Skip to content

chore(deps): bump the all group across 1 directory with 9 updates - #288

Merged
vincentsarago merged 1 commit into
mainfrom
dependabot/uv/all-44134481d0
Oct 27, 2026
Merged

chore(deps): bump the all group across 1 directory with 9 updates#288
vincentsarago merged 1 commit into
mainfrom
dependabot/uv/all-44134481d0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 9 updates in the / directory:

Package From To
orjson 3.12.0 3.13.0
fastapi 0.142.2 0.150.0
starlette 1.7.0 1.9.0
pydantic 2.13.5 2.14.1
pydantic-settings 2.15.0 2.16.0
httpx2 2.13.1 2.15.1
pre-commit 4.6.2 4.7.0
bump-my-version 1.5.1 1.6.3
black 26.10.0 26.10.1

Updates orjson from 3.12.0 to 3.13.0

Release notes

Sourced from orjson's releases.

3.13.0

Changed

  • No longer publish PyPI wheels for Windows x86/i686.

Added

  • Serialize new Python 3.15 built-in type frozendict identical to dict (PEP 814).
Changelog

Sourced from orjson's changelog.

3.13.0 - 2026-08-17

Changed

  • No longer publish PyPI wheels for Windows x86/i686.

Added

  • Serialize new Python 3.15 built-in type frozendict identical to dict (PEP 814).
Commits

Updates fastapi from 0.142.2 to 0.150.0

Release notes

Sourced from fastapi's releases.

0.150.0

When no file is selected, browsers submit a file part with an empty filename and empty content. FastAPI now treats this as missing: required file fields return a validation error, and fields with defaults or default factories use them. Unselected inputs are ignored in lists of files. Named zero-byte files are still accepted.

Breaking Changes

0.149.0

Browsers submit empty text inputs as empty strings (""). FastAPI now treats empty scalar form values as missing in form models, matching individual Form parameters. Required fields return a validation error. Fields with defaults or default factories use them and remain unset in model_dump(exclude_unset=True).

Empty strings inside lists are preserved. Omitted boolean form fields still become False. JSON requests and direct Pydantic validation are unchanged.

Breaking Changes

0.148.0

Defaults for omitted Query, Header, Cookie, and Form parameters and model fields are no longer treated as user input. Defaults are not validated unless validate_default=True is enabled. If you rely on validators running for omitted values, enable default validation with Field(validate_default=True) for model fields or, for example, Query(validate_default=True) for individual parameters. Body(validate_default=True) is now honored too.

For parameter models, applying a default no longer marks a field as explicitly set, so model_dump(exclude_unset=True) excludes it. Default factories run once, and validation errors no longer include injected defaults in input.

Omitted boolean form fields still become False and count as explicitly set.

Breaking Changes

0.147.0

Omitted bool and bool | None form fields are now interpreted as False, matching unchecked HTML checkboxes. This applies to individual Form parameters and form models, including required fields and fields with defaults of True or None. The inferred value is considered explicitly set, including in model_dump(exclude_unset=True).

JSON requests and direct Pydantic validation are unchanged. See Boolean Form Fields.

Breaking Changes

Internal

  • ✅ Add tests for parameter defaults, nullability, and browser form behavior. PR #14829 by @​YuriiMotov.

0.146.0

The root_path parameter in FastAPI() is deprecated. Configure the server with fastapi run --root-path /api/v1 instead.

Breaking Changes

0.145.0

Breaking Changes

... (truncated)

Commits

Updates starlette from 1.7.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.
Commits
  • 1840c9d Version 1.9.0 (#3676)
  • 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
  • 414af4f Remove unmaintained packages from the third-party packages page (#3674)
  • d4df01a Add adminsite to the third-party packages (#3654)
  • 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
  • a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
  • 6b11cd7 Honor streaming responses in TestClient (#3491)
  • b7901fb Use byte length for typed memoryview response bodies (#3622)
  • 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
  • 7b2948f Version 1.8.0 (#3660)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

  • CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
  • Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
  • Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
  • cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
  • CliSubCommand aliases keep their case with case_sensitive=False (#989).
  • Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
  • CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

  • Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
  • Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
  • A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
  • collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
  • A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
  • Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

  • With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
  • secrets_case_sensitive=True is now honored on Windows (#1001).
  • An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
  • TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

  • Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
  • Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
  • NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • 6ea85e6 Decode optional Annotated named union aliases (#1041)
  • ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
  • b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
  • bedb60e Honor explicit empty TOML table header overrides (#1027)
  • Additional commits viewable in compare view

Updates httpx2 from 2.13.1 to 2.15.1

Release notes

Sourced from httpx2's releases.

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

httpx2 and httpcore2 no longer support Python 3.10 (#1274). There are no other changes in this release.

httpx2

Removed

  • Drop support for Python 3.10 (#1274).

httpcore2

Removed

  • Drop support for Python 3.10 (#1274).

Full Changelog: pydantic/httpx2@v2.14.0...v2.15.0

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.15.1 (October 19th, 2026)

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

  • Drop support for Python 3.10. (#1274)

2.14.0 (October 18th, 2026)

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
  • Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)
Commits

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

Commits
  • 65bb884 v4.7.0
  • 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
  • 860d07d don't leak GIT_* env into npm install for language: node
  • 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
  • 9905e88 use contextlib.chdir
  • 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
  • 2be1701 remove triple-nested withs for 3.14 coverage
  • 4c8d22a py311+
  • c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
  • f49e251 [pre-commit.ci] pre-commit autoupdate
  • Additional commits viewable in compare view

Updates bump-my-version from 1.5.1 to 1.6.3

Release notes

Sourced from bump-my-version's releases.

1.6.3

Compare the full difference.

Fixes

  • Fix: close review gaps in config discovery and file resolution. aff2341

    • recognise POSIX and Windows absolute paths on every platform
    • raise ConfigurationError for non-mapping 'files' entries
    • resolve each filemap key once in files_to_modify
    • use find_repo_root for scm repository_root (git and hg)
    • strengthen symlink tests, add symlinked config case
    • narrow broad pytest.raises(Exception) to ValidationError

  • Fix: don't re-add CLI files already configured; limit '!' handling to glob_exclude. ce16247

  • Fix: compare CLI and configured file paths as resolved paths. f36ef5d

    Also handle '!' glob_exclude negation when rebasing paths, ignore non-mapping files entries, simplify config-dir walk, and document discovery and path rules.

Other

  • Test: add docstrings to discovery and resolution tests. 5001ca1

  • Test: use posix paths for resolved filenames and skip '|' path test on Windows. b1a2d20

  • Test: compare resolved filename as Path for Windows separators. ad7b894

  • Test: expect single entry for symlinked cwd. 2635f8e

  • Feat: resolve config through repo parents and anchor file paths to config dir. 276dfc4

    Search parent directories up to the git/hg repo root for a config file (#8). Resolve relative filename/glob from the config file's directory and add a {repo_root} placeholder (#9).

    Closes #8, closes #9

1.6.2

Compare the full difference.

Fixes

@dependabot
chore(deps): bump the all group across 1 directory with 9 updates
d85598b 
Bumps the all group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [orjson](https://github.com/ijl/orjson) | `3.12.0` | `3.13.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.142.2` | `0.150.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.7.0` | `1.9.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.13.1` | `2.15.1` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.2` | `4.7.0` |
| [bump-my-version](https://github.com/callowayproject/bump-my-version) | `1.5.1` | `1.6.3` |
| [black](https://github.com/psf/black) | `26.10.0` | `26.10.1` |



Updates `orjson` from 3.12.0 to 3.13.0
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.12.0...3.13.0)

Updates `fastapi` from 0.142.2 to 0.150.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.142.2...0.150.0)

Updates `starlette` from 1.7.0 to 1.9.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.7.0...1.9.0)

Updates `pydantic` from 2.13.5 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.1)

Updates `pydantic-settings` from 2.15.0 to 2.16.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.0)

Updates `httpx2` from 2.13.1 to 2.15.1
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.13.1...v2.15.1)

Updates `pre-commit` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

Updates `bump-my-version` from 1.5.1 to 1.6.3
- [Release notes](https://github.com/callowayproject/bump-my-version/releases)
- [Changelog](https://github.com/callowayproject/bump-my-version/blob/master/CHANGELOG.md)
- [Commits](callowayproject/bump-my-version@1.5.1...1.6.3)

Updates `black` from 26.10.0 to 26.10.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.10.0...26.10.1)

---
updated-dependencies:
- dependency-name: orjson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: fastapi
  dependency-version: 0.150.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: starlette
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: httpx2
  dependency-version: 2.15.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: bump-my-version
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 27, 2026
github-actions[bot]
github-actions Bot reviewed Oct 27, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'TiPg Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.30.

Benchmark suite Current: d85598b Previous: dcce22f Ratio
tests/benchmarks.py::test_benchmark_collections[json-1] 289.61513334558936 iter/sec (stddev: 0.0002310124826070992) 700.1209385231101 iter/sec (stddev: 0.00007553992978992043) 2.42
tests/benchmarks.py::test_benchmark_collections[json-10] 164.16830275893076 iter/sec (stddev: 0.003495123616722144) 329.8699698435304 iter/sec (stddev: 0.00010059692271529795) 2.01
tests/benchmarks.py::test_benchmark_collections[html-1] 280.92256238155755 iter/sec (stddev: 0.000255645780456653) 539.4602808616407 iter/sec (stddev: 0.000125725283160195) 1.92
tests/benchmarks.py::test_benchmark_collections[html-10] 164.03211263029195 iter/sec (stddev: 0.0003108483586721704) 305.2754818246401 iter/sec (stddev: 0.0000946792827741705) 1.86
tests/benchmarks.py::test_benchmark_collection[json] 357.89693817053563 iter/sec (stddev: 0.00023755288745749243) 860.4169576057518 iter/sec (stddev: 0.00006141940188165609) 2.40
tests/benchmarks.py::test_benchmark_collection[html] 230.17534744103895 iter/sec (stddev: 0.005708109466516761) 592.3788491688048 iter/sec (stddev: 0.00015933170117176875) 2.57
tests/benchmarks.py::test_benchmark_queryables 379.3328798166816 iter/sec (stddev: 0.00022744036171556633) 1056.6426690045168 iter/sec (stddev: 0.00005135265528552503) 2.79
tests/benchmarks.py::test_benchmark_items[geojson-1] 182.3692014840452 iter/sec (stddev: 0.00016970392036569837) 319.05629563364414 iter/sec (stddev: 0.0002509954191733606) 1.75
tests/benchmarks.py::test_benchmark_items[geojson-10] 168.19667731401782 iter/sec (stddev: 0.00021425408165943815) 273.49200259598376 iter/sec (stddev: 0.0003547894671253195) 1.63
tests/benchmarks.py::test_benchmark_items[geojson-50] 109.72724517226746 iter/sec (stddev: 0.006207847700746376) 175.48470990105608 iter/sec (stddev: 0.0005739455305003719) 1.60
tests/benchmarks.py::test_benchmark_items[geojson-100] 77.86637762665372 iter/sec (stddev: 0.008303017743604289) 109.05046184973759 iter/sec (stddev: 0.005398772087718522) 1.40
tests/benchmarks.py::test_benchmark_items[csv-1] 166.10837728947686 iter/sec (stddev: 0.00043900731347815516) 300.720709772161 iter/sec (stddev: 0.0002616599234375008) 1.81
tests/benchmarks.py::test_benchmark_items[csv-10] 94.32470765835416 iter/sec (stddev: 0.0007907601660727383) 223.60121450732262 iter/sec (stddev: 0.0003577556560260062) 2.37
tests/benchmarks.py::test_benchmark_items[csv-50] 39.72997435321544 iter/sec (stddev: 0.002016229817565363) 116.83367386634049 iter/sec (stddev: 0.0007525533378689166) 2.94
tests/benchmarks.py::test_benchmark_items[csv-100] 20.11041135205433 iter/sec (stddev: 0.004469511304881747) 64.72309730864914 iter/sec (stddev: 0.0015093341154026937) 3.22
tests/benchmarks.py::test_benchmark_items[csv-200] 11.538245906396442 iter/sec (stddev: 0.008129161909190944) 35.913920498418484 iter/sec (stddev: 0.0018515026550085544) 3.11
tests/benchmarks.py::test_benchmark_items[csv-250] 8.79559864936463 iter/sec (stddev: 0.01010594484298054) 28.886022789624732 iter/sec (stddev: 0.002906876744513545) 3.28
tests/benchmarks.py::test_benchmark_items[html-1] 170.71438050143678 iter/sec (stddev: 0.0003993972266562732) 255.08609967030264 iter/sec (stddev: 0.0004985913068316636) 1.49
tests/benchmarks.py::test_benchmark_items[html-10] 144.9988629920395 iter/sec (stddev: 0.000206836513180897) 214.06042798968056 iter/sec (stddev: 0.0004952234972550771) 1.48
tests/benchmarks.py::test_benchmark_items[html-50] 79.64366066965464 iter/sec (stddev: 0.011243889892974653) 113.84584024642662 iter/sec (stddev: 0.009182985790444853) 1.43
tests/benchmarks.py::test_benchmark_items[html-100] 54.82582241928275 iter/sec (stddev: 0.013162419376527573) 76.09852879844952 iter/sec (stddev: 0.014627355778740078) 1.39
tests/benchmarks.py::test_benchmark_items[html-200] 31.977315687606954 iter/sec (stddev: 0.01653064531962813) 41.906150953978205 iter/sec (stddev: 0.020305252050474887) 1.31
tests/benchmarks.py::test_benchmark_item[html-Saskatchewan] 16.664847859323476 iter/sec (stddev: 0.026593251839067588) 22.371330757289318 iter/sec (stddev: 0.0007931670370045593) 1.34
tests/benchmarks.py::test_benchmark_tile[4/8/5-WGS1984Quad] 185.88447363610754 iter/sec (stddev: 0.00024678649540596466) 308.2463033240865 iter/sec (stddev: 0.00016444181899305236) 1.66
tests/benchmarks.py::test_benchmark_tile[4/8/5-WebMercatorQuad] 134.0580821352064 iter/sec (stddev: 0.0002752212685346532) 215.70666239905387 iter/sec (stddev: 0.00022417557309451237) 1.61
tests/benchmarks.py::test_benchmark_tile[6/33/25-WGS1984Quad] 214.85661053475357 iter/sec (stddev: 0.00033265696022515424) 423.4743172054643 iter/sec (stddev: 0.00010124114989461988) 1.97
tests/benchmarks.py::test_benchmark_tile[6/33/25-WebMercatorQuad] 211.68031657138104 iter/sec (stddev: 0.000250998982050584) 359.12943128179734 iter/sec (stddev: 0.00013409069410348298) 1.70
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/tileMatrixSets] 374.5478331168773 iter/sec (stddev: 0.00037645083953229174) 949.0539125835182 iter/sec (stddev: 0.00011767242114662347) 2.53
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/tileMatrixSets/WGS1984Quad] 358.5822474443135 iter/sec (stddev: 0.00026022445550920217) 865.6769815873611 iter/sec (stddev: 0.00009523185053190207) 2.41
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/tileMatrixSets/WebMercatorQuad] 353.32237510243067 iter/sec (stddev: 0.0002673569321216912) 896.6858294066853 iter/sec (stddev: 0.00007804454788714607) 2.54
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/collections/public.landsat_wrs/tiles] 76.33084618644796 iter/sec (stddev: 0.0004593264444277525) 108.46101987457625 iter/sec (stddev: 0.00045380791827147435) 1.42
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/collections/public.landsat_wrs/tiles/WGS1984Quad] 131.2492551604939 iter/sec (stddev: 0.00027646023536137293) 230.7859113234701 iter/sec (stddev: 0.00008515865748449949) 1.76
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/collections/public.landsat_wrs/tiles/WebMercatorQuad] 95.64219728489387 iter/sec (stddev: 0.01505604375626015) 200.70073860075263 iter/sec (stddev: 0.00020497259150960086) 2.10

This comment was automatically generated by workflow using github-action-benchmark.

@vincentsarago
vincentsarago merged commit 2a3e899 into main Oct 27, 2026
5 checks passed
@vincentsarago
vincentsarago deleted the dependabot/uv/all-44134481d0 branch October 27, 2026 09:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentsarago