chore(deps): bump the backend-compatible group across 1 directory with 16 updates

[dependabot]

Bumps the backend-compatible group with 16 updates in the /backend directory:

Package	From	To
alembic	1.18.5	1.19.1
cffi	2.1.0	2.1.1
greenlet	3.5.4	3.5.5
httpcore2	2.9.1	2.10.0
httpx2	2.9.1	2.10.0
mako	1.3.12	1.4.1
packaging	26.2	26.3
pwdlib	0.3.0	0.3.1
pydantic-core	2.46.4	2.48.0
sqlalchemy	2.0.51	2.0.52
sqlglot	30.16.0	30.17.0
starlette	1.3.1	1.6.0
typing-inspection	0.4.2	0.4.4
uvicorn	0.52.0	0.52.3
hypothesis	6.164.0	6.165.7
ruff	0.16.1	0.16.3

Updates alembic from 1.18.5 to 1.19.1

Release notes

Sourced from alembic's releases.

1.19.1

Released: August 8, 2026

bug

• [bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508 that failed to take into account column bound check constraints, leading to wrong autogenerate detections.

  References: #1842

1.19.0

Released: August 4, 2026

changed

• [changed] [installation] Environmental updates:

  -   Trove classifiers now include Python 3.15 which is now part of CI
      integration
  
  
  Python 3.14 is also added to trove classifiers which had been previously
  omitted
  
  
  Implemented PEP 604 style unions in type annotations
  

feature

• [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK constraints, as part of the default autogenerate behavior. Detection is name-based only; a constraint whose name is unchanged is presumed equivalent regardless of its expression text, as reliably normalizing SQL expressions across backends for comparison purposes is not generally feasible. This behavior is implemented as a plugin named alembic.autogenerate.checkconstraint_byname, and may be disabled if not desired by excluding it from the EnvironmentContext.configure.autogenerate_plugins list. Pull request courtesy Francois van Kempen.

  References: #508

bug

... (truncated)

Commits

• See full diff in compare view

Updates cffi from 2.1.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

Commits

• fd33e77 New release 2.1.1
• 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
• See full diff in compare view

Updates greenlet from 3.5.4 to 3.5.5

Changelog

Sourced from greenlet's changelog.

3.5.5 (2026-08-10)

• Link the C++ runtime statically into the Windows wheels again, as the Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported MSVCP140.dll, which no Windows CPython distribution ships, so importing greenlet failed on machines without the Visual C++ redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue and pull request by Daniel Sticker.

.. note:: Binary 3.15 wheels are now built with 3.15.0rc1. This should be compatible with future 3.15 releases and is believed compatible with 3.15b4 as well (but not earlier versions).

Commits

• ddb1453 Preparing release 3.5.5
• 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
• f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
• f1ce3ca Restore static linking of the C++ runtime for Windows wheels
• b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
• 726cc38 Bump the github-actions group with 3 updates
• e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
• be55a59 Check that the suspended greenlet is what keeps the class alive
• e9c01dd Back to development: 3.5.5
• See full diff in compare view

Updates httpcore2 from 2.9.1 to 2.10.0

Release notes

Sourced from httpcore2's releases.

v2.10.0

Highlights

🚀 Performance and memory improvements

• Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (pydantic/httpx2#1127).
• SSE parsing is up to 35x faster on highly fragmented streams (pydantic/httpx2#1117).
• Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (pydantic/httpx2#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (pydantic/httpx2#1119, pydantic/httpx2#1114). Thanks @​hoodmane!

httpx2

Added

• Add support for running on WebAssembly / Emscripten via Pyodide by @​hoodmane in pydantic/httpx2#1119
• Add max_event_size to cap SSE event buffering by @​Kludex in pydantic/httpx2#1071
• Add RFC 9110 status code constants by @​mbeijen in pydantic/httpx2#1069
• Add support for Python 3.15 by @​hugovk in pydantic/httpx2#1090

Changed

• Improve SSE chunk buffering performance by @​Kludex in pydantic/httpx2#1117
• Skip cookie extraction without Set-Cookie by @​Kludex in pydantic/httpx2#1107
• Return str | None instead of Any from Headers.get by @​ItsDrike in pydantic/httpx2#1121

Fixed

• Enforce WebSocket max message size across fragments by @​Kludex in pydantic/httpx2#1085
• Ignore unsolicited and duplicate Pong frames by @​Kludex in pydantic/httpx2#1122

httpcore2

Added

• Add support for Python 3.15 by @​hugovk in pydantic/httpx2#1090

Changed

• Avoid quadratic copying when sending large HTTP/2 request bodies by @​Kludex in pydantic/httpx2#1127

Fixed

• Propagate the original exception instead of raising KeyError when an HTTP/2 stream fails by @​yhay81 in pydantic/httpx2#1093
• Start TLS for the wss scheme in SOCKS5 proxy connections by @​Kludex in pydantic/httpx2#1104

🙏 New Contributors

... (truncated)

Commits

• a966320 Version 2.10.0 (#1129)
• 586f968 Avoid quadratic copying when sending large HTTP/2 request bodies (#1127)
• dee1d1a Return str | None instead of Any from Headers.get (#1121)
• dec24ad Use httpx2-jsfetch on Emscripten (#1119)
• 454b8b2 Ignore unsolicited and duplicate Pong frames (#1122)
• cbfc0e0 Improve SSE chunk buffering performance (#1117)
• ad141d8 Refactor SSE parser coordination (#1118)
• e0b0124 Make _client depend on the _transports package instead of its submodules ...
• e52f963 Skip dependencies not needed on Emscripten (#1114)
• 5d9eedc Add max_event_size to cap SSE event buffering (#1071)
• Additional commits viewable in compare view

Updates httpx2 from 2.9.1 to 2.10.0

Release notes

Sourced from httpx2's releases.

v2.10.0

Highlights

🚀 Performance and memory improvements

• Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (pydantic/httpx2#1127).
• SSE parsing is up to 35x faster on highly fragmented streams (pydantic/httpx2#1117).
• Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (pydantic/httpx2#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (pydantic/httpx2#1119, pydantic/httpx2#1114). Thanks @​hoodmane!

httpx2

Added

• Add support for running on WebAssembly / Emscripten via Pyodide by @​hoodmane in pydantic/httpx2#1119
• Add max_event_size to cap SSE event buffering by @​Kludex in pydantic/httpx2#1071
• Add RFC 9110 status code constants by @​mbeijen in pydantic/httpx2#1069
• Add support for Python 3.15 by @​hugovk in pydantic/httpx2#1090

Changed

• Improve SSE chunk buffering performance by @​Kludex in pydantic/httpx2#1117
• Skip cookie extraction without Set-Cookie by @​Kludex in pydantic/httpx2#1107
• Return str | None instead of Any from Headers.get by @​ItsDrike in pydantic/httpx2#1121

Fixed

• Enforce WebSocket max message size across fragments by @​Kludex in pydantic/httpx2#1085
• Ignore unsolicited and duplicate Pong frames by @​Kludex in pydantic/httpx2#1122

httpcore2

Added

• Add support for Python 3.15 by @​hugovk in pydantic/httpx2#1090

Changed

• Avoid quadratic copying when sending large HTTP/2 request bodies by @​Kludex in pydantic/httpx2#1127

Fixed

• Propagate the original exception instead of raising KeyError when an HTTP/2 stream fails by @​yhay81 in pydantic/httpx2#1093
• Start TLS for the wss scheme in SOCKS5 proxy connections by @​Kludex in pydantic/httpx2#1104

🙏 New Contributors

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.10.0 (August 9th, 2026)

Added

• Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
• Add max_event_size to cap SSE event buffering. (#1071)
• Add RFC 9110 status code constants. (#1069)
• Add support for Python 3.15. (#1090)

Changed

• Improve SSE chunk buffering performance. (#1117)
• Skip cookie extraction for responses without Set-Cookie headers. (#1107)
• Return str | None instead of Any from Headers.get. (#1121)

Fixed

• Enforce the WebSocket max message size across fragmented messages. (#1085)
• Ignore unsolicited and duplicate WebSocket Pong frames. (#1122)

Commits

• a966320 Version 2.10.0 (#1129)
• dee1d1a Return str | None instead of Any from Headers.get (#1121)
• dec24ad Use httpx2-jsfetch on Emscripten (#1119)
• 454b8b2 Ignore unsolicited and duplicate Pong frames (#1122)
• cbfc0e0 Improve SSE chunk buffering performance (#1117)
• ad141d8 Refactor SSE parser coordination (#1118)
• e0b0124 Make _client depend on the _transports package instead of its submodules ...
• e52f963 Skip dependencies not needed on Emscripten (#1114)
• 5d9eedc Add max_event_size to cap SSE event buffering (#1071)
• 55fad71 Bump the python-packages group across 1 directory with 15 updates (#1112)
• Additional commits viewable in compare view

Updates mako from 1.3.12 to 1.4.1

Release notes

Sourced from mako's releases.

1.4.1

Released: Wed Aug 5 2026

bug

• [bug] [installation] Fixed issue in the 1.4.0 packaging where the repository's internal tools/ directory was detected by setuptools package discovery and installed as a top-level tools package into site-packages, shadowing unrelated tools packages belonging to other applications. Package discovery is now limited to the mako package explicitly.

  References: #438

1.4.0

Released: Tue Aug 4 2026

changed

• [changed] [examples] The examples/bench folder has been removed as it used mostly long-obsolete template engines. The examples/wsgi/run_wsgi.py example has been updated to remove the use of the removed-in-Python-3.13 cgi module, and to be runnable as a module from the project root.

• [changed] [installation] Minimum MarkupSafe dependency version bumped from 0.9.2 to 2.0.

• [changed] [tests] The test suite now runs via nox. The old tox.ini remains however nox will be the only system that's maintained.

• [changed] [installation] Project metadata has been migrated to PEP 621 pyproject.toml-based configuration. setup.cfg remains only for the [mako_testing] section used by Mako's own test suite. The build requirements now set the minimum setuptools version at 77.0.0 in order to build Mako from source.

• [changed] [installation] Minimum Python version is now 3.10. Mako 1.4.0 has been tested up through Python 3.15.0b4.

bug

• [bug] [ext] The minimum Lingua version supported by LinguaMakoExtractor is now 4.16. The test suite had continued to pin Lingua below 4 long after the extractor itself was repaired to work with Lingua 4 in version 1.2.0, with the result that the plugin was no longer covered by tests at all; the pinned version additionally imports pkg_resources at startup, which is not present in current setuptools releases and left the package

... (truncated)

Commits

• See full diff in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates pwdlib from 0.3.0 to 0.3.1

Release notes

Sourced from pwdlib's releases.

v0.3.1

Bump version 0.3.0 → 0.3.1

Improvements

• Remove top-pin of dependencies. Thanks @​hynek 🎉
• PasswordHash.recommended() constructor now returns typing.Self. Thanks @​waketzheng 🎉

Commits

• bb51a24 Bump version 0.3.0 → 0.3.1
• 1c3f93a Fix dependency versions
• 7a6855d docs: add hynek as a contributor for code (#49)
• 7a070b5 docs: add waketzheng as a contributor for code (#48)
• c22deeb Use Self instead of class name for type hints
• 3493637 Remove argon2-cffi top-pin (#47)
• e746495 Bump actions/setup-python from 6 to 7 (#46)
• dcc5aa3 Bump actions/checkout from 6 to 7 (#45)
• 8051873 Bump actions/deploy-pages from 4 to 5 (#38)
• 775bc5d Bump extractions/setup-just from 3 to 4 (#40)
• Additional commits viewable in compare view

Updates pydantic-core from 2.46.4 to 2.48.0

Commits

• 5922459 Prepare release v2.14.0b1 (#13597)
• 111c942 Refactor model namespace inspection (#13596)
• b348cf0 Add initial support for Python 3.15 (#13587)
• 4792336 Bump PyO3 to 0.29.2 (#13572)
• 57d0ad8 Raise explicit TypeError on invalid index_key serialization wrap handler ...
• 53b39c3 Add a named-tuple core schema (#13505)
• 98a08d3 Revert moving pydantic-core tests (#13589)
• 5f49d85 Add AllowInfNan type to the field metadata gathering (#13586)
• 2e5f0e2 Try Format.VALUE before FORWARDREF when evaluating annotations in `ModelM...
• de3175c Migrate pydantic-core tests to main tests directory (#13582)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates sqlglot from 30.16.0 to 30.17.0

Commits

• 9a8129b feat(executor): implement LENGTH [CLAUDE] (#8145)
• b7386b7 fix(optimizer)!: scope DML / DDL query fragments properly (#8140)
• 8619582 fix(optimizer): preserve identifier meta when restoring JSON dot part case
• 98f3d66 feat(executor): implement ILIKE [CLAUDE] (#8144)
• 44b73a0 Fix(executor): fullmatch like semantics
• 7cab581 fix(executor): honor the negate flag on LIKE and ILIKE [CLAUDE] (#8139)
• 1dae76b fix(executor): only truncate typed division when both operands are integers [...
• 3a76dfd feat(optimizer)!: annotate encode for postgresql (#8137)
• 9312212 Fix(optimizer)!: properly support UNION BY NAME in qualify, type inference ...
• 8ba0435 fix(optimizer)!: escape gen delimited names (strings, etc) (#8134)
• Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

• Add max_body_size to Starlette and route classes by @​Kludex in Kludex/starlette#3431
• Expose http.response.debug info via response extensions by @​y2kbugger in Kludex/starlette#3130

New Contributors

• @​y2kbugger made their first contribution in Kludex/starlette#3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Version 1.5.1

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @​nikolauspschuetz in encode/starlette#3389
• Limit FileResponse to 100 ranges by @​Kludex in encode/starlette#3430

Full Changelog: Kludex/starlette@1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @​Kludex in encode/starlette#3418
• Flush GZip output for each streamed chunk by @​Kludex in encode/starlette#3419
• Skip compression of partial responses in GZipMiddleware by @​Kludex in encode/starlette#3420
• Expand default excluded content types in GZipMiddleware by @​Kludex in encode/starlette#3421

Full Changelog: Kludex/starlette@1.4.1...1.5.0

Version 1.4.1

What's Changed

• Default thread_minimum_size in GZipResponder by @​Kludex in Kludex/starlette#3415

Full Changelog: Kludex/starlette@1.4.0...1.4.1

Version 1.4.0

What's Changed

• Lazily allocate GZipMiddleware compression resources by @​Kludex in Kludex/starlette#3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @​Kludex in Kludex/starlette#3411
• Offload large GZip compression by @​Kludex in Kludex/starlette#3410

New Contributors

• @​benberryallwood made their first contribution in Kludex/starlette#3334
• @​lkk7 made their first contribution in Kludex/starlette#3359

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

• Add max_body_size to Starlette and route classes #3431.
• Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

• Reject inverted single-byte ranges in FileResponse #3389.
• Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

• Add exclude_content_types parameter to GZipMiddleware #3418.

Changed

• Expand default excluded content types in GZipMiddleware #3421.

Fixed

• Flush GZip output for each streamed chunk #3419.
• Skip compression of partial responses in GZipMiddleware #3420.

1.4.1 (August 5, 2026)

Fixed

• Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

• Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

• Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
• Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.

Commits

• 4f250d6 Version 1.6.0 (#3434)
• 9eea41a Expose http.response.debug info via response extensions (#3130)
• 38f8999 Add max_body_size to Starlette and route classes (#3431)
• c41236c Version 1.5.1 (#3432)
• 9c500db Limit FileResponse to 100 ranges (#3430)
• 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
• c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
• ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
• 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
• d96887e Add Pydantic Logfire banner to the docs (#3428)
• Additional commits viewable in compare view

Updates typing-inspection from 0.4.2 to 0.4.4

Release notes

Sourced from typing-inspection's releases.

v0.4.3 2026-08-10

What's Changed

• Drop support for Python 3.9 by @​Viicos in #52
• Avoid module getattr() calls in typing_objects functions by @​Viicos in #57
• Add Python 3.15 support by @​Viicos in #59

Full Changelog: pydantic/typing-inspection@v0.4.2...v0.4.3

Changelog

Sourced from typing-inspection's changelog.

v0.4.4 (2026-08-12)

• Add typing_objects.DEPRECATED_ALIASES_ID by @​Viicos in #63

v0.4.3 (2026-08-10)

• Drop support for Python 3.9 by @​Viicos in #52
• Avoid module getattr() calls in typing_objects functions by @​Viicos in #57
• Add Python 3.15 support by @​Viicos in #59

Commits

• 83d4dbb Prepare release v0.4.4 (#64)
• 3ac9791 Fixes to DEPRECATED_ALIASES_IDS (#65)
• 382616c Add typing_objects.DEPRECATED_ALIASES_IDS (#63)
• cef71ba Fix docs publish CI job (#62)
• 7b09e7a Fix coverage CI job (#61)
• 2648bdf Prepare release 0.4.3 (