Bump the python-deps group across 1 directory with 9 updates

[dependabot]

Bumps the python-deps group with 9 updates in the / directory:

Package	From	To
fastapi	0.139.0	0.141.1
uvicorn	0.50.2	0.52.1
pypdf	6.14.2	6.15.0
matplotlib	3.11.0	3.11.1
polars	1.42.1	1.43.2
python-calamine	0.7.0	0.8.2
duckdb	1.5.4	1.5.5
ipython	9.15.0	9.16.1
tqdm	4.68.4	4.70.0

Updates fastapi from 0.139.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn from 0.50.2 to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Version 0.51.0

What's Changed

• Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @​Kludex in Kludex/uvicorn#3025
• Remove colorama from the standard extra by @​Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

Commits

• ee8e45c Version 0.52.1 (#3056)
• b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
• 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
• 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
• 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
• e148451 Handle connection loss during WebSocket write backpressure (#3050)
• e16a69b Add missing write flow control to websockets-sansio (#3048)
• ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
• 8f1b884 Version 0.52.0 (#3044)
• f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
• Additional commits viewable in compare view

Updates pypdf from 6.14.2 to 6.15.0

Release notes

Sourced from pypdf's releases.

Version 6.15.0, 2026-08-06

What's new

Security (SEC)

• Improve performance of read_until_whitespace (#3947) by @​stefan6419846
• Limit CID width range and width count when loading fonts (#3946) by @​stefan6419846
• Limit token length for ToUnicode entries (#3944) by @​stefan6419846

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#3897) by @​stefan6419846

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#3901) by @​PJBrs
• Allow keeping original PDF header in non-incremental clone mode (#3918) by @​pctablet505
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831) by @​PJBrs
• Add actions base class (#3552) by @​j-t-1

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#3938) by @​RavSinghChandan
• Decode low-bit DeviceRGB images as RGB instead of palette (#3929) by @​RavSinghChandan
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937) by @​stefan6419846

Documentation (DOC)

• Image and attachment filenames are unsanitized (#3942) by @​stefan6419846

Maintenance (MAINT)

• Update charset mappings (#3935) by @​stefan6419846

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.15.0, 2026-08-06

Security (SEC)

• Improve performance of read_until_whitespace (#3947)
• Limit CID width range and width count when loading fonts (#3946)
• Limit token length for ToUnicode entries (#3944)

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#3897)

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#3901)
• Allow keeping original PDF header in non-incremental clone mode (#3918)
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831)
• Add actions base class (#3552)

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#3938)
• Decode low-bit DeviceRGB images as RGB instead of palette (#3929)
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937)

Documentation (DOC)

• Image and attachment filenames are unsanitized (#3942)

Maintenance (MAINT)

• Update charset mappings (#3935)

Full Changelog

Commits

• 7f226a2 REL: 6.15.0
• 4959848 SEC: Improve performance of read_until_whitespace (#3947)
• 51cb6ac SEC: Limit CID width range and width count when loading fonts (#3946)
• afba808 SEC: Limit token length for ToUnicode entries (#3944)
• aa2f37d DOC: Image and attachment filenames are unsanitized (#3942)
• 760ba28 DOC: Further clarify security policy
• 55bd85c BUG: Expand low-bit samples for images without a filter (#3938)
• 4807cb4 ROB: Tolerate malformed /FontBBox when building font descriptors (#3895)
• ce9320b DEV: Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#3941)
• 8b6f6fd ENH: Add ActualText tag when we produce RTL appearance stream (#3901)
• Additional commits viewable in compare view

Updates matplotlib from 3.11.0 to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Fix tight layout of multiple subplots with sharey=True
• Fix NoNorm cursor formatting for uint8 images
• Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
• Fix clipped Axis labels on 3D plots with tight layout
• Fix inverted Axis on 3D plots
• Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
• Fix missing glyphs when subsetting Type 1 fonts in PDF
• Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits

• 3c1757a REL: v3.11.1
• 792c6b5 DOC: Prepare for 3.11.1
• aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
• d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
• 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
• 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
• c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
• 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
• a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
• 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
• Additional commits viewable in compare view

Updates polars from 1.42.1 to 1.43.2

Release notes

Sourced from polars's releases.

Python Polars 1.43.2

⚠️ Deprecations

• Deprecate casts from Categorical to integer dtypes (#28525)
• Deprecate not setting the plan_stage argument in show_graph() (#28391)

🚀 Performance improvements

• Pushdown len() to concat/union inputs (#28570)

✨ Enhancements

• Issue FutureWarning on using from_arrow of ArrowStreamExportable (#28442)
• Add infer_schema_files parameter to scan_csv (#28440)

🐞 Bug fixes

• Properly propagate enum metadata for iceberg column mapping (#28580)
• Correctly write parquet field IDs for enums and categoricals (#28581)
• Fix arrow C interop binview offset (#28623)
• Fix duplicate hive values in hive pre-partition rewrite (#28621)
• Double-counted offset for Arrow export of sliced Series(Array) (#28602)
• Struct/List/Array equality handling in sort and join (#28601)
• More careful slice pushdown into joins (#28578)
• Preserve ordering in sliced unions (#28576)
• Drop input sortedness when casting to a string (#28574)
• Clear sortedness flags in StringChunked substring kernels (#28573)
• Bad mask handling when reading optional parquet column (#28547)
• Any operation on Unknown(Int) and Unknown(Float) should result in Unknown(Float) (#28545)
• Flip nulls_last after Expr.reverse() (#28572)
• Fix high blocking thread use in sink_parquet with async local path (#28543)
• Serialize LazyFrames backed by bytes (#28568)
• Release GIL in SQLContext.execute() (#28549)
• Propagate nulls_last in function_expr_sortedness (#28544)
• Incorrect slicing when a join requires sorting (#28541)

🛠️ Other improvements

• Fix duckdb delta extension install collision (#28607)

Thank you to all our contributors for making this release possible! @​BitWeaverDev, @​Matt711, @​Samoilov2004, @​borchero, @​dancsi, @​dsprenkels, @​kdn36, @​masumi-ryugo, @​nameexhaustion and @​ritchie46

Python Polars 1.43.1

🚀 Performance improvements

• Optimize not(bool_f) to not_bool_f (#28474)

✨ Enhancements

... (truncated)

Commits

• ae588a9 fix: Properly propagate enum metadata for iceberg column mapping (#28580)
• f6c766a fix: Correctly write parquet field IDs for enums and categoricals (#28581)
• 12f83f5 Python Polars 1.43.2 (#28625)
• 1ec0668 fix: Fix arrow C interop binview offset (#28623)
• af24b92 perf: Pushdown len() to concat/union inputs (#28570)
• e79bdb0 fix: Fix duplicate hive values in hive pre-partition rewrite (#28621)
• 7a6cdbc fix: Double-counted offset for Arrow export of sliced Series(Array) (#28602)
• a2b0b2a fix: Struct/List/Array equality handling in sort and join (#28601)
• 9aca544 ci: Fix duckdb delta extension install collision (#28607)
• 7d6483b fix(rust): Use try_new in StructArray construction in polars-json (#27489)
• Additional commits viewable in compare view

Updates python-calamine from 0.7.0 to 0.8.2

Release notes

Sourced from python-calamine's releases.

v0.8.2

Full Changelog: dimastbk/python-calamine@v0.8.1...v0.8.2

v0.8.1

What's Changed

• ci: add pyodide (PyEmscripten) build and test by @​dimastbk in dimastbk/python-calamine#213
• build(deps-dev): bump pytest from 9.0.2 to 9.0.3 by @​dependabot[bot] in dimastbk/python-calamine#215
• build(deps): bump pygments from 2.19.2 to 2.20.0 by @​dependabot[bot] in dimastbk/python-calamine#214

Full Changelog: dimastbk/python-calamine@v0.8.0...v0.8.1

v0.8.0

What's Changed

• tests: remove pandas 2.2 from ci and pandas 3.0 by @​dimastbk in dimastbk/python-calamine#211
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in dimastbk/python-calamine#206
• build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @​dependabot[bot] in dimastbk/python-calamine#207
• build(deps): bump actions/cache from 5.0.5 to 6.1.0 by @​dependabot[bot] in dimastbk/python-calamine#208
• build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in dimastbk/python-calamine#209
• Upgrade calamine dependency to 0.36.0 by @​dayongxie in dimastbk/python-calamine#212

New Contributors

• @​dayongxie made their first contribution in dimastbk/python-calamine#212

Full Changelog: dimastbk/python-calamine@v0.7.0...v0.8.0

Commits

• cd6f36f bump to 0.8.2
• 7bda614 ci: sync all build artifacts name
• 0804d5e bump to 0.8.1
• 427ebeb Merge pull request #214 from dimastbk/dependabot/uv/pygments-2.20.0
• feabd87 Merge branch 'master' into dependabot/uv/pygments-2.20.0
• de6aee2 Merge pull request #215 from dimastbk/dependabot/uv/pytest-9.0.3
• c0a188d build(deps-dev): bump pytest from 9.0.2 to 9.0.3
• f9e6606 build(deps): bump pygments from 2.19.2 to 2.20.0
• d2fb617 Merge pull request #213 from dimastbk/add-pyodide
• d5cd2a4 ci: add pyodide (PyEmscripten) build and test
• Additional commits viewable in compare view

Updates duckdb from 1.5.4 to 1.5.5

Release notes

Sourced from duckdb's releases.

v1.5.5 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

What's Changed in DuckDB-Python

• Fix numpy deprecations by @​evertlammerts in duckdb/duckdb-python#505
• Fix alias of DuckDBPyRelation.query (closes #468) by @​evertlammerts in duckdb/duckdb-python#524

Commits

• b236c81 Pin submodule to release hash
• e6a21c5 [duckdb-labs bot] Bump DuckDB submodule (#554)
• f637bf4 Bump submodule
• 4c5c73c [duckdb-labs bot] Bump DuckDB submodule (#551)
• 6fae280 Bump submodule
• d8d5f0a [duckdb-labs bot] Bump DuckDB submodule (#548)
• 5d85f06 Bump submodule
• c3cbf8d [duckdb-labs bot] Bump DuckDB submodule (#545)
• 93418b6 Bump submodule
• 24f1915 [duckdb-labs bot] Bump DuckDB submodule (#539)
• Additional commits viewable in compare view

Updates ipython from 9.15.0 to 9.16.1

Commits

• 3b83e1b release 9.16.1
• cc8334e Convert IFrame sources to strings before HTML escaping (#15348)
• 82a902e back to dev
• 2ae7863 release 9.16.0
• 6334b8f Update whats new for version 9.16 (#15342)
• dbbfa7b escape urls and file names interpolated into display html attributes (#15334)
• 59986e7 fix: correct typos
• 0e9d34d Fix missing space
• 1a753ba Resolve attribute annotations under the policy in eval_node (#15337)
• 876b5aa resolve attribute annotations under the policy in eval_node
• Additional commits viewable in compare view

Updates tqdm from 4.68.4 to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

• contrib.concurrent: major improvements
  • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
  • fix total based on shortest iterable length (#1473)
  • use default max_workers (#1543 <- #1530, #1518)
  • support timeout, buffersize (#1576)
  • improve ETA (#1708 <- #1161)
  • update as_completed (#1709 <- #1565)
  • add tqdm.concurrent.intepreter_map (#1777)
• asyncio: support iterables with only __aiter__ (#1714 <- #1686)
• support reset(float("inf")) (#1783 <- #1781, #651)
• framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

• contrib.logging: preserve filters (#1775 <- #1581)
• rich: misc fixes (#1773)
  • support generators (without len) (#1391)
  • fix potential AttributeError on exit (#1674)
• fix total=float('inf') (#1781 <- #651)
• fix potential AttributeError on exit (#1778 <- #1668, #1537, #261)
• fix minor docs typos (#1780, #1746)

tqdm v4.69.0 stable

• add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)
• misc minor framework updates
  • bump workflow actions & pre-commit hooks

Commits

• 96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
• c27393e misc tidy
• 061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
• 9fc160b Update how we check for interpreter_map support in the tests
• b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
• 16d5486 Add support for nested progress bars
• 9f5890f Add initial implementation for interpreter_map
• 321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
• 4664b57 minor tidy
• 426a098 Treat inf total as unknown in reset() too
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions