build(deps): bump the python-deps group across 1 directory with 9 updates

[dependabot]

Updates the requirements on uvicorn, sqlalchemy, alembic, psycopg2-binary, pyjwt, cryptography, ruff, mypy and oracledb to permit the latest version.
Updates uvicorn from 0.52.3 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.52 to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

• [platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

• [platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

  References: #13592

2.0.53

Released: September 14, 2026

orm

• [orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

  References: #13560

• [orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an

... (truncated)

Commits

• See full diff in compare view

Updates alembic from 1.19.1 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

• [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

  References: #1846

• [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

  References: #916

bug

• [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

  References: #1768

• [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

• See full diff in compare view

Updates psycopg2-binary to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
Fixed



Raise the documented PyJWTError subclass instead of leaking a

TypeError when the exp, nbf, or iat claim decodes to a

non-numeric, non-string value such as a list, dict, or null.

Commits

• c6fe464 release: prepare v2.14.0
• f541302 style: apply Ruff formatting
• 801cd12 fix: reject public JWK container HMAC keys
• af8181c fix: reject empty HMAC keys from JWKs
• ba4853a Throttle repeated PyJWKClient refreshes
• 2798504 fix: reject DER public keys as HMAC secrets
• 8b4e233 fix: reject loader-accepted PEM variants
• 1f8180a fix: format JWS tests
• cff1ac5 Fix redirect handler return annotation
• 0a795b8 Reject redirects in PyJWKClient fetches
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates ruff from 0.16.3 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• See full diff in compare view

Updates oracledb to 26.0.0

Release notes

Sourced from oracledb's releases.

v26.0.0

python-oracledb 26.0.0 is now released. The major version number will now be the two digit year in which that version was first released. This release has the following highlights:

• support for Python 3.14 templates
• support for centralized configuration providers for GCP and AWS
• support for setting transaction priority (Oracle AI Database 26ai feature)
• support for Oracle AI Database 26ai Deep Data Security using asyncio
• support for external authentication using TLS in thin mode
• support for operation and round trip callbacks
• improvements to Apache Arrow support

See the full release notes for all of the details.

Commits

• 601f2b4 Preparing to release python-oracledb 26.0.0.
• 7082aad Tweak release notes as suggested.
• 36fa3ae Tidy up tests to ensure cleanup works as it should.
• a7b8c60 Add Cython declaration to avoid attribute error.
• 9aa7753 Fixed typo.
• c41a5cc Change Oracle Database 26ai to Oracle AI Database 26ai.
• 94f94c1 Ensure the HA readiness piggyback is not sent for client initiated connections
• b6b14c2 Added directory name to test functions for better differentiation of tests.
• d1703fb Small tweaks in preparing for release.
• bf0ea3c Added method AsyncConnection.terminate() as requested (#602).
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 262b8907-9de1-4380-a738-e6e2e2920309

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}