chore(deps): bump the deploy-python-dependencies group in /deploy with 4 updates

[dependabot]

Bumps the deploy-python-dependencies group in /deploy with 4 updates: markupsafe, pydantic-core, sqlalchemy and websockets.

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. :issue:521

Commits

• ece2607 release version 3.0.4
• 620bc80 split archs
• 73c3be1 fix wheel builds (#536)
• d8ae19e fix wheel builds
• ff1eaff Build Android and iOS wheels (#516)
• 87e64f9 build Android and iOS wheels
• bc33c55 Build ppc64le wheels (#518)
• 0ddd6ea build ppc64le wheels
• 3e07758 Build armv7l wheels (#514)
• 39b9aae build armv7l wheels
• Additional commits viewable in compare view

Updates pydantic-core from 2.46.5 to 2.49.0

Commits

• 6312eb1 Prepare release v2.14.0b2 (#13790)
• 4a66dc2 Stabilize MISSING sentinel (#13782)
• 45c3fc1 Add support for lazy imports (#13776)
• 2e7a559 Fix typos in changelog entries (#13789)
• 831893e Fix race conditions in freethreaded build (#13785)
• e2683e1 Refactor Decimal JSON Schema pattern constraint (#13672)
• 78a5c4c Add support for TypeForm (#13459)
• 6b470f4 Do not mention MISSING as a valid value in validation errors (#13779)
• 1c8a330 Add a deque core schema (#13757)
• 2261ae1 Allow self to be used as a parameter with @validate_call (#13773)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.54 to 2.1.3

Release notes

Sourced from sqlalchemy's releases.

2.1.3

Released: October 2, 2026

orm

• [orm] [bug] [regression] Fixed regression where columns delivered to a mapped class from an unmapped _orm.MappedAsDataclass mixin, or from a class decorated with _orm.unmapped_dataclass(), would not be placed in the _schema.Table in the order in which they were declared on the mixin; columns that had no dataclass default, such as a primary key column with no _orm.mapped_column.default, or which made use of _orm.mapped_column.default_factory, would be moved after the remaining columns of the mixin.

  References: #13634

sql

• [sql] [bug] [regression] Fixed regression caused by the new implementation of ExecutableStatement.params() where parameter values established using this method would not be rendered when compiling the statement with the literal_binds compiler option, instead rendering NULL with a warning.

  References: #13635

2.1.2

Released: October 2, 2026

orm

• [orm] [bug] [regression] Fixed regression caused by #5987 where the selectinload() loader strategy would ignore additional criteria present in the _orm.relationship.primaryjoin of a many-to-many relationship, such as a comparison against a column on the association table or on the parent table, loading related rows that should have been excluded. The omit_join optimization for many-to-many relationships is now only used when the primaryjoin consists solely of comparisons between the parent's primary key columns and the association table.

  References: #13626

engine

... (truncated)

Commits

• See full diff in compare view

Updates websockets from 17.1 to 17.2

Release notes

Sourced from websockets's releases.

17.2

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits

• a1664f4 Release version 17.2.
• d2060d8 Test against latest PyPy.
• 2af0aff Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
• 603dd98 Document how to wait for clients to disconnect.
• f78b0b3 mypy is getting smarter.
• 32504a8 Prevent suprious log when proxy rejects connection.
• 7db6ba3 Decode credentials in WebSocket and proxy URIs.
• a591d62 Tighten heuristics for representing control frames.
• 5b63a4c Fix flaky tests.
• b8cfbfb Add deterrence against AI slop.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T22:40:06.097815Z	449a721	PR opened
🔒 Security Review	✅ Completed 2026-10-08T22:40:54.874760Z	449a721	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 449a721feb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep pydantic-core aligned with Pydantic

The lock still selects pydantic==2.13.5, whose package metadata requires exactly pydantic-core==2.46.5; pinning core to 2.49.0 therefore gives pip mutually incompatible requirements. Any pip install --require-hashes -r deploy/backend-requirements.txt, including the backend Docker build and capacity verification jobs, will stop during dependency resolution before the application can be installed.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep SQLAlchemy within the declared project constraint

The project metadata declares sqlalchemy>=2.0,<2.1, but this line pins 2.1.3. In the repository-and-dependencies and PostgreSQL CI jobs, the install command explicitly combines pip install -e .[dev] with the version extracted from this lock, so pip cannot satisfy both constraints and exits before running tests; retain a 2.0.x pin or update and validate the project constraint together.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Refresh the dependency inventories with the lock

Updating this lock without regenerating the checked-in dependency and software inventories makes the mandatory dependency-inventory CI validation fail. expected_python_ids() reads this file, while docs/supply-chain/dependency-inventory.json still contains MarkupSafe 3.0.3, pydantic-core 2.46.5, SQLAlchemy 2.0.54, and websockets 17.1, so validation reports all four new IDs as missing and all four old IDs as extra.

Useful? React with 👍 / 👎.