build(deps): bump the backend-python group across 1 directory with 76 updates

[dependabot]

Bumps the backend-python group with 76 updates in the /backend directory:

Package	From	To
fastapi	0.139.0	0.141.1
starlette	1.3.1	1.6.0
uvicorn	0.51.0	0.53.0
pydantic-settings	2.14.2	2.15.0
aiosmtplib	5.1.2	5.1.3
sqlalchemy	2.0.51	2.0.54
alembic	1.18.5	1.20.0
greenlet	3.5.3	3.5.6
openai	2.45.0	3.15.0
tiktoken	0.13.0	0.14.0
google-api-python-client	2.198.0	2.200.0
google-auth-httplib2	0.4.0	0.4.2
google-auth-oauthlib	1.4.0	1.4.1
cryptography	50.0.0	50.0.1
prometheus-fastapi-instrumentator	8.0.2	8.1.0
opentelemetry-api	1.43.0	1.44.0
opentelemetry-sdk	1.43.0	1.44.0
opentelemetry-instrumentation-fastapi	0.64b0	0.65b0
opentelemetry-exporter-otlp	1.43.0	1.44.0
protobuf	7.35.1	7.36.2
setuptools	83.0.0	84.0.0
wheel	0.47.0	0.48.0
websockets	16.1	17.1
pyjwt	2.13.0	2.14.0
icalendar	7.2.0	7.3.0
coverage	7.15.1	7.16.1
ruff	0.15.21	0.16.8
annotated-doc	0.0.4	0.0.5
annotated-types	0.7.0	0.8.0
anyio	4.14.2	4.15.1
asgiref	3.11.1	3.12.1
certifi	2026.6.17	2026.7.22
cffi	2.1.0	2.1.1
charset-normalizer	3.4.9	3.5.1
click	8.4.2	8.5.0
google-api-core	2.31.0	2.38.0
google-auth	2.55.2	2.58.0
googleapis-common-protos	1.75.0	1.75.3
grpcio	1.82.1	1.84.0
idna	3.18	3.20
jiter	0.16.0	0.17.0
langchain-core	1.4.9	1.6.3
langchain-protocol	0.0.18	0.0.19
langsmith	0.10.2	0.12.6
mako	1.3.12	1.4.1
opentelemetry-exporter-otlp-proto-common	1.43.0	1.44.0
opentelemetry-exporter-otlp-proto-grpc	1.43.0	1.44.0
opentelemetry-exporter-otlp-proto-http	1.43.0	1.44.0
opentelemetry-instrumentation	0.64b0	0.65b0
opentelemetry-instrumentation-asgi	0.64b0	0.65b0
opentelemetry-proto	1.43.0	1.44.0
opentelemetry-semantic-conventions	0.64b0	0.65b0
opentelemetry-util-http	0.64b0	0.65b0
orjson	3.11.9	3.12.0
packaging	26.2	26.3
prometheus-client	0.25.0	0.26.0
proto-plus	1.28.1	1.28.4
pydantic	2.13.4	2.13.5
pydantic-core	2.46.4	2.49.0
pygments	2.20.0	2.21.0
python-dotenv	1.2.2	1.2.3
regex	2026.7.10	2026.9.10
tqdm	4.68.4	4.70.1
typing-inspection	0.4.2	0.4.4
tzdata	2026.3	2026.4
urllib3	2.7.0	2.8.0
uuid-utils	0.17.0	1.0.0
wrapt	2.2.2	2.4.1
xxhash	3.8.1	4.0.1
pydantic-ai-slim	2.9.0	2.45.0
genai-prices	0.0.71	0.1.7
griffelib	2.1.0	2.3.0
httpcore2	2.5.0	2.13.0
httpx2	2.5.0	2.13.0
logfire-api	4.37.0	5.1.0
pydantic-graph	2.9.0	2.45.0

Updates fastapi from 0.139.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

• Add max_body_size to Starlette and route classes by @​Kludex in Kludex/starlette#3431
• Expose http.response.debug info via response extensions by @​y2kbugger in Kludex/starlette#3130

New Contributors

• @​y2kbugger made their first contribution in Kludex/starlette#3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Version 1.5.1

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @​nikolauspschuetz in encode/starlette#3389
• Limit FileResponse to 100 ranges by @​Kludex in encode/starlette#3430

Full Changelog: Kludex/starlette@1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @​Kludex in encode/starlette#3418
• Flush GZip output for each streamed chunk by @​Kludex in encode/starlette#3419
• Skip compression of partial responses in GZipMiddleware by @​Kludex in encode/starlette#3420
• Expand default excluded content types in GZipMiddleware by @​Kludex in encode/starlette#3421

Full Changelog: Kludex/starlette@1.4.1...1.5.0

Version 1.4.1

What's Changed

• Default thread_minimum_size in GZipResponder by @​Kludex in Kludex/starlette#3415

Full Changelog: Kludex/starlette@1.4.0...1.4.1

Version 1.4.0

What's Changed

• Lazily allocate GZipMiddleware compression resources by @​Kludex in Kludex/starlette#3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @​Kludex in Kludex/starlette#3411
• Offload large GZip compression by @​Kludex in Kludex/starlette#3410

New Contributors

• @​benberryallwood made their first contribution in Kludex/starlette#3334
• @​lkk7 made their first contribution in Kludex/starlette#3359

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

• Add max_body_size to Starlette and route classes #3431.
• Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

• Reject inverted single-byte ranges in FileResponse #3389.
• Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

• Add exclude_content_types parameter to GZipMiddleware #3418.

Changed

• Expand default excluded content types in GZipMiddleware #3421.

Fixed

• Flush GZip output for each streamed chunk #3419.
• Skip compression of partial responses in GZipMiddleware #3420.

1.4.1 (August 5, 2026)

Fixed

• Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

• Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

• Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
• Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.

Commits

• 4f250d6 Version 1.6.0 (#3434)
• 9eea41a Expose http.response.debug info via response extensions (#3130)
• 38f8999 Add max_body_size to Starlette and route classes (#3431)
• c41236c Version 1.5.1 (#3432)
• 9c500db Limit FileResponse to 100 ranges (#3430)
• 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
• c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
• ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
• 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
• d96887e Add Pydantic Logfire banner to the docs (#3428)
• Additional commits viewable in compare view

Updates uvicorn from 0.51.0 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

... (truncated)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

• case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
• Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
• Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

• Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
• PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
• toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
• Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
• GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

• Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
• Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
• Fix AliasPath on nested model fields not JSON-decoding env values (#898).
• Fix case-insensitive matching for optional nested models (#905).
• Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
• Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
• Fix Secret subclasses crashing when loaded from the environment (#920).
• Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
• An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
• NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
• GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
• AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

• Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
• Recommend an async settings loading pattern (#908).
• Clarify behavior when an unprefixed value is present in a dotenv file (#895).
• Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

• Update documentation link for Pydantic settings by @​hramezani in pydantic/pydantic-settings#863
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#865
• docs: clarify environment variable helper descriptions by @​vip892766gma in pydantic/pydantic-settings#867
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#870
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#875
• Skip list_secrets call when case_sensitive=True by @​ecerulm in pydantic/pydantic-settings#862
• GoogleSecretManagerSettingsSource: read project_id from previous sources by @​ecerulm in pydantic/pydantic-settings#878

... (truncated)

Commits

• f725ca1 Prepare release 2.15.0 (#930)
• 28f35c2 Bump the python-packages group with 4 updates (#929)
• 9056db0 test: move function-local imports to the top of test modules (#927)
• f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
• ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
• 798dcea Bump the python-packages group with 4 updates (#924)
• a190041 Bump the github-actions group with 4 updates (#925)
• 5d93332 Bump the python-packages group with 4 updates (#921)
• d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
• 2256a4e Bump the python-packages group with 3 updates (#915)
• Additional commits viewable in compare view

Updates aiosmtplib from 5.1.2 to 5.1.3

Release notes

Sourced from aiosmtplib's releases.

v5.1.3

What's Changed

• Security: reject addresses containing whitespace or angle brackets outside of a quoted local part in mail, rcpt, vrfy, expn and sendmail. Previously, a caller supplied address such as user@example.com> AUTH=<attacker@example.com could smuggle additional ESMTP parameters onto the command line. This is a follow up to the fix in 5.1.1 for CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. sendmail now validates all addresses before sending any commands.
• Bugfix: reject local_hostname values (and the hostname argument to helo/ehlo) containing whitespace or control characters, so a hostname such as me.example.com XCLIENT ADDR=1.2.3.4 can no longer smuggle extra parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped.
• Bugfix: raise SMTPAuthenticationError instead of binascii.Error when the server sends a malformed (non-base64) CRAM-MD5 challenge, so login can fall back to the next auth method
• Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks @​Charisn for contributing)
• Bugfix: handle protocol connection lost callback arriving after reconnect
• Bugfix: close connection on async context manager exit in cases of a server error response
• Bugfix: release connection lock on connect timeout
• Bugfix: re-derive the default port on each connect() so changing use_tls/start_tls between connects no longer reuses a stale default. Defaulted port/hostname are now resolved per-connect rather than written back onto the instance, so they read back as None when unset
• Bugfix: typeerror in latest ty
• Bugfix: mark response waiter exceptions as retrieved when they are set, so Future exception was never retrieved is no longer logged on free-threaded builds where the previous __del__ based cleanup ran too late
• CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)
• Bugfix: the SIZE parameter sent with MAIL FROM now reports the number of octets as the message will be transmitted (with CRLF line endings), rather than the raw length of the message argument
• Bugfix: data arriving on the transport after the connection is lost is now dropped instead of raising RuntimeError from the protocol callback
• Bugfix: SMTPProtocol now records that it is using TLS after a successful start_tls, so a second upgrade attempt on the protocol is rejected
• Bugfix: starttls now validates its TLS options before sending EHLO, so invalid options raise ValueError without touching the connection
• Bugfix: helo no longer records a failed response as last_helo_response, so a rejected HELO does not leave the session looking as if a greeting succeeded
• Bugfix: bytearray and memoryview values are no longer silently passed through the auth encoding helpers; only str and bytes are accepted, as the type annotations already stated
• Bugfix: TLS context setup now run in thread (thanks @​tr4nt0r)

New Contributors

... (truncated)

Changelog

Sourced from aiosmtplib's changelog.

5.1.3

• Security: reject addresses containing whitespace or angle brackets outside of a quoted local part in mail, rcpt, vrfy, expn and sendmail. Previously, a caller supplied address such as user@example.com> AUTH=<attacker@example.com could smuggle additional ESMTP parameters onto the command line. This is a follow up to the fix in 5.1.1 for CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. sendmail now validates all addresses before sending any commands.
• Bugfix: reject local_hostname values (and the hostname argument to helo/ehlo) containing whitespace or control characters, so a hostname such as me.example.com XCLIENT ADDR=1.2.3.4 can no longer smuggle extra parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped.
• Bugfix: raise SMTPAuthenticationError instead of binascii.Error when the server sends a malformed (non-base64) CRAM-MD5 challenge, so login can fall back to the next auth method
• Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks @​Charisn for contributing)
• Bugfix: handle protocol connection lost callback arriving after reconnect
• Bugfix: close connection on async context manager exit in cases of a server error response
• Bugfix: release connection lock on connect timeout
• Bugfix: re-derive the default port on each connect() so changing use_tls/start_tls between connects no longer reuses a stale default. Defaulted port/hostname are now resolved per-connect rather than written back onto the instance, so they read back as None when unset
• Bugfix: typeerror in latest ty
• Bugfix: mark response waiter exceptions as retrieved when they are set, so Future exception was never retrieved is no longer logged on free-threaded builds where the previous __del__ based cleanup ran too late
• CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)
• Bugfix: the SIZE parameter sent with MAIL FROM now reports the number of octets as the message will be transmitted (with CRLF line endings), rather than the raw length of the message argument
• Bugfix: data arriving on the transport after the connection is lost is now dropped instead of raising RuntimeError from the protocol callback
• Bugfix: SMTPProtocol now records that it is using TLS after a successful start_tls, so a second upgrade attempt on the protocol is rejected
• Bugfix: starttls now validates its TLS options before sending EHLO, so invalid options raise ValueError without touching the connection
• Bugfix: helo no longer records a failed response as last_helo_response, so a rejected HELO does not leave the session looking as if a greeting succeeded
• Bugfix: bytearray and memoryview values are no longer silently passed through the auth encoding helpers; only str and bytes are accepted, as the type annotations already stated
• Bugfix: TLS context setup now run in thread (thanks @​tr4nt0r)

Commits

• 9cc4254 ci: only twine-check wheel and sdist in buildcheck
• e4ee41a release: v5.1.3
• 8ee1047 test: replace event_loop_policy override with pytest_asyncio_loop_factories hook
• ddf47a7 ci: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)
• ced720d test: expect HeaderWriteError for non-ASCII address on Python 3.15+
• 4d22898 fix: mark response waiter exceptions as retrieved when set
• 7b8e3de fix: report SIZE as transmitted octets, not raw message length
• aa0d536 fix: drop data received after connection loss instead of raising
• bdc17f5 fix: mark SMTPProtocol as over SSL after a successful start_tls
• 1d84d57 fix: validate starttls options before sending EHLO
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

• [platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

• [platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

  References: #13592

2.0.53

Released: September 14, 2026

orm

• [orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

  References: #13560

• [orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an

... (truncated)

Commits

• See full diff in compare view

Updates alembic from 1.18.5 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

• [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

  References: #1846

• [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

  References: #916

bug

• [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

  References: #1768

• [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

• See full diff in compare view

Updates greenlet from 3.5.3 to 3.5.6

Changelog

Sourced from greenlet's changelog.

3.5.6 (2026-09-14)

• Correct a race condition that could lead to garbage collection unintentionally being disabled. See PR 529 <https://github.com/python-greenlet/greenlet/pull/529>_ by Yurii.

3.5.5 (2026-08-10)

• Link the C++ runtime statically into the Windows wheels again, as the Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported MSVCP140.dll, which no Windows CPython distribution ships, so importing greenlet failed on machines without the Visual C++ redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue and pull request by Daniel Sticker.

.. note:: Binary 3.15 wheels are now built with 3.15.0rc1. This should be compatible with future 3.15 releases and is believed compatible with 3.15b4 as well (but not earlier versions).

3.5.4 (2026-07-22)

• Fix a crash (segfault) on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet that was started from a non-empty C-stack-reference state is active. See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

• Fix a potential use-after-free on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet is suspended holding a _PyCStackRef (for example, mid attribute resolution). See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

• Fix a deadlock on free-threaded builds when a greenlet switch happened while a PyCriticalSection was held -- for example inside asyncio's Task.__step, which holds one on the running task for the duration of the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>. Thanks to ddorian and Kumar Aditya.

.. note::

... (truncated)

Commits

• abfe740 Preparing release 3.5.6
• e23e3e4 Change note for #529
• 8de830f Merge pull request #529 from Georggi/patch-1
• 72d7cac Merge pull request #530 from python-greenlet/dependabot/github_actions/github...
• ac01b7d Bump github/codeql-action in the github-actions group
• e18f5a6 Simplify GCDisabledGuard constructor
• 6aaf3af Back to development: 3.5.6
• ddb1453 Preparing release 3.5.5
• 7de515c Update CHANGES: Credit for iss...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: ContextualWisdomLab/naruon/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: ab0b6231-2752-4999-bdcc-23c10d90921b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Owner-path repair (2026-09-21 KST): this generated backend update lane is now Draft and retargeted onto canonical Starlette/TestClient dependency owner #1565 (codex/starlette-testclient-dependency@52dfc863d1a5d6e4e80b6366f719dd09f2aa6172).

Why: #1749 changes backend/pyproject.toml, backend/requirements-agent.txt, backend/requirements-hashes.txt, and backend/requirements.txt, while #1565 owns the coherent TestClient dependency contract across those inputs and backend/uv.lock. The generated #1749 branch does not currently carry that uv-lock owner delta, so it is not yet a valid descendant or a verified complete successor. Mechanical conflict after retarget is a repair finding, not a reason to restore direct develop admission.

The valid update intent must be reconciled ordinary/non-force above #1565: preserve its direct httpx2/warnings-as-errors runtime proof and coherent pyproject/plain/hash/uv lock graph, then apply only reviewed dependency changes and regenerate locks. In particular, retain and independently verify the security-material aiosmtplib==5.1.3 change; upstream 5.1.3 adds follow-up SMTP command/hostname injection hardening. Do not let that fix be delayed or implicitly accepted as one undifferentiated 76-package compatibility change.

Closed predecessor Dependabot lane #1685 is audit lineage for the same broad update class, not proof that #1749 already inherited every valid delta/evidence. #1752 repairs the wildcard grouping policy prospectively; it does not make this current generated branch merge-ready.

No @dependabot rebase, force push, destructive rebase, manual generated-lock edit, predecessor GREEN transfer, self-approval, or gate weakening. Keep Draft until the owner delta is reconciled and the resulting exact head has current install/TestClient/warnings-as-errors/SMTP hostile-case/Security/CodeQL/full-suite evidence plus qualifying independent review.

[seonghobae]

Owner-routing / security-preservation finding (current head 944e0ac13d9837ba7e8ac11e762a649e9c36cf7b): keep this PR Draft as the generated migration/provenance lane; do not merge the 76-package bundle as a security fix.

Fresh changed-file inventory is only backend/pyproject.toml, backend/requirements-agent.txt, backend/requirements-hashes.txt, and backend/requirements.txt; backend/uv.lock is absent. Because base #1565 exact 52dfc863d1a5d6e4e80b6366f719dd09f2aa6172 explicitly owns a coherent pyproject.toml / plain requirements / hashed requirements / uv-lock graph, this head cannot be accepted until valid deltas are decomposed/reconciled and the lock graph is regenerated ordinary-forward. GitHub currently reports this PR non-mergeable.

Preserve one delta independently during that decomposition: aiosmtplib 5.1.2 -> 5.1.3. Precision matters: GitHub's reviewed CVE-2026-53533 / GHSA-v3q9-hj7j-63hq says the original CR/LF command injection was patched in 5.1.1, so 5.1.2 should not be mislabeled as still CVE-affected. Upstream 5.1.3 is nevertheless security-material follow-up hardening: it rejects whitespace/angle brackets outside quoted local parts (documented example: user@example.com> AUTH=<attacker@example.com) and validates sendmail addresses before issuing commands, closing ESMTP-parameter smuggling that control-character-only validation did not cover.

PyPI 5.1.3 provenance checked fresh: sdist SHA-256 ac2b418d3260ba62d9cfd0fe7359726e9dc009a4e8e8d9909fdfae332f522a7c, wheel SHA-256 f7d76ce3d4995a65a178c1f11e1bd1607706b921d00cb768e7a2c7f7ef5517a8; these match this generated hash file. The focused successor must synchronize pyproject.toml, requirements.txt, requirements-hashes.txt, and uv.lock, add hostile-address regression evidence, and reacquire install/Security/CodeQL gates. #1752 already excludes aiosmtplib from the wildcard backend group so this security patch remains independently reviewable once that policy lands.

Do not Close this generated lane until bounded successors have completely inherited every valid delta/evidence, per PR-0/succession policy.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.