Skip to content

Bump the server-python group across 1 directory with 9 updates - #290

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/server/server-python-af8f334afc
Open

Bump the server-python group across 1 directory with 9 updates#290
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/server/server-python-af8f334afc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on aiohttp, asyncpg, fastapi[standard], krippendorff, openai, pydantic, pydantic-ai-slim[openai,openrouter,retries], sqlalchemy[asyncio] and boto3 to permit the latest version.
Updates aiohttp from 3.14.3 to 3.14.4
Updates asyncpg from 0.31.0 to 0.32.0

Release notes

Sourced from asyncpg's releases.

v0.32.0

Improvements

  • Support Python 3.15 (#1367, #1378) (by @​elprans in 1b118464 and 58c0c595)

  • Support PostgreSQL 19 (#1379) (by @​elprans in 8d2a5aed)

  • Make pool min_size a maintained connection floor and add init_size to control the number of connections opened at startup (#1323). Idle connections at or below min_size are retained, and closed connections are replaced in the background. init_size defaults to min_size. To preserve the previous behavior, where the pool could drain to zero, replace min_size=N with init_size=N, min_size=0. (by @​shatilov-diman in 67a1cbc5)

  • Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#1359) (by @​twelfthlabor in 00319a9b)

  • Use the statement cache for copy_records_to_table() introspection (#1360) (by @​matemax in dd058652)

Fixes

  • Clean up connections rejected by target_session_attrs immediately so an unresponsive rejected host cannot delay the selected connection, and cleanup tasks cannot outlive the event loop. Rejected connections are aborted without waiting for a graceful disconnect; servers may log "unexpected EOF on client connection" if the Terminate message is not delivered before the transport closes.

  • Fix a connection pool deadlock when releasing a connection after a protocol abort (#1324) (by @​pchaseh in 4a83cc2f)

  • Honor Connection.close(timeout=...) while waiting for a pending cancellation (#1361) (by @​gyanu2507 in c06bcb4d)

  • Prevent stuck cancellation from blocking connection teardown or pool release by bounding cancellation with the command or release timeout (#1370) (by @​elprans in 4cf02203)

  • Preserve the server error when the connection closes mid-operation (#1369) (by @​RitiGrover in 6c8f1a7a)

  • Fix COPY cleanup when a records generator raises, preserving the original exception and avoiding protocol desynchronization and stalled rollback (#1358) (by @​CodingCossack in fdc6bc8f)

... (truncated)

Commits
  • d701e11 asyncpg v0.32.0
  • b04f8f2 Bump to macOS 26 in runners, set deployment target to 11 (#1384)
  • 3934d77 tests: Capture expected pool retry warnings during role changes (#1383)
  • 2c37501 tests: Avoid DeprecationWarning when settings up uvloop (#1382)
  • b7eea79 Test pool min_size backoff on target attribute mismatch (#1381)
  • 46dda91 Terminate rejected target_session_attrs candidates before returning (#1380)
  • 8d2a5ae Support PostgreSQL 19 (#1379)
  • 58c0c59 Bump uvloop (#1378)
  • 67a1cbc Make pool min_size a maintained connection floor (#1323)
  • 25aaaf5 fix: allow cursors in external transactions (#1350)
  • Additional commits viewable in compare view

Updates fastapi[standard] to 0.143.0

Release notes

Sourced from fastapi[standard]'s releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.
Commits

Updates krippendorff from 0.8.2 to 0.9.0

Release notes

Sourced from krippendorff's releases.

v0.9.0

What's Changed

Full Changelog: pln-fing-udelar/fast-krippendorff@v0.8.2...v0.9.0

Commits
  • c6c1a0e Bump version 0.9.0
  • 6228db4 Convert project to src/ directory structure (#44)
  • b4b97dc Add support for Python 3.15 and drop support for Python 3.10 (#43)
  • 400946a Update uv-build requirement from <0.12.0,>=0.10.0 to >=0.10.0,<0.13.0 (#42)
  • b1eb616 Update uv-build requirement from <0.11.0,>=0.10.0 to >=0.10.0,<0.12.0 (#41)
  • 16578cc Add linting, formatting, and type-checking
  • fb55836 Add more Python versions to test
  • af8cd29 Update the dependencies
  • 08fe296 Update pytest requirement from <9,>=7 to >=7,<10 (#40)
  • 650fe02 Bump version 0.8.3.dev0
  • See full diff in compare view

Updates openai from 3.24.0 to 3.26.1

Release notes

Sourced from openai's releases.

v3.26.1

3.26.1 (2026-10-08)

Bug Fixes

  • api: correct custom voice creation parameters (#4038) (b9bc5c1)

v3.26.0

3.26.0 (2026-10-06)

Features

v3.25.0

3.25.0 (2026-10-06)

Features

  • agents: observe local tool failures (#4028) (95d9645)
  • agents: run local tools during streamed session creation (#4027) (919b623)
  • api: add agent turn items and usage source grouping (#4030) (bd74c4e)
  • lib: export type_to_response_format_param publicly (#2993) (becc1d2)
  • tools: support tool search (defer_loading=true) in typed function helpers (#4029) (eec627f)
Changelog

Sourced from openai's changelog.

3.26.1 (2026-10-08)

Bug Fixes

  • api: correct custom voice creation parameters (#4038) (b9bc5c1)

3.26.0 (2026-10-06)

Features

3.25.0 (2026-10-06)

Features

  • agents: observe local tool failures (#4028) (95d9645)
  • agents: run local tools during streamed session creation (#4027) (919b623)
  • api: add agent turn items and usage source grouping (#4030) (bd74c4e)
  • lib: export type_to_response_format_param publicly (#2993) (becc1d2)
  • tools: support tool search (defer_loading=true) in typed function helpers (#4029) (eec627f)
Commits
  • 9301e31 release: 3.26.1 (#4039)
  • b9bc5c1 fix(api): correct custom voice creation parameters (#4038)
  • 4e152cd release: 3.26.0 (#4034)
  • b99e3e4 feat(api): add standalone Decisions support (#4033)
  • 13fff1b release: 3.25.0 (#4019)
  • bd74c4e feat(api): add agent turn items and usage source grouping (#4030)
  • 919b623 feat(agents): run local tools during streamed session creation (#4027)
  • eec627f feat(tools): support tool search (defer_loading=true) in typed function helpe...
  • 95d9645 feat(agents): observe local tool failures (#4028)
  • becc1d2 feat(lib): export type_to_response_format_param publicly (#2993)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Updates pydantic-ai-slim[openai,openrouter,retries] to 2.54.0

Release notes

Sourced from pydantic-ai-slim[openai,openrouter,retries]'s releases.

v2.54.0 (2026-10-02)

What's Changed

⚠️ Compatibility Notes

🚀 Features

🐛 Bug Fixes

Full Changelog: pydantic/pydantic-ai@v2.53.0...v2.54.0

Changelog

Sourced from pydantic-ai-slim[openai,openrouter,retries]'s changelog.

description: "Pydantic AI upgrade guide and changelog: the breaking changes in each release, how to install V2, and the recommended path to migrate your code from V1."

Upgrade Guide

In September 2025, Pydantic AI reached V1 and committed to API stability: no changes that break your code until V2. V2 is now available, collecting the breaking and behavior changes that stability guarantee didn't allow. This guide is the canonical place to learn what's in V2, how to install it, and how to upgrade; for the guarantees behind these version numbers, see the Version Policy.

Breaking Changes

Here's a filtered list of the breaking changes for each version to help you upgrade Pydantic AI.

v2.0.0 (2026-06-23)

The stable V2.0 release. There are no new breaking or behavior changes since the betas; the full breaking-change list and recommended upgrade path are in the v2.0.0b1 entry below. Install it with:

uv add pydantic-ai

v2.0.0b7 (2026-06-10)

The seventh V2 beta, forked from v1.107.0. There are no new V2 breaking or behavior changes since v2.0.0b6 below — everything in that entry applies unchanged — but this beta picks up the latest V1 release on top, which adds Claude Fable 5 / Mythos 5 model support and OpenRouter prompt caching (CachePoint), plus known_model_names() and Anthropic fixes; see the v1.107.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b7"

For the full breaking-change list and the recommended upgrade path, see the v2.0.0b1 entry below; the only difference is that the latest V1 to upgrade through first is now v1.107.0.

v2.0.0b6 (2026-06-04)

The sixth V2 beta, forked from v1.106.0. There are no new V2 breaking or behavior changes since v2.0.0b5 below — everything in that entry applies unchanged — but this beta picks up the latest V1 release on top, which adds api_host/timeout configuration and base seed mapping for the xAI provider, plus streaming and data-URI handling fixes; see the v1.106.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b6"

For the full breaking-change list and the recommended upgrade path, see the v2.0.0b1 entry below; the only difference is that the latest V1 to upgrade through first is now v1.106.0.

v2.0.0b5 (2026-06-02)

The fifth V2 beta, forked from v1.105.0. There are no new V2 breaking or behavior changes since v2.0.0b4 below — everything in that entry (including the prepare-callbacks change) still applies — but this beta picks up the latest V1 release on top, which adds on-demand (deferred-loading) capabilities and Grok 4.3 reasoning_effort support, plus GoogleModelSettings.google_cached_content and Temporal gateway/ fixes; see the v1.105.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

... (truncated)

Commits
  • 6695132 Hold pydantic-ai-harness to the 100% coverage gate and strict-no-cover, a...
  • 1ec8ce4 Normalize CRLF in the rewind menu preview test so it passes on Rich 15 (#9722)
  • c4cc8bc Exempt the arguments and text TestModel generates from the scope requiremen...
  • bdffc6c Keep BubblewrapWorkspace commands from running code on the SSH host through...
  • fcbbc00 Return the live token from PKCESignIn.token() when another clai2 session ...
  • a5258ce Name tests/test_docs_navigation.py as the check for harness navigation entr...
  • de0dab7 Propagate a native cancel that lands during a command timeout's stop (#9675)
  • 47f5715 Preserve text and reasoning part boundaries in OpenAIChatModel streams (#8729)
  • 3184a7d Preserve dependency extras in clai2 archive updates (#9690)
  • ee1b888 Allow deleting unused models from the clai2 /model menu (#9696)
  • Additional commits viewable in compare view

Updates sqlalchemy[asyncio] to 2.1.4

Release notes

Sourced from sqlalchemy[asyncio]'s releases.

2.1.4

Released: October 7, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

    References: #13659

engine

  • [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

    This change is also backported to: 2.0.55

    References: #13640

  • [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

    This change is also backported to: 2.0.55

    References: #13641

  • [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

Updates boto3 from 1.43.108 to 1.43.110

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the server-python group across 1 directory with 9 updates
ab8c09d 
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-python
- dependency-name: asyncpg
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-python
- dependency-name: fastapi[standard]
  dependency-version: 0.143.0
  dependency-type: direct:production
  dependency-group: server-python
- dependency-name: krippendorff
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-python
- dependency-name: openai
  dependency-version: 3.26.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-python
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-python
- dependency-name: pydantic-ai-slim[openai,openrouter,retries]
  dependency-version: 2.54.0
  dependency-type: direct:production
  dependency-group: server-python
- dependency-name: sqlalchemy[asyncio]
  dependency-version: 2.1.4
  dependency-type: direct:production
  dependency-group: server-python
- dependency-name: boto3
  dependency-version: 1.43.110
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 11, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alehuo