deps: bump the pip-minor-patch group across 1 directory with 20 updates by dependabot[bot] · Pull Request #179 · KayzenRoot/hive

dependabot · 2026-11-09T01:37:55Z

Bumps the pip-minor-patch group with 20 updates in the / directory:

Package	From	To
alembic	`1.15.1`	`1.20.1`
fastapi	`0.133.0`	`0.162.0`
python-multipart	`0.0.31`	`0.0.33`
pypdf	`6.16.2`	`6.21.4`
anyio	`4.14.2`	`4.16.0`
idna	`3.19`	`3.20`
pydantic	`2.13.5`	`2.14.3`
pydantic-core	`2.46.5`	`2.50.4`
pydantic-settings	`2.7.1`	`2.16.2`
psycopg	`3.2.4`	`3.3.8`
psycopg-binary	`3.2.4`	`3.3.8`
sqlalchemy	`2.0.38`	`2.1.8`
python-dotenv	`1.2.3`	`1.2.4`
starlette	`1.3.1`	`1.10.0`
typing-inspection	`0.4.4`	`0.4.5`
tzdata	`2026.3`	`2026.6`
uvicorn	`0.34.0`	`0.54.0`
mako	`1.3.12`	`1.4.3`
jsonschema	`4.23.0`	`4.26.0`
ruff	`0.9.4`	`0.17.4`

Updates alembic from 1.15.1 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

[bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

References: #1085

[bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

References: #1360

[bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

References: #1462

[bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

[bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

See full diff in compare view

Updates fastapi from 0.133.0 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

🐛 Restore default handling for omitted boolean form fields. PR #16605 by @tiangolo.

0.161.1

Fixes

🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @tiangolo.

0.161.0

Features

✨ Add support for combining unions of form models. PR #16596 by @tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @tiangolo.

Internal

⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @dependabot[bot].

0.159.1

Features

✨ Add support for optional unions of form models. PR #16586 by @tiangolo.

0.159.0

Features

✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @tiangolo.

0.158.2

Features

✨ Add support for optional form models. PR #16582 by @tiangolo.

0.158.1

... (truncated)

Commits

7a0a3f0 🔖 Release version 0.162.0 (#16606)
b56f7c6 📝 Update release notes
f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
69ddc2b 🔖 Release version 0.161.1 (#16599)
0cafa07 📝 Update release notes
f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
80c8742 🔖 Release version 0.161.0 (#16597)
b105209 📝 Update release notes
e42ac0a ✨ Add support for combining unions of form models (#16596)
addd077 🔖 Release version 0.160.0 (#16595)
Additional commits viewable in compare view

Updates python-multipart from 0.0.31 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.
pip install python-multipart==0.0.33
Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.

Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.

UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.

Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.

parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

Faster opening boundary matching (#328). Complete boundaries are matched in one step.

Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.

Faster querystring callback dispatch (#316).

🐍 Python support

Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.

Python 3.15 is supported (#350).

💜 Thank you

Thanks to @Edneam, @sungbin1015, @carlok, and @fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Version 0.0.32

What's Changed

Replace per-byte partial-boundary scan with rfind lookbehind by @Kludex in Kludex/python-multipart#300

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

Drop Python 3.10 support #329.

Add Python 3.15 support #350.

Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.

Normalize the content type returned by parse_options_header when the header has parameters #287.

Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.

Keep only the incomplete escape when quoted-printable data is split across writes #355.

Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.

Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.

Speed up parser state lookups #330.

Speed up opening boundary matching #328.

Speed up querystring callback dispatch #316.

0.0.32 (2026-06-04)

Speed up partial-boundary scanning for CR/LF-dense part data #300.

Commits

9217f26 Bump version to 0.0.33 (#357)
d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
44871df Handle nameless uploads when keeping the filename or extension (#343)
b21ea59 Add streaming field limits to FormParser (#333)
48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
95f6376 Use the shared security policy (#353)
8ec84ef Migrate documentation from MkDocs to Zensical (#352)
d7af81c Rewrite README for newcomers (#351)
b035d14 Add Python 3.15 classifier (#350)
Additional commits viewable in compare view

Updates pypdf from 6.16.2 to 6.21.4

Release notes

Sourced from pypdf's releases.

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

Limit the number of copied page attributes during flattening (#4290) by @stefan6419846

Detect EOF when reading standard xref table trailer (#4289) by @stefan6419846

Fix loop detection when cloning DictionaryObject (#4288) by @stefan6419846

Documentation (DOC)

Exclude performance issues from security reports (#4280) by @stefan6419846

Full Changelog

Version 6.21.3, 2026-10-27

What's new

Security (SEC)

Use the validated page count after decrypting a document (#4270) by @stefan6419846

Limit total number of cross-reference stream entries (#4269) by @stefan6419846

Avoid excessive error messages (#4265) by @stefan6419846

Performance Improvements (PI)

Read flat page label number trees once for all pages (#4251) by @kholdrex

Collect the named destinations once when resolving links (#4249) by @MartinThoma

Avoid scanning all objects in get_outline_root (#4245) by @kholdrex

Bug Fixes (BUG)

Resolve indirect widths in CID font /W arrays (#4267) by @tim-hilde

Documentation (DOC)

Block incremental writes of encrypted documents (#4246) by @metsw24-max

Developer Experience (DEV)

Update to PyPy 3.12 and pinned requirements (#4244) by @stefan6419846

Maintenance (MAINT)

Revert: Reject unsupported key lengths in the /Encrypt dictionary by @stefan6419846

Full Changelog

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Avoid repeated full file loads (#4240) by @stefan6419846

Limit size of standard xref table (#4239) by @stefan6419846

Bug Fixes (BUG)

Decode UniGB-UTF16 CMaps as UTF-16BE (#4231) by @4444wjt

Keep 8-bit DeviceRGB image mode (#4230) by @DGrutt

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.4, 2026-10-28

Security (SEC)

Limit the number of copied page attributes during flattening (#4290)

Detect EOF when reading standard xref table trailer (#4289)

Fix loop detection when cloning DictionaryObject (#4288)

Documentation (DOC)

Exclude performance issues from security reports (#4280)

Full Changelog

Version 6.21.3, 2026-10-27

Security (SEC)

Use the validated page count after decrypting a document (#4270)

Limit total number of cross-reference stream entries (#4269)

Avoid excessive error messages (#4265)

Performance Improvements (PI)

Read flat page label number trees once for all pages (#4251)

Collect the named destinations once when resolving links (#4249)

Avoid scanning all objects in get_outline_root (#4245)

Bug Fixes (BUG)

Resolve indirect widths in CID font /W arrays (#4267)

Documentation (DOC)

Block incremental writes of encrypted documents (#4246)

Developer Experience (DEV)

Update to PyPy 3.12 and pinned requirements (#4244)

Maintenance (MAINT)

Revert: Reject unsupported key lengths in the /Encrypt dictionary

Full Changelog

Version 6.21.2, 2026-10-21

Security (SEC)

Avoid repeated full file loads (#4240)

Limit size of standard xref table (#4239)

Bug Fixes (BUG)

Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)

Keep 8-bit DeviceRGB image mode (#4230)

Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

... (truncated)

Commits

b2c3fa2 REL: 6.21.4
ea4ac66 SEC: Limit the number of copied page attributes during flattening (#4290)
06593f9 SEC: Detect EOF when reading standard xref table trailer (#4289)
f176db1 SEC: Fix loop detection when cloning DictionaryObject (#4288)
c7d391c PI: Speed up transformation matrix handling for layout mode text extraction (...
b330dcd DEV: Bump actions/setup-python from 7.0.0 to 7.1.0 (#4278)
8901534 DOC: Exclude performance issues from security reports (#4280)
70eab9b PI: Speed up parse_bfchar (#4273)
4ef744f ROB: Skip an embedded file specification that is not a dictionary (#4256)
945216f ROB: Keep the text state when a text state operator has no operand in layout ...
Additional commits viewable in compare view

Updates anyio from 4.14.2 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @davidbrochart)

Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @theunkn0wn1)

Other changes

Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @graingert)

Bug fixes

Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @GruffElixir)

Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @AmirF194)

Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)

Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @graingert)

Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @graingert)

Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @graingert)

Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @graingert)

Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @graingert)

Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @graingert)

Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @graingert)

Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @BetterAndBetterII)

Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)

Fixed AsyncFile not shielding against cancellation while closing (#1314)

Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @Yasser-Ameur)

Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @dylanpulver)

Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @Kuang-xianxin)

Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @GruffElixir)

Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @skulitom)

Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @Aurelucien)

Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @feiiiiii5)

Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @Yasser-Ameur)

Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @januththedev)

Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @Zac-HD)

Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @DYNOSuprovo)

Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @pasmud)

Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @00200200)

Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @charan-rathore)

Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @feiiiiii5)

Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @feiiiiii5)

Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @Rodrigo-Palma)

Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @kokotatan)

Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @Kayvan-Zahiri)

Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)

Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @sricharanreddycheruku)

Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @fhgffy)

Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @adenzhou1350)

Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @fhgffy)

Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @adenzhou1350)

... (truncated)

Commits

0ddd02d Released version 4.16.0
576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
02ff4f8 Added BlockingPortal.call_async() (#1343)
1af29a4 Moved documentation code snippets into separate, checked files (#1445)
f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
95a0143 Test with blockbuster and uvloop on Python 3.15 too
4d51154 Modernized the memory object stream tests
1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
b7f8c68 [pre-commit.ci] pre-commit autoupdate (#1431)
Additional commits viewable in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

Commits

d55e65e Release 3.20
0c0824a Pre-release 3.20rc0
bd7c316 Note Python 3.15 support in the 3.20 changelog
b6cce85 Merge pull request #276 from kjd/unicode-18
9a4bc59 Update to Unicode 18.0.0
dfab5a0 Merge branch 'python-3.15'
417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
cd17392 Merge pull request #274 from kjd/fix-decode-length-check
c5796d7 Skip the decode round-trip check for domains past encode's length limit
d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

Build wheels for GraalPy 3.13 by @msimacek in #14136.

The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

Improve schema generation for fixed type handlers by @alexmojaki in #14130

Skip general schema dispatch for builtin scalars by @alexmojaki in #14141

Skip annotation handler setup when annotations are empty by @alexmojaki in #14149

Fix quadratic serialization time with per-index include/exclude on sequences by @Viicos in #14160

Avoid type lookups when checking for None during serialization by @Viicos in #14167

Improve performance of model serialization by @Viicos in #14171

Improve performance of dict serialization by @Viicos in #14172

Improve performance of type inference during serialization by @Viicos in #14173

Avoid cloning the field name when using the default value during validation by @Viicos in #14175

Do not evaluate model_config annotations by @Viicos in #14195

Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @Viicos in #14196

Use a lightweight @contextmanager implementation internally by @Viicos in #14199

Fixes

Fix various issues about GC tracking in pydantic-core by @Viicos in #13819

Include null in serialization JSON Schema for unless-none field serializers by @Kropiunig in #13848

Fix RecursionError when copying or unpickling models with defer_build by @Viicos in #14115

Remove dead default_factory check in unsupported Field() attribute by @owtaylor in #14129

Disallow non string extra keys during validation by @Viicos in #14135

Fix deeply nested data being reported as a cyclic reference by @Viicos in #14164

New Contributors

@owtaylor made their first contribution in #14129

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @Viicos in #14003

Bump speedate to v0.18.0 by @Viicos in #14007

Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @Viicos in #14083

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

ea492e0 Bump pydantic-core to v2.50.4
4f4a33f Prepare release v2.14.3
dca067b Benchmark TypedDict schema generation across builds
a2d1f6c Skip annotation handler setup when annotations are empty
3ae0a40 Construct builtin scalar union schemas directly
358d36f Skip general schema dispatch for builtin scalars
3cc701a Improve schema generation for fixed type handlers
762db7e Remove redundant None check in union schema generation
c214986 Bump pytest-codspeed to v5.0.4
038ee97 Bump typing-inspection to v0.4.5
Additional commits viewable in compare view

Updates pydantic-core from 2.46.5 to 2.50.4

Commits

ea492e0 Bump pydantic-core to v2.50.4

Bumps the pip-minor-patch group with 20 updates in the / directory: | Package | From | To | | --- | --- | --- | | [alembic](https://github.com/sqlalchemy/alembic) | `1.15.1` | `1.20.1` | | [fastapi](https://github.com/fastapi/fastapi) | `0.133.0` | `0.162.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.31` | `0.0.33` | | [pypdf](https://github.com/py-pdf/pypdf) | `6.16.2` | `6.21.4` | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.16.0` | | [idna](https://github.com/kjd/idna) | `3.19` | `3.20` | | [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.3` | | [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.5` | `2.50.4` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.7.1` | `2.16.2` | | [psycopg](https://github.com/psycopg/psycopg) | `3.2.4` | `3.3.8` | | [psycopg-binary](https://github.com/psycopg/psycopg) | `3.2.4` | `3.3.8` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.38` | `2.1.8` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.3` | `1.2.4` | | [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.10.0` | | [typing-inspection](https://github.com/pydantic/typing-inspection) | `0.4.4` | `0.4.5` | | [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.6` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.34.0` | `0.54.0` | | [mako](https://github.com/sqlalchemy/mako) | `1.3.12` | `1.4.3` | | [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.23.0` | `4.26.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.9.4` | `0.17.4` | Updates `alembic` from 1.15.1 to 1.20.1 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `fastapi` from 0.133.0 to 0.162.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.133.0...0.162.0) Updates `python-multipart` from 0.0.31 to 0.0.33 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.31...0.0.33) Updates `pypdf` from 6.16.2 to 6.21.4 - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.16.2...6.21.4) Updates `anyio` from 4.14.2 to 4.16.0 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.2...4.16.0) Updates `idna` from 3.19 to 3.20 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.19...v3.20) Updates `pydantic` from 2.13.5 to 2.14.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.13.5...v2.14.3) Updates `pydantic-core` from 2.46.5 to 2.50.4 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@core-v2.46.5...core-v2.50.4) Updates `pydantic-settings` from 2.7.1 to 2.16.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.7.1...v2.16.2) Updates `psycopg` from 3.2.4 to 3.3.8 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.2.4...3.3.8) Updates `psycopg-binary` from 3.2.4 to 3.3.8 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.2.4...3.3.8) Updates `sqlalchemy` from 2.0.38 to 2.1.8 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `python-dotenv` from 1.2.3 to 1.2.4 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4) Updates `starlette` from 1.3.1 to 1.10.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.3.1...1.10.0) Updates `typing-inspection` from 0.4.4 to 0.4.5 - [Release notes](https://github.com/pydantic/typing-inspection/releases) - [Changelog](https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md) - [Commits](pydantic/typing-inspection@v0.4.4...v0.4.5) Updates `tzdata` from 2026.3 to 2026.6 - [Release notes](https://github.com/python/tzdata/releases) - [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md) - [Commits](python/tzdata@2026.3...2026.6) Updates `uvicorn` from 0.34.0 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.34.0...0.54.0) Updates `mako` from 1.3.12 to 1.4.3 - [Release notes](https://github.com/sqlalchemy/mako/releases) - [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/mako/commits) Updates `jsonschema` from 4.23.0 to 4.26.0 - [Release notes](https://github.com/python-jsonschema/jsonschema/releases) - [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst) - [Commits](python-jsonschema/jsonschema@v4.23.0...v4.26.0) Updates `ruff` from 0.9.4 to 0.17.4 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.9.4...0.17.4) --- updated-dependencies: - dependency-name: alembic dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: fastapi dependency-version: 0.162.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: python-multipart dependency-version: 0.0.33 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-patch - dependency-name: pypdf dependency-version: 6.21.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: anyio dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: idna dependency-version: '3.20' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: pydantic dependency-version: 2.14.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: pydantic-core dependency-version: 2.50.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: pydantic-settings dependency-version: 2.16.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: psycopg dependency-version: 3.3.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: psycopg-binary dependency-version: 3.3.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: sqlalchemy dependency-version: 2.1.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: python-dotenv dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-patch - dependency-name: starlette dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: typing-inspection dependency-version: 0.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-patch - dependency-name: tzdata dependency-version: '2026.6' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: mako dependency-version: 1.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: jsonschema dependency-version: 4.26.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pip-minor-patch - dependency-name: ruff dependency-version: 0.17.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pip-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

ecc-tools · 2026-11-09T01:38:01Z

ECC Tools / Security Evidence

Commit: 0277cc60c76e0804e2865c06761d210efb7de807

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 2 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-11-09T01:38:03Z

ECC Tools / PR Risk Taxonomy

Commit: 0277cc60c76e0804e2865c06761d210efb7de807

PR taxonomy clear (success)

Scanned 2 changed file(s). No taxonomy bucket signals were detected.

Scanned 2 changed file(s).

No PR taxonomy bucket signals were detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-11-09T01:38:05Z

ECC Tools / Reference Set Readiness

Commit: 0277cc60c76e0804e2865c06761d210efb7de807

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 2 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-11-09T01:38:07Z

ECC Tools / Hosted Promotion Readiness

Commit: 0277cc60c76e0804e2865c06761d210efb7de807

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 2 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

socket-security · 2026-11-09T01:38:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
pypi/psycopg@3.2.4 ⏵ 3.3.8	⁺¹
pypi/psycopg-binary@3.2.4 ⏵ 3.3.8
pypi/tzdata@2026.3 ⏵ 2026.6
pypi/sqlalchemy@2.0.38 ⏵ 2.1.8
pypi/anyio@4.14.2 ⏵ 4.16.0
pypi/mako@1.3.12 ⏵ 1.4.3	⁺¹	⁺²
pypi/uvicorn@0.34.0 ⏵ 0.54.0
pypi/alembic@1.15.1 ⏵ 1.20.1
pypi/jsonschema@4.23.0 ⏵ 4.26.0	⁺¹
pypi/python-dotenv@1.2.3 ⏵ 1.2.4	⁺¹
pypi/pypdf@6.16.2 ⏵ 6.21.4		⁺⁷⁵
pypi/python-multipart@0.0.31 ⏵ 0.0.33
pypi/pydantic@2.13.5 ⏵ 2.14.3	⁺¹
pypi/starlette@1.3.1 ⏵ 1.10.0	⁺¹
pypi/typing-inspection@0.4.4 ⏵ 0.4.5	⁺¹
pypi/ruff@0.9.4 ⏵ 0.17.4	⁺¹
pypi/pydantic-core@2.46.5 ⏵ 2.50.4	⁺¹
pypi/fastapi@0.133.0 ⏵ 0.162.0	⁺¹
pypi/pydantic-settings@2.7.1 ⏵ 2.16.2	⁺¹
pypi/idna@3.19 ⏵ 3.20	⁺¹

View full report

dependabot Bot requested a review from KayzenRoot as a code owner November 9, 2026 01:37

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 9, 2026

Navigation Menu

Repository navigation

deps: bump the pip-minor-patch group across 1 directory with 20 updates - #179

deps: bump the pip-minor-patch group across 1 directory with 20 updates#179
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-minor-patch-e467082382

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

ecc-tools Bot commented Nov 9, 2026

Uh oh!

ecc-tools Bot commented Nov 9, 2026

Uh oh!

ecc-tools Bot commented Nov 9, 2026

Uh oh!

ecc-tools Bot commented Nov 9, 2026

Uh oh!

socket-security Bot commented Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

1.20.1

bug

0.162.0

Breaking Changes

0.161.1

Fixes

0.161.0

Features

0.160.0

Breaking Changes

Internal

0.159.1

Features

0.159.0

Features

0.158.2

Features

0.158.1

Version 0.0.33

🛡️ Safer form parsing

⚡ Faster parsing

🐍 Python support

💜 Thank you

Version 0.0.32

What's Changed

0.0.33 (2026-10-31)

0.0.32 (2026-06-04)

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

Documentation (DOC)

Version 6.21.3, 2026-10-27

What's new

Security (SEC)

Performance Improvements (PI)

Bug Fixes (BUG)

Documentation (DOC)

Developer Experience (DEV)

Maintenance (MAINT)

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Bug Fixes (BUG)

Version 6.21.4, 2026-10-28

Security (SEC)

Documentation (DOC)

Version 6.21.3, 2026-10-27

Security (SEC)

Performance Improvements (PI)

Bug Fixes (BUG)

Documentation (DOC)

Developer Experience (DEV)

Maintenance (MAINT)

Version 6.21.2, 2026-10-21

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

4.16.0

v3.20

3.20 (2026-09-17)

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

Performance

Fixes

New Contributors

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

Packaging

v2.14.0 (2026-10-08)

What's Changed

New Features

Changes

Fixes

New Contributors

Uh oh!

ecc-tools Bot commented Nov 9, 2026