Skip to content

chore(deps): bump the api-minor-patch group across 1 directory with 7 updates - #46

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/apps/api/api-minor-patch-26abf8d170
Open

chore(deps): bump the api-minor-patch group across 1 directory with 7 updates#46
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/apps/api/api-minor-patch-26abf8d170

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the api-minor-patch group with 7 updates in the /apps/api directory:

Package From To
fastapi 0.143.0 0.162.0
starlette 1.7.0 1.10.0
sqlalchemy 2.1.4 2.1.6
pydantic-settings 2.15.0 2.16.1
fonttools 4.66.1 4.67.0
uharfbuzz 0.56.3 0.57.0
brotli 1.2.0 1.2.1

Updates fastapi from 0.143.0 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

  • 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

  • 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

  • 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

0.159.1

Features

0.159.0

Features

  • ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

0.158.1

... (truncated)

Commits

Updates starlette from 1.7.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0
  • Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
  • The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
  • FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

  • Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
  • starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

  • Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
  • Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
  • WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
  • FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

  • Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
  • Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
  • FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
  • Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

  • Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
  • Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
  • Compare Match members by identity during routing #3665 and #3722.

Deprecated

  • Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

  • Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
  • Keep path parameter values that look like another placeholder in url_path_for() #3725.
  • Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
  • Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
  • Strip only one pair of matching outer quotes from Config env file values #3720.
  • Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
  • Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
  • Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.

... (truncated)

Commits
  • 8aa828c Version 1.10.0 (#3728)
  • a85a5c3 Substitute URL path parameters in a single pass (#3725)
  • 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
  • b973efd Build URL-encoded form fields in parser callbacks (#3724)
  • d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
  • fb3e818 Compare remaining Match members by identity in routing (#3722)
  • fc23aa1 Compare Match members by identity in Router.app (#3665)
  • fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
  • 4114432 Default omitted http.response.start headers in middlewares (#3721)
  • 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.1.4 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

  • [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

    This change is also backported to: 2.0.56

    References: #13711

  • [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

    References: #13701

  • [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

    References: #13709

orm extensions

  • [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

    This change is also backported to: 2.0.56

    References: #13680

... (truncated)

Commits

Updates pydantic-settings from 2.15.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

  • Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
  • A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
  • f651a7a Keep list of dicts CLI values as lists (#1049)
  • ecf7d90 Harden CI (#1044)
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • Additional commits viewable in compare view

Updates fonttools from 4.66.1 to 4.67.0

Release notes

Sourced from fonttools's releases.

4.67.0

  • [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
  • [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
  • [designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
  • [designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
  • [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
  • [varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
  • [varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
  • [varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
  • [varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
  • [varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
  • [varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
  • [featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
  • [ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
  • [ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
  • [VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
  • [VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
  • [varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
  • [otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
  • [ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
  • [scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
  • [cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or all single-byte codes map to .notdef (#4215). Formats 2 and 4 now reject glyph IDs above 65535 instead of wrapping them (#4226). Split format 14 default UVS ranges longer than 256 codepoints (#4229). Empty format 12 and 13 subtables round-trip (#4246).
  • [glyf] Use unsigned instruction lengths, so programs of 32768-65535 bytes compile and decompile correctly (#4227). Keep instructions in zero-contour glyphs (#4228).
  • [pens] Fix cubic off-curve detection in TTGlyphPointPen across contour starts (#4224). Glyph.drawPoints() now raises NotImplementedError for an all-off-curve cubic contour, which the point pen protocol cannot express (#3191, #4225). RoundingPen passes the all-off-curve None sentinel through (#4311, #4312).
  • [CFF2] Preserve operands when a blend has zero regions (#4240).
  • [cffLib] Read CFF font names as Latin-1, matching how they are written (#4253). Deleting a CFF dict attribute now actually removes it (#2725, #4264).
  • [CFF2ToCFF] Fix conversion of fonts with local subroutines (#4258). A CFF2 table with a single FontDict is now converted to a name-keyed CFF font that keeps its glyph names (#3890, #4265).
  • [subset] Handle a null GDEF variation store (#4230).
  • [merge] Support merging fonts that both have a MATH table (#3823, #4257).
  • [feaLib] Reject the same mark class used twice in one anchor list (#3628, #4255). Don't crash on value records whose devices are all NULL (#2396, #4261). Pad a short OS/2 Vendor with spaces (#4259).
  • [feaLib] Raise FeatureLibError with a location, instead of a bare Python error, for: a BASE script list without a matching tag list (#4263), a UnicodeRange bit outside 0-127 (#4266), a name string that cannot be decoded (#4267), a STAT axis location with no or too many values (#4268), and a non-ASCII OS/2 Vendor (#4269).
  • [name] Fix the BCP 47 tags of some Mac and Windows language IDs, e.g. es was mapped to Mac Estonian (#3733, #4256). getDebugName prefers the Windows English name over the Mac one (#3969, #4273).
  • [post] Don't crash on a format 2.0 table with numGlyphs set to 0 (#3060, #4274).
  • [VDMX] Recompute numRecs and numRatios when compiling (#4293).
  • [Silf] Fix compiling a Silf table that was decompiled from binary (#4294).
  • [woff2] Preserve minorVersion when copying flavor data (#4249, #4250).
  • [ttGlyphSet] Compute glyph width lazily for glyf variable fonts without HVAR, so .width is correct before drawing (#3964, #4260).
  • [varLib.interpolatable] Respect designspace source layers (#3951, #4275); fix --json output with SciPy (#3870, #4276).
  • [misc.psLib] Fix tokenizing of escaped parentheses in PostScript strings (#4207).
  • [svgLib] Raise ValueError instead of IndexError on a truncated path command (#4254).
  • [misc.transform] Preserve the direction of the remaining axis when decomposing a transform whose first column is zero (#4242).
  • [misc.textTools] Tag.__ne__ returns NotImplemented for unsupported types (#4305, #4306).
  • [misc.dictTools] hashdict rejects in-place union (|=) (#4313, #4314).
  • [misc.xmlReader] Close owned input streams when parsing fails (#4298).
  • [misc.filesystem] WriteZipFS.close() can be called more than once (#4309, #4310).
  • [EBDT] Keep EBDT/CBDT glyph metrics after probing a missing attribute (#3806, #4216).
Changelog

Sourced from fonttools's changelog.

4.67.0 (released 2026-10-14)

  • [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
  • [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
  • [designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
  • [designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
  • [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
  • [varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
  • [varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
  • [varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
  • [varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
  • [varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
  • [varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
  • [featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
  • [ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
  • [ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
  • [VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
  • [VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
  • [varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
  • [otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
  • [ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
  • [scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
  • [cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or

... (truncated)

Commits
  • 16f88cb Release 4.67.0
  • 5049c83 Update NEWS.rst [skip ci]
  • fdfd15f Merge pull request #4314 from xiehuanyi/fix/hashdict-inplace-union-20261014
  • 87ee7d3 Merge pull request #4312 from xiehuanyi/fix/roundingpen-offcurve-none-20261014
  • e6e65d3 [dictTools] Reject in-place union on hashdict
  • 10cfefe Merge pull request #4310 from xiehuanyi/fix/writezipfs-idempotent-close-20261014
  • 06157e4 Merge pull request #4300 from CAOShurong/codex/3751-missing-fvar
  • 2940a2e Merge pull request #4298 from xiehuanyi/fix-xml-reader-failure-cleanup
  • 821805d Merge pull request #4306 from xiehuanyi/fix/tag-notimplemented-comparison-202...
  • 85538d6 [roundingPen] Preserve all-off-curve quadratic sentinel
  • Additional commits viewable in compare view

Updates uharfbuzz from 0.56.3 to 0.57.0

Release notes

Sourced from uharfbuzz's releases.

0.57.0

Python 3.11 or newer is now required. Wheels target the Python 3.11 stable ABI to avoid a Cython shared-type import conflict with Astropy (#318, #319).

0.56.4

What's Changed

Full Changelog: harfbuzz/uharfbuzz@v0.56.3...v0.56.4

Commits
  • 9d3a162 Merge pull request #319 from harfbuzz/fix-abi3-min-py311
  • 38d2b88 build uharfbuzz abi3 extension against 3.11 Limited API
  • ea49f50 We should not need HB_EXPERIMENTAL_API
  • 4d5d5df Update to HarfBuzz 15.0.0
  • See full diff in compare view

Updates brotli from 1.2.0 to 1.2.1

Release notes

Sourced from brotli's releases.

v1.2.1

SECURITY

Changelog

Sourced from brotli's changelog.

[1.2.1] - 2026-10-21

SECURITY

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> w...

Description has been truncated

@dependabot
chore(deps): bump the api-minor-patch group across 1 directory with 7…
d6078a8 
… updates

Bumps the api-minor-patch group with 7 updates in the /apps/api directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.143.0` | `0.162.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.7.0` | `1.10.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.1.4` | `2.1.6` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.1` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.66.1` | `4.67.0` |
| [uharfbuzz](https://github.com/trufont/uharfbuzz) | `0.56.3` | `0.57.0` |
| [brotli](https://github.com/google/brotli) | `1.2.0` | `1.2.1` |



Updates `fastapi` from 0.143.0 to 0.162.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.143.0...0.162.0)

Updates `starlette` from 1.7.0 to 1.10.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.7.0...1.10.0)

Updates `sqlalchemy` from 2.1.4 to 2.1.6
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `pydantic-settings` from 2.15.0 to 2.16.1
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.1)

Updates `fonttools` from 4.66.1 to 4.67.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.66.1...4.67.0)

Updates `uharfbuzz` from 0.56.3 to 0.57.0
- [Release notes](https://github.com/trufont/uharfbuzz/releases)
- [Commits](harfbuzz/uharfbuzz@v0.56.3...v0.57.0)

Updates `brotli` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/google/brotli/releases)
- [Changelog](https://github.com/google/brotli/blob/go/brotli/v1.2.1/CHANGELOG.md)
- [Commits](google/brotli@v1.2.0...go/brotli/v1.2.1)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: api-minor-patch
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: api-minor-patch
- dependency-name: sqlalchemy
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: api-minor-patch
- dependency-name: pydantic-settings
  dependency-version: 2.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: api-minor-patch
- dependency-name: fonttools
  dependency-version: 4.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: api-minor-patch
- dependency-name: uharfbuzz
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: api-minor-patch
- dependency-name: brotli
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: api-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants