deps(python): bump the python group in /backend with 6 updates by dependabot[bot] · Pull Request #464 · HardMax71/Integr8sCode

dependabot · 2026-10-26T03:29:41Z

Bumps the python group in /backend with 6 updates:

Package	From	To
fastapi	`0.143.3`	`0.146.0`
httpx2	`2.13.1`	`2.14.0`
pydantic	`2.14.0`	`2.14.1`
starlette	`1.8.0`	`1.9.0`
pytest-env	`1.8.0`	`1.8.1`
pipdeptree	`4.2.8`	`4.2.9`

Updates fastapi from 0.143.3 to 0.146.0

Release notes

Sourced from fastapi's releases.

0.146.0

The root_path parameter in FastAPI() is deprecated. Configure the server with fastapi run --root-path /api/v1 instead.

Breaking Changes

🗑️ Deprecate the root_path parameter in FastAPI. PR #16520 by @tiangolo.

0.145.0

Breaking Changes

🔥 Remove deprecated openapi_prefix and unused **extra from FastAPI. PR #16518 by @tiangolo.

Docs

📝 Document URL paths in templates. PR #16517 by @tiangolo.

0.144.0

Features

✨ Add WebSocket support to security dependencies. PR #10147 by @mnixry.

0.143.5

Fixes

🐛 Fix handling of empty value for byte file list parameter. PR #9383 by @Viicos.

0.143.4

Upgrades

⬆️ Add httpx2 to optional dependencies. PR #16512 by @tiangolo.

Commits

3070b51 🔖 Release version 0.146.0 (#16521)
a17bd59 📝 Update release notes
45c4199 🗑️ Deprecate the root_path parameter in FastAPI (#16520)
129c9cf 🔖 Release version 0.145.0 (#16519)
475b466 📝 Update release notes
a37a162 🔥 Remove deprecated openapi_prefix and unused **extra from FastAPI (#16...
0ab3e03 📝 Update release notes
4f940b1 📝 Document URL paths in templates (#16517)
9528746 🔖 Release version 0.144.0 (#16516)
c18732c 📝 Update release notes
Additional commits viewable in compare view

Updates httpx2 from 2.13.1 to 2.14.0

Release notes

Sourced from httpx2's releases.

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#1217), and writing after a peer closes TLS without close_notify raises WriteError (#1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#1233).

httpx2

Added

Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#1165).

Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#1267).

Changed

Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#1165).

Fixed

Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#1267).

Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#1130).

Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#1233).

Stop the sync WebSocket session from hanging on exit when its event queue is full (#1123).

httpcore2

Fixed

Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#1262).

Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#1217).

Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

Changelog

Sourced from httpx2's changelog.

2.14.0 (October 18th, 2026)

Added

Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)

Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)

Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)

Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)

Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)

Commits

4fa853a Prepare version 2.14.0 (#1271)
dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
53c11c4 Interrupt blocked queue puts during sync WebSocket teardown (#1123)
d989385 Support FIPS-enforced Python builds without hashlib.md5 in DigestAuth (#1...
76d02ee Handle reads during ASGI WebSocket shutdown (#1233)
See full diff in compare view

Updates pydantic from 2.14.0 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

Avoid Python tuple allocation during model fields validation by @Viicos in #13955

Avoid unnecessary extra dict allocation in model validation by @Viicos in #13956

Fixes

Fix arguments-v3 schema with variadic keywords by @Viicos in #13954

Fix TypeError on ForwardRef on Python 3.10.0 by @Viicos in #13964

Support closed and extra_items via inheritance in TypedDict by @Viicos in #13967

Enforce the max_digits whole-digits limit in the Python Decimal validator by @Viicos in #13972

Reject out-of-range int inputs for timedelta by @Viicos in #13973

Support named tuples in Sequence validation by @Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

Commits

b2212c7 Prepare release v2.14.1
968fb2b Fix docs conversion table
6adc8b3 Support named tuples in Sequence validation
7637fbc Reject out-of-range int inputs for timedelta
dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
e2456d3 Support closed and extra_items via inheritance in TypedDict
317655d Harden CI security
3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
43681ab Bump samuelcolvin/check-python-version action to v5.1
d6bc53a Avoid unnecessary extra dict allocation in model validation
See full diff in compare view

Updates starlette from 1.8.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

1840c9d Version 1.9.0 (#3676)
750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
414af4f Remove unmaintained packages from the third-party packages page (#3674)
d4df01a Add adminsite to the third-party packages (#3654)
1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
6b11cd7 Honor streaming responses in TestClient (#3491)
b7901fb Use byte length for typed memoryview response bodies (#3622)
3214cd0 Escape path delimiters and leading // when building URLs (#3671)
See full diff in compare view

Updates pytest-env from 1.8.0 to 1.8.1

Release notes

Sourced from pytest-env's releases.

1.8.1

Respect explicit empty native env_files over INI fallback (#273)

PyPI release

Full Changelog: pytest-dev/pytest-env@1.8.0...1.8.1

Changelog

Sourced from pytest-env's changelog.

1.8.1 (2026-10-18)

Respect explicit empty native env_files over INI fallback (#273)

Commits

1fed481 Respect explicit empty native env_files over INI fallback (#273)
87aa836 build(deps): bump the github-actions group with 2 updates (#272)
0a16faa [pre-commit.ci] pre-commit autoupdate (#271)
See full diff in compare view

Updates pipdeptree from 4.2.8 to 4.2.9

Release notes

Sourced from pipdeptree's releases.

4.2.9

Packaging updates - 4.2.9

Publish GitHub Releases with changelog notes, PyPI links, and version comparisons. (#739)

PyPI release

Full Changelog: tox-dev/pipdeptree@4.2.8...4.2.9

Changelog

Sourced from pipdeptree's changelog.

Packaging updates - 4.2.9

Publish GitHub Releases with changelog notes, PyPI links, and version comparisons. (:issue:739)

4.2.8 (2026-10-15)

Commits

892b633 release 4.2.9
5fa82ef Trim GitHub Release notes (#739)
b320c9c 👷 ci: publish release after PyPI (#738)
edc24c2 build(deps): bump the github-actions group with 3 updates (#737)
12d5f9b build(deps): bump pyo3 from 0.29.3 to 0.30.1 in the cargo group (#736)
93abf3e 👷 ci(release): require changelog entries (#735)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python group in /backend with 6 updates: | Package | From | To | | --- | --- | --- | | [fastapi](https://github.com/fastapi/fastapi) | `0.143.3` | `0.146.0` | | [httpx2](https://github.com/pydantic/httpx2) | `2.13.1` | `2.14.0` | | [pydantic](https://github.com/pydantic/pydantic) | `2.14.0` | `2.14.1` | | [starlette](https://github.com/Kludex/starlette) | `1.8.0` | `1.9.0` | | [pytest-env](https://github.com/pytest-dev/pytest-env) | `1.8.0` | `1.8.1` | | [pipdeptree](https://github.com/tox-dev/pipdeptree) | `4.2.8` | `4.2.9` | Updates `fastapi` from 0.143.3 to 0.146.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.143.3...0.146.0) Updates `httpx2` from 2.13.1 to 2.14.0 - [Release notes](https://github.com/pydantic/httpx2/releases) - [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md) - [Commits](pydantic/httpx2@v2.13.1...v2.14.0) Updates `pydantic` from 2.14.0 to 2.14.1 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.14.0...v2.14.1) Updates `starlette` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.8.0...1.9.0) Updates `pytest-env` from 1.8.0 to 1.8.1 - [Release notes](https://github.com/pytest-dev/pytest-env/releases) - [Changelog](https://github.com/pytest-dev/pytest-env/blob/main/CHANGELOG.md) - [Commits](pytest-dev/pytest-env@1.8.0...1.8.1) Updates `pipdeptree` from 4.2.8 to 4.2.9 - [Release notes](https://github.com/tox-dev/pipdeptree/releases) - [Changelog](https://github.com/tox-dev/pipdeptree/blob/main/docs/changelog.rst) - [Commits](tox-dev/pipdeptree@4.2.8...4.2.9) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.146.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python - dependency-name: httpx2 dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python - dependency-name: starlette dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python - dependency-name: pytest-env dependency-version: 1.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python - dependency-name: pipdeptree dependency-version: 4.2.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-26T03:29:50Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: a2355fe0-7dfc-44da-b922-cfef4432f039

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-10-26T03:30:23Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot requested a review from HardMax71 as a code owner October 26, 2026 03:29

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 26, 2026

HardMax71 enabled auto-merge (squash) October 26, 2026 03:29

HardMax71 merged commit 1075ff4 into main Oct 26, 2026
25 checks passed

HardMax71 deleted the dependabot/uv/backend/python-badb27ae5c branch October 26, 2026 03:35

Navigation Menu

Repository navigation

deps(python): bump the python group in /backend with 6 updates - #464

deps(python): bump the python group in /backend with 6 updates#464
HardMax71 merged 1 commit into
mainfrom
dependabot/uv/backend/python-badb27ae5c

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

coderabbitai Bot commented Oct 26, 2026

Review skipped

Uh oh!

sonarqubecloud Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026

0.146.0

Breaking Changes

0.145.0

Breaking Changes

Docs

0.144.0

Features

0.143.5

Fixes

0.143.4

Upgrades

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

🔐 FIPS-enforced Python support

🔌 Sturdier connections and WebSocket shutdown

httpx2

Added

Changed

Fixed

httpcore2

Fixed

2.14.0 (October 18th, 2026)

Added

Changed

Fixed

v2.14.1 2026-10-11

What's Changed

Performance

Fixes

Version 1.9.0

Changed

Fixed

1.9.0 (October 18, 2026)

Changed

Fixed

1.8.1

1.8.1 (2026-10-18)

4.2.9

Packaging updates - 4.2.9

Packaging updates - 4.2.9

Uh oh!

coderabbitai Bot commented Oct 26, 2026

Review skipped

Uh oh!

sonarqubecloud Bot commented Oct 26, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

🌐 CIDR ranges in `NO_PROXY`