50.0.1	50.0.2
fastapi	0.141.1	0.142.2
fonttools	4.65.0	4.66.1
markupsafe	3.0.3	3.0.4
pyparsing	3.3.2	3.3.3
python-dotenv	1.2.3	1.2.4
regex	2026.9.10	2026.9.29
sqlalchemy	2.0.54	2.1.3
uvicorn	0.53.0	0.54.0
webauthn	3.0.0	3.0.1
pymssql	2.4.1	2.4.2
oracledb	26.0.0	26.0.1
snowflake-connector-python	4.7.4	4.8.0
pillow-heif	1.7.0	1.8.0
mammoth	1.12.2	1.13.0
streamlit	1.64.0	1.65.0
gitpython	3.1.62	3.2.0
opentelemetry-api	1.44.0	1.45.0
opentelemetry-sdk	1.44.0	1.45.0
opentelemetry-exporter-otlp	1.44.0	1.45.0
opentelemetry-instrumentation-fastapi	0.65b0	0.66b0
opentelemetry-instrumentation-sqlalchemy	0.65b0	0.66b0
opentelemetry-instrumentation-logging	0.65b0	0.66b0
cyclonedx-bom	7.4.0	7.5.0
hypothesis	6.168.0	6.168.3
httpx2	2.13.0	2.13.1
markdown	3.10.3	3.11
mypy	2.3.1	2.4.0
ruff	0.16.8	0.16.10
ast-serialize	0.11.2	0.12.1
cbor2	6.1.4	6.1.5
coverage	7.16.1	7.16.2
fqdn	1.5.1	1.6.0
httpcore2	2.13.0	2.13.1
identify	2.6.19	2.6.20
librt	0.15.0	0.16.0
nodeenv	1.10.0	1.11.0
platformdirs	4.11.11	4.12.3
soupsieve	2.9.2	2.10
tzdata	2026.4	2026.5
virtualenv	21.9.0	21.14.5

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates fastapi from 0.141.1 to 0.142.2

Release notes

Sourced from fastapi's releases.

0.142.2

Fixes

• 🐛 Allow startup when automatic OpenTelemetry configuration fails. PR #16418 by @​tiangolo.

0.142.1

Fixes

• 🐛 Fix repeated endpoint wrapping in included routers. PR #16414 by @​tiangolo.

0.142.0

Features

• ✨ Add native OpenTelemetry support. PR #16403 by @​tiangolo.

Refactors

• 📱 Improve mobile responsiveness of conference rail. PR #16196 by @​alejsdev.
• ♻️ Remove conf section and add event banner. PR #16193 by @​alejsdev.

Docs

• 🔥 Remove unused image. PR #16195 by @​alejsdev.
• 🐛 Use buttons for Termynal controls. PR #16132 by @​tiangolo.

Translations

• 🌐 Update translations for hi (update-outdated). PR #16212 by @​pr-submit[bot].
• 🌐 Update translations for ru (update-outdated). PR #16210 by @​pr-submit[bot].
• 🌐 Update translations for zh-hant (update-outdated). PR #16211 by @​pr-submit[bot].
• 🌐 Update translations for uk (update-outdated). PR #16208 by @​pr-submit[bot].
• 🌐 Update translations for de (update-outdated). PR #16209 by @​pr-submit[bot].
• 🌐 Update translations for tr (update-outdated). PR #16207 by @​pr-submit[bot].
• 🌐 Update translations for ja (update-outdated). PR #16206 by @​pr-submit[bot].
• 🌐 Update translations for fr (update-outdated). PR #16205 by @​pr-submit[bot].
• 🌐 Update translations for zh (update-outdated). PR #16204 by @​pr-submit[bot].
• 🌐 Update translations for es (update-outdated). PR #16203 by @​pr-submit[bot].
• 🌐 Update translations for pt (update-outdated). PR #16202 by @​pr-submit[bot].
• 🌐 Update translations for ko (update-outdated). PR #16201 by @​pr-submit[bot].
• 🌐 Update translations for ko (update-outdated). PR #16171 by @​pr-submit[bot].

Internal

• ✅ Fix frontend test timeout with Starlette Git. PR #16408 by @​YuriiMotov.
• 🔧 Update sponsors: remove Permit.io. PR #16406 by @​tiangolo.
• ⬆ Bump anyio from 4.12.1 to 4.14.2. PR #16375 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 15 updates. PR #16285 by @​dependabot[bot].
• ⬆ Bump starlette from 1.3.1 to 1.6.0. PR #16289 by @​dependabot[bot].
• ⬆ Bump annotated-doc from 0.0.4 to 0.0.5. PR #16288 by @​dependabot[bot].
• ⬆ Bump typing-inspection from 0.4.2 to 0.4.4. PR #16286 by @​dependabot[bot].

... (truncated)

Commits

• 78c4324 🔖 Release version 0.142.2 (#16419)
• 2579ed0 📝 Update release notes
• 1d4953d 🐛 Allow startup when automatic OpenTelemetry configuration fails (#16418)
• 3e33a03 🔖 Release version 0.142.1 (#16415)
• 12ea7f5 📝 Update release notes
• ac88f56 🐛 Fix repeated endpoint wrapping in included routers (#16414)
• bd41128 🔖 Release version 0.142.0 (#16411)
• 7aa21e5 📝 Update release notes
• 4b3949c ✨ Add native OpenTelemetry support (#16403)
• c30032a 📝 Update release notes
• Additional commits viewable in compare view

Updates fonttools from 4.65.0 to 4.66.1

Release notes

Sourced from fonttools's releases.

4.66.1

• [designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
• [cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
• [cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

4.66.0

• Drop support for EOL Python 3.10; fontTools now requires Python 3.11 or later. fontTools.misc.enumTools now only re-exports enum.StrEnum and is deprecated. Explicitly test and declare support for Python 3.15 (#4183, #4196).
• [unicodedata] Update the bundled script, script extension, block and bidi-mirroring tables to Unicode 18.0.0, and require unicodedata2 18.0.0 when it is used (#4192, #4197).
• [feaLib] Support language statements listing multiple language tags, e.g. language AZE CRT;adobe-type-tools/feature_file_workshops#8dflt cannot be combined with other tags. LanguageStatement.language is still the first tag; all of them are in the new languages attribute (#4201, #4202).
• [feaLib] Fix lookups being dropped when a script/language pair is repeated within a feature block: the repeated statement replaced the language system's lookups with a fresh copy of the default ones (#4189).
• [feaLib] Raise FeatureLibError instead of UnboundLocalError when a STAT table block lacks ElidedFallbackName or ElidedFallbackNameID (#3834, #4179).
• [cffLib] Always recompile the CFF2 VarStore when saving. Previously the bytes compiled by an earlier save were reused, so a CFF2 variable font that was saved and then modified in place, e.g. by the instancer, was written with a stale VarStore next to its updated charstrings (#4199).
• [ttLib] Support static VARC fonts that omit fvar while retaining gvar or CFF2 variation data for component-internal axes: hidden axes are addressed by index and gvar can compile, decompile and round-trip through TTX without fvar, reading the axis count from a new axisCount element (#4187, #4188).
• [ttLib] Fix drawing VARC components whose condition is negated (format 5), which raised AttributeError (#4191).
• [instancer] Fix VARC axis references left stale when removing an unrelated axis, reject pinning or restricting axes referenced by VARC components, and stop culling avar2 ranges for component-internal variations, which can reach outside the font-level ranges (#4190, #4193).
• [bezierTools] Preserve exact endpoints in splitQuadraticAtT and splitCubicAtTC as well, like splitCubicAtT since 4.55.4 (#3742, #4194).
• [bezierTools] Fix ZeroDivisionError in lineLineIntersections for collinear vertical lines; they are now treated as parallel like horizontal ones (#3515, #4181).
• [subset] pyftsubset now preserves the input font's flavor (WOFF, WOFF2) when --flavor is omitted, instead of writing uncompressed sfnt data under the same extension; pass --flavor=none to force uncompressed output (#3630, #4182).
• [merge] Report incompatible unitsPerEm values by name, with the input values, instead of a bare assertion (#2844, #4184).
• [designspaceLib] Fix the type annotation and documentation of DesignSpaceDocument.default, which holds a SourceDescriptor, not a source name (#2994, #4186).
• [ttLib.sfnt] Raise TTLibError instead of AssertionError for inconsistent WOFF table, metadata and private-data lengths, so the checks also hold under python -O (#4178).
• [misc.etree] Disable entity resolution altogether on lxml >= 5.0 as well: lxml's resolve_entities="internal" still fetched external parameter entities before lxml 6.1.3, so a crafted DTD could read local files into parsed XML content (#4195).
• [cmap] Bound the expansion of format 4 segments and format 12/13 groups when decompiling, like HarfBuzz does: groups are clamped to U+10FFFF, inverted or overlapping groups are skipped with a warning, and groups mapped to the missing glyph are not expanded. A crafted font could previously exhaust memory with a single group ending at 0xFFFFFFFF (#4204).
• [varLib.avar] Escape axis names and tags when varLib.avar.unbuild emits its designspace snippet, so a crafted font cannot inject markup (#4203).

Changelog

Sourced from fonttools's changelog.

4.66.1 (released 2026-09-29)

• [designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
• [cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
• [cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

4.66.0 (released 2026-09-23)

• Drop support for EOL Python 3.10; fontTools now requires Python 3.11 or later. fontTools.misc.enumTools now only re-exports enum.StrEnum and is deprecated. Explicitly test and declare support for Python 3.15 (#4183, #4196).
• [unicodedata] Update the bundled script, script extension, block and bidi-mirroring tables to Unicode 18.0.0, and require unicodedata2 18.0.0 when it is used (#4192, #4197).
• [feaLib] Support language statements listing multiple language tags, e.g. language AZE CRT;, as Glyphs does and as proposed for the spec adobe-type-tools/feature_file_workshops#8 references are registered under every listed language. dflt cannot be combined with other tags. LanguageStatement.language is still the first tag; all of them are in the new languages attribute (#4201, #4202).
• [feaLib] Fix lookups being dropped when a script/language pair is repeated within a feature block: the repeated statement replaced the language system's lookups with a fresh copy of the default ones (#4189).
• [feaLib] Raise FeatureLibError instead of UnboundLocalError when a STAT table block lacks ElidedFallbackName or ElidedFallbackNameID (#3834, #4179).
• [cffLib] Always recompile the CFF2 VarStore when saving. Previously the bytes compiled by an earlier save were reused, so a CFF2 variable font that was saved and then modified in place, e.g. by the instancer, was written with a stale VarStore next to its updated charstrings (#4199).
• [ttLib] Support static VARC fonts that omit fvar while retaining gvar or CFF2 variation data for component-internal axes: hidden axes are addressed by index and gvar can compile, decompile and round-trip through TTX without fvar, reading the axis count from a new axisCount element (#4187, #4188).
• [ttLib] Fix drawing VARC components whose condition is negated (format 5), which raised AttributeError (#4191).
• [instancer] Fix VARC axis references left stale when removing an unrelated axis, reject pinning or restricting axes referenced by VARC components, and stop culling avar2 ranges for component-internal variations,

... (truncated)

Commits

• 9e95795 Release 4.66.1
• 8fc91fb Update NEWS.rst [skip ci]
• 82dc507 Merge pull request #4209 from insaf021/cmap4-idrangeoffset-bounds
• a83553e trim comments
• 85049d3 Merge pull request #4208 from fonttools/fix-split-stat-names-override
• 1ad111d Merge pull request #4210 from youdie006/cmap-format2-high-gids
• c9e9d68 [cmap] fix format 2 compile for glyph IDs above 32767
• 85625c5 raise TTLibError for out-of-range glyphIndexArray offset in cmap format 4
• 879173e [designspaceLib] Let explicit instance names win over STAT labels when splitting
• 718b61b Bump version: 4.66.0 → 4.66.1.dev0
• Additional commits viewable in compare view

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. :issue:521

Commits

• ece2607 release version 3.0.4
• 620bc80 split archs
• 73c3be1 fix wheel builds (#536)
• d8ae19e fix wheel builds
• ff1eaff Build Android and iOS wheels (#516)
• 87e64f9 build Android and iOS wheels
• bc33c55 Build ppc64le wheels (#518)
• 0ddd6ea build ppc64le wheels
• 3e07758 Build armv7l wheels (#514)
• 39b9aae build armv7l wheels
• Additional commits viewable in compare view

Updates pyparsing from 3.3.2 to 3.3.3

Changelog

Sourced from pyparsing's changelog.

Version 3.3.3 - in development

• Added support for Python 3.15.

• Parse actions that return a tuple value for a named expression formerly saved just the first value of the tuple. Now they return the entire tuple. Partially fixes Issue #401, PR #640 submitted by Vincent Gao et AI.

• Fixed CI unit test jobs selecting a tox environment with no test commands. The matrix and fallback now select py-unit, as diagnosed and proposed by glaziermag in issue #662; submitted by Neal Lin et AI.

• Fixed Dict returning an empty nested ParseResults.as_dict() as [] instead of {}. Incorporates partial solution submitted in PR #635 submitted by Leo Ji.

  Additional fixes found as part of this work:

  • Removed vestigial unused ParseResults._modal attribute.

  • Fixed incidental bug when Dict tries to create a dict with a ParseResults value for a key (not hashable).

• Fixed Word(..., max=n) raising instead of matching up to max characters when the character set contained whitespace - Word(nums, max=3) and Word(nums + " ", max=3) gave opposite results on the same input. Now both forms match up to max and leave the rest for the next parser. PR #646 submitted by Andrew Chen et AI.

• Fixed QuotedString stripping whitespace that is part of a multi-character quote delimiter, e.g. the leading newline in QuotedString("\n;", multiline=True). The delimiter was silently collapsed to ";", so the newline was ignored when matching. QuotedString now only rejects quote_char/end_quote_char values that are empty or entirely whitespace, and preserves any surrounding whitespace that is part of a valid delimiter. Reported in issue #492.

• Fixed pyparsing_common.as_datetime raising Invalid date/time: microsecond must be in 0..999999 for valid ISO-8601 timestamps whose fractional seconds round up to a full second (e.g. 2021-06-15T12:30:59.9999995, common in nanosecond-precision timestamps). The rounded microseconds are now added via timedelta so the value carries into the next second instead of overflowing the datetime microsecond argument. PR submitted by Andrew Chen et AI.

• Fixed debug output corruption when a parsed line contains a carriage return or other control character. set_debug() printed the source line verbatim, so a stray \r returned the terminal cursor to column 0 and overwrote the "Match ... at loc" text. Control characters in the debug line are now shown escaped, and the marker caret stays aligned with the match location. Issue #496, reported by Matthew Rowles.

... (truncated)

Commits

• d90d38b Update flit version and exclusion of generated railroad diagrams from source ...
• 4220992 Updated CI to execute unit tests, PR #663; update test_unit.py to add test ca...
• e266043 Reworked internal recursive implementations to use local stack vars or iterat...
• See full diff in compare view

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

• dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
• An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
• dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

• dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
• An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
• dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

Commits

• a565c2c Bump version: 1.2.3 → 1.2.4
• 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
• f215c02 fix: dotenv get exits 0 for empty string values (#700)
• 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
• e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
• a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
• f5485a6 fix: parse empty unquoted value with inline comment as empty string
• See full diff in compare view

Updates regex from 2026.9.10 to 2026.9.29

Changelog

Sourced from regex's changelog.

Version: 2026.9.29

Updated to Unicode 18.0.0.
Switched to using stdbool.h and stdint.h.

Version: 2026.9.19

Git issue 619: `Match.expand()` segfaults after `detach_string()` when the template references a group

Version: 2026.9.10

Fixed version.

Version: 2026.9.9

PR [#615](https://github.com/mrabarnett/mrab-regex/issues/615): Fix Python API error propagation in match helpers
PR #616: Preserve Python Exceptions in Input Decoding and String Detachment
PR #617: Prevent Invalid Pointer Use and Exception State Corruption in Byte String Joining
PR #618: Propagate Allocation and Internal Errors During Pattern Compilation and Scanner Execution

Version: 2026.9.3

New version of cibuildwheel no longer supports building for free-threaded Python 3.13.

Version: 2026.9.2

New version of cibuildwheel no longer needs nor supports cpython-freethreading option.

Version: 2026.9.1

Updated cibuildwheel.
Support Python 3.15.

Version: 2026.8.31

Fixed version.

Version: 2026.8.30

Git issue 611: Heap out-of-bounds write at compile time
Git issue 612: count_one() size underflow through the stale required-string cache
Git issue 613: (*SKIP) inside an atomic group, plus an equality-only scan stop
Git issue 614: build_GROUP() does not propagate the match direction

Version: 2026.8.12

... (truncated)

Commits

• 0e8cb05 Updated to Unicode 18.0.0.
• 85e568c Git issue 619: Match.expand() segfaults after detach_string() when the te...
• See full diff in compare view

Updates sqlalchemy from 2.0.54 to 2.1.3

Release notes

Sourced from sqlalchemy's releases.

2.1.3

Released: October 2, 2026

orm

• [orm] [bug] [regression] Fixed regression where columns delivered to a mapped class from an unmapped _orm.MappedAsDataclass mixin, or from a class decorated with _orm.unmapped_dataclass(), would not be placed in the _schema.Table in the order in which they were declared on the mixin; columns that had no dataclass default, such as a primary key column with no _orm.mapped_column.default, or which made use of _orm.mapped_column.default_factory, would be moved after the remaining columns of the mixin.

  References: #13634

sql

• [sql] [bug] [regression] Fixed regression caused by the new implementation of ExecutableStatement.params() where parameter values established using this method would not be rendered when compiling the statement with the literal_binds compiler option, instead rendering NULL with a warning.

  References: #13635

2.1.2

Released: October 2, 2026

orm

• [orm] [bug] [regression] Fixed regression caused by #5987 where the selectinload() loader strategy would ignore additional criteria present in the _orm.relationship.primaryjoin of a many-to-many relationship, such as a comparison against a column on the association table or on the parent table, loading related rows that should have been excluded. The omit_join optimization for many-to-many relationships is now only used when the primaryjoin consists solely of comparisons between the parent's primary key columns and the association table.

  References: #13626

engine

... (truncated)

Commits

• See full diff in compare view

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• See full diff in compare view

Updates webauthn from 3.0.0 to 3.0.1

Release notes

Sourced from webauthn's releases.

v3.0.1

Changes:

• verify_registration_response() now rejects responses with attestation statement formats that are not strings (#288, h/t @​DarkaMaul)

Changelog

Sourced from webauthn's changelog.

v3.0.1

Changes:

• verify_registration_response() now rejects responses with attestation statement formats that are not strings (#288, h/t @​DarkaMaul)

Commits

• d72e0f5 Bump version to v3.0.1
• 732ca23 Update CHANGELOG for v3.0.1
• b474c8d Merge pull request #288 from trail-of-forks/dm/reject-attestations-fmt
• 5557d97 Reject early invalid attestation formats
• See full diff in compare view

Updates pymssql from 2.4.1 to 2.4.2

Release notes

Sourced from pymssql's releases.

pymssql 2.0 greenish

Experimental support for greening for gevent, etc.

Changelog

Sourced from pymssql's changelog.

Version 2.4.2 - 2026-09-26 - Mikhail Terekhov

General

• Fix deadlock in err_handler (#1002), thanks to sergiopmscope.

Commits

• b730f8c Update ChangeLog.rst
• 63b3fc9 Fix deadlock in err_handler (#1018)
• a55eb7a Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
• See full diff in compare view

Updates oracledb from 26.0.0 to 26.0.1

Release notes

Sourced from oracledb's releases.

v26.0.1

python-oracledb 26.0.1 is now released. This release addresses a number of issues. See the full release notes for all of the details.

Commits

• cf7d2aa Preparing to release python-oracledb 26.0.1.
• 145ea2b Fixed bug causing hang with NUMBER input and SYS_REFCURSOR output bind
• 6748825 Fixed bugs with handling duplicate data when fetching Arrow data frames
• ba3bdd2 Fixed bug with handling the empty (default) value of the
• 68dde29 Simplify tests.
• 717aba0 Fixed regression with connecting to listeners that require TLS renegotiation
• 619ac1e Bump version in preparation for new changes.
• See full diff in compare view

Updates snowflake-connector-python from 4.7.4 to 4.8.0

Release notes

Sourced from snowflake-connector-python's releases.

4.8.0

• OCSP certificate revocation checks are now off unless you opt in. Set ocsp_fail_open=True or ocsp_fail_open=False to enable OCSP. The stored default is None (unset); only an explicit True/False opts in, so forwarding DEFAULT_CONFIGURATION as kwargs does not turn OCSP on. disable_ocsp_checks=True (or insecure_mode=True) always turns OCSP off, including when ocsp_fail_open is also set. disable_ocsp_checks=False and insecure_mode=False are the stored defaults and are not an opt-in. Connection attribute ocsp_fail_open is no longer a report of whether OCSP is fail-open; it is the stored preference (None = unset, True = fail-open, False = fail-closed). Use _ocsp_mode() / disable_ocsp_checks to see whether checks are actually on. ocsp_response_cache_filename and ocsp_root_certs_dict_lock_timeout do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The SF_OCSP_FAIL_OPEN environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login OCSP_MODE telemetry now reports DISABLE_OCSP_CHECKS by default. The process-global FEATURE_OCSP_MODE is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later FAIL_OPEN client does not overwrite FAIL_CLOSED.

• Fixed external-browser (SSO) authentication to validate the Origin header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. https://account.snowflakecomputing.com/) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.

• Added the SNOWFLAKE_TLS_CIPHERS environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with TLS_ are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.

• Raised the minimum pyOpenSSL requirement to 25.3.0, the first version providing set_tls13_ciphersuites. This does not narrow the set of installable versions in practice: earlier releases cap cryptography below 46 and so were already uninstallable alongside the connector's own cryptography>=46.0.5 requirement.

• Added the workload_identity_host connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use amazonaws.com (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires workload_identity_aws_use_outbound_token=True (SNOW-4017192).

• Fixed MD5 computation for Azure clouds (SNOW-4168830).

4.7.5

Fixes

• Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via GET /queries/{qid}/result before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty...

  Description has been truncated

[github-actions]

requirements.txt / pylock.toml drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/2062/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
uv export --format pylock.toml --frozen --all-extras --all-groups --output-file pylock.toml
git add requirements.txt pylock.toml
git commit -S -m "chore(deps): regenerate requirements.txt and pylock.toml after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt and pylock.toml from the workflow artifact on this run when present.

[cursor]

🔒 Agentic Security Review

One MEDIUM finding on the FastAPI 0.141.1 → 0.142.2 bump: native OpenTelemetry auto-export can bypass the product DATA_BOAR_OTEL_ENABLED opt-in when the optional [otel] extra is present and a generic OTEL_EXPORTER_OTLP_ENDPOINT is set.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

FastAPI 0.142.2 defaults telemetry.auto_configure to true. On ASGI lifespan startup, if OTEL_EXPORTER_OTLP_ENDPOINT (or a per-signal OTLP endpoint) is set and the OpenTelemetry SDK/OTLP HTTP exporter can be imported, FastAPI attaches its own exporters and records HTTP spans including url.path and url.query.

api/routes.py constructs FastAPI() without telemetry={"auto_configure": False}. Product instrumentation in core/otel_setup.py stays gated on DATA_BOAR_OTEL_ENABLED, but this library path does not. Deployments that installed the optional [otel] extra and have a leftover or platform-injected OTLP endpoint can export request paths and query strings even when the product telemetry gate is off.

Impact: Unintended OTLP export of dashboard HTTP metadata (paths, query strings, exception/validation telemetry) to whatever collector the generic OTEL env points at, bypassing the documented opt-in.

 

^{Reviewed by Cursor Security Reviewer for commit 2492aa2. Configure here.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.