[dependabot]

Bumps the runtime-minor-and-patch group with 5 updates in the / directory:

Package	From	To
fastapi	0.143.0	0.161.1
pydantic	2.14.0	2.14.1
pydantic-settings	2.15.0	2.16.1
alembic	1.20.0	1.20.1
pypdf	6.20.0	6.21.2

Updates fastapi from 0.143.0 to 0.161.1

Release notes

Sourced from fastapi's releases.

0.161.1

Fixes

• 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

• ✨ Add support for combining unions of form models. PR #16596 by @​tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

• 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @​dependabot[bot].

0.159.1

Features

• ✨ Add support for optional unions of form models. PR #16586 by @​tiangolo.

0.159.0

Features

• ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

• ✨ Add support for optional form models. PR #16582 by @​tiangolo.

0.158.1

Fixes

• 🐛 Preserve form media types in OpenAPI. PR #16579 by @​tiangolo.

0.158.0

Features

• ✨ Add support for combining form models. PR #16577 by @​tiangolo.

0.157.0

Features

... (truncated)

Commits

• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• 352a4ed 📝 Update release notes
• 91a335c 🐛 Apply each parameter model's extra configuration to sibling fields (#16594)
• ce6ee83 📝 Update release notes
• Additional commits viewable in compare view

Updates pydantic from 2.14.0 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• See full diff in compare view

Updates pydantic-settings from 2.15.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

• Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
• A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

• Harden CI by @​Viicos in pydantic/pydantic-settings#1044
• Keep list of dicts CLI values as lists by @​hramezani in pydantic/pydantic-settings#1049
• Keep fixed-length tuple CLI positionals single-valued by @​hramezani in pydantic/pydantic-settings#1069
• Prepare release 2.16.1 by @​hramezani in pydantic/pydantic-settings#1087
• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

• Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
• python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
• Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
• validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
• CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
• JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
• Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

• Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
• Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
• AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
• env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
• CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits

• 4e286e2 Prepare release 2.16.1 (#1087)
• 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
• f651a7a Keep list of dicts CLI values as lists (#1049)
• ecf7d90 Harden CI (#1044)
• 8c259f4 Prepare release 2.16.0 (#1043)
• 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
• f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
• cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
• 081d39f Fix config file and CLI values being ignored when alias differs from validati...
• c46ebc4 Expand home paths when checking TOML table headers (#1034)
• Additional commits viewable in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Updates pypdf from 6.20.0 to 6.21.2

Release notes

Sourced from pypdf's releases.

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

• Avoid repeated full file loads (#4240) by @​stefan6419846
• Limit size of standard xref table (#4239) by @​stefan6419846

Bug Fixes (BUG)

• Decode UniGB-UTF16 CMaps as UTF-16BE (#4231) by @​4444wjt
• Keep 8-bit DeviceRGB image mode (#4230) by @​DGrutt
• Preserve all annotation quadrilaterals when merging pages (#4223) by @​repzakske

Robustness (ROB)

• Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222) by @​metsw24-max

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

• Improve performance and limit field work (#4219) by @​stefan6419846
• Limit stream parsing work (#4218) by @​stefan6419846

New Features (ENH)

• Allow custom fit modes for named destinations (#4181) by @​JackyHsu-X

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198) by @​Zephyr761
• Avoid overwriting unread objects in add_form_topname (#4190) by @​tigger0jk
• Read an indirect page box on a writer page (#4179) by @​usmanmateen

Full Changelog

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

• Prevent cyclic tree handling (#4188) by @​stefan6419846

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158) by @​yaourtv

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.2, 2026-10-21

Security (SEC)

• Avoid repeated full file loads (#4240)
• Limit size of standard xref table (#4239)

Bug Fixes (BUG)

• Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
• Keep 8-bit DeviceRGB image mode (#4230)
• Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

• Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)

Full Changelog

Version 6.21.0, 2026-10-16

Security (SEC)

• Improve performance and limit field work (#4219)
• Limit stream parsing work (#4218)

New Features (ENH)

• Allow custom fit modes for named destinations (#4181)

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198)
• Avoid overwriting unread objects in add_form_topname (#4190)
• Read an indirect page box on a writer page (#4179)

Full Changelog

Version 6.20.1, 2026-10-12

Security (SEC)

• Prevent cyclic tree handling (#4188)

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158)

Full Changelog

Commits

• 37d05f6 REL: 6.21.2
• 68a0e50 SEC: Avoid repeated full file loads (#4240)
• a3061e3 SEC: Limit size of standard xref table (#4239)
• b7eb7b9 BUG: Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
• 885e743 ROB: Reject unsupported key lengths in the /Encrypt dictionary (#4226)
• b68a335 TST: Enable type checking for PageRange tests (#4229)
• 3f9c7f4 ROB: Reject negative bfrange source ranges in /ToUnicode CMaps (#4225)
• 85c46ab ROB: Raise PdfReadError for malformed /ObjStm /N and /First headers (#4216)
• a91817a BUG: Keep 8-bit DeviceRGB image mode (#4230)
• b32df1d ROB: Validate the /Encrypt dictionary when opening an encrypted file (#4197)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions