Skip to content

chore(deps): bump the backend-minor-and-patch group across 1 directory with 26 updates - #564

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/apps/backend/dev/backend-minor-and-patch-af444f7875
Open

chore(deps): bump the backend-minor-and-patch group across 1 directory with 26 updates#564
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/apps/backend/dev/backend-minor-and-patch-af444f7875

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-minor-and-patch group with 26 updates in the /apps/backend directory:

Package From To
fastapi 0.141.1 0.143.2
uvicorn 0.53.0 0.54.0
pydantic 2.13.5 2.14.1
pydantic-settings 2.15.0 2.16.0
pyjwt 2.14.0 2.15.1
cryptography 50.0.1 50.0.2
sqlalchemy 2.0.54 2.1.4
xhtml2pdf 0.2.20 0.2.24
mypy 2.3.1 2.4.0
ruff 0.16.8 0.17.1
charset-normalizer 3.5.1 3.5.2
dnspython 2.8.0 2.9.0
httptools 0.8.0 0.9.0
markupsafe 3.0.3 3.0.4
pycparser 3.0 3.11
pypdf 6.19.0 6.20.1
python-dotenv 1.2.3 1.2.4
starlette 1.6.0 1.8.0
svglib 2.2.0 2.3.0
tzdata 2026.4 2026.5
websockets 17.1 17.2
ast-serialize 0.11.2 0.13.0
coverage 7.16.1 7.16.2
iniconfig 2.3.0 2.3.1
librt 0.15.0 0.16.0
pluggy 1.6.0 1.7.0

Updates fastapi from 0.141.1 to 0.143.2

Release notes

Sourced from fastapi's releases.

0.143.2

Fixes

Translations

Internal

0.143.1

Fixes

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

... (truncated)

Commits

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

  • CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
  • Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
  • Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
  • cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
  • CliSubCommand aliases keep their case with case_sensitive=False (#989).
  • Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
  • CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

  • Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
  • Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
  • A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
  • collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
  • A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
  • Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

  • With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
  • secrets_case_sensitive=True is now honored on Windows (#1001).
  • An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
  • TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

  • Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
  • Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
  • NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • 6ea85e6 Decode optional Annotated named union aliases (#1041)
  • ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
  • b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
  • bedb60e Honor explicit empty TOML table header overrides (#1027)
  • Additional commits viewable in compare view

Updates pyjwt from 2.14.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed


- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).

v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__


Security

  • Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
  • PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table>

... (truncated)

Commits
  • 7d5ef55 chore: prepare 2.15.1 release
  • 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
  • 1d41a64 chore: prepare 2.15.0 release
  • 9bc0665 fix: make recursive payload tests deterministic
  • 5fde08a fix: normalize recursive JWT payload errors
  • 171062d utils: mention bytes in force_bytes type error (#1173)
  • c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
  • 2763752 Add support for Python 3.15 (#1202)
  • 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
  • 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
  • Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates sqlalchemy from 2.0.54 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

    References: #13659

engine

  • [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

    This change is also backported to: 2.0.55

    References: #13640

  • [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

    This change is also backported to: 2.0.55

    References: #13641

  • [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

Updates xhtml2pdf from 0.2.20 to 0.2.24

Release notes

Sourced from xhtml2pdf's releases.

v.0.2.24

🐛 Bug-Fixes

  • Parentheses, brackets, «» and the other mirrored characters face the right way in right-to-left text: (א) used to be drawn )א(. Bracket pairs now take the direction of what they enclose, as a browser lays them out, and the invisible bidi controls (U+2066–U+2069, U+202A–U+202E, the marks U+200E, U+200F, U+061C) are no longer drawn as boxes.

  • A simple signature with a ca_chain – the first example in Encryption and signing – signs. The chain was read and parsed, then handed to pyHanko as file names, and every such signature failed with “expected str, bytes or os.PathLike object, not Certificate”.

  • A pkcs11 signature that names its token with token_label works with pyHanko 0.37, which removed open_pkcs11_session(token_label=...); the label now goes through token_criteria.

  • A table row that fits no page – such as a row with a long text in a narrow column that would fit a page alone but not under the repeated header – is cut between pages and goes on under the header, instead of stopping the whole render with LayoutError: ... too large on page. Content wider than the cell does not stop the cut either. A row crossed by a rowspan still fails as before.

  • A long table in a document with pdf:pagecount or pdf:toc no longer keeps every part of it already drawn until the end. Each part that went on to the next page was remembered, with the rest of its table, to be undone between passes; it is remembered weakly now. A 500-row report peaked at 58 MB instead of 166 MB, with the same PDF.

  • Right-to-left text is put in the order it is drawn one line at a time, after the lines are broken, instead of one fragment at a time before. A paragraph of several lines had its last words on its first line, and an entity (—, «) or an inline tag such as < b > in the middle of a sentence split it into halves that came out the wrong way round. The text itself now keeps the order it was written in, so the PDF outline and the document title are no longer stored reversed.

  • Dashed and dotted borders on table cells are drawn dashed and dotted. The squared line ends a table border is stroked with closed up every gap, so they always came out as solid lines.

⚠️ Deprecation

  • pyHanko 0.37.0 and pyhanko-certvalidator 0.32.1 are the minimum versions; the declared floor was pyHanko 0.12.1, which nothing tested. pyHanko 0.37 fetches revocation data and timestamps with aiohttp and no longer installs requests.

🧹 Cleanup

  • python-bidi is no longer a dependency. The Unicode Bidirectional Algorithm is implemented in xhtml2pdf/bidi.py, in pure Python on top of unicodedata, and passes the whole of the Unicode conformance suites (tools/bidi/conformance.py). python-bidi has been a compiled Rust extension since 0.5, which needed a wheel for every platform, and it reordered without mirroring, which is the bug above.

Full Changelog: xhtml2pdf/xhtml2pdf@v0.2.23...v0.2.24

v.0.2.23

This release adds CSS custom properties, real block boxes and long-word wrapping. It also fixes a round of table, table-of-contents and chart bugs, and renders long documents with far less memory and time. The PDF output of the speed and memory work is byte-for-byte identical to 0.2.22.

🎉 New

  • CSS custom properties: --name: value and var(--name, fallback) work anywhere a value goes, including shorthands, @page, @frame and @font-face (#743).
  • A block's box goes round everything it holds: a <div> with padding, a border or a background draws one box around its text, tables and inner blocks, and the box is cut cleanly at a page break. The border is no longer copied onto every paragraph and
  • Long words wrap: overflow-wrap: break-word / anywhere (and word-wrap) break a wors a URL or a hash, andthis works on links. word-break: break-all is supported (#339). - Table sizing: marmargin: 0 autoapply to tables, and a CSSwidthon ais read ([#386](https://github.com/xhtml2pdf/xhtml2pdf/issues/386)). A table with anauto` margin shrinks toon a table is honoured(#562).
  • **Links to other filesd other relative linksbecome real links (#660).
  • Block height: a bld, and an empty blockwith a border or background is drawn.
  • Charts: they read an entry per series viaseriesNames / seriesColors.

💪🏼 Improvements

  • Less memory, and faster. Peak memory for long documents drops to about 40% of what it was: 10,0tead of 371 MB, and a256-row table 14 MB instead of 26 MB. Rendering is 10–39% faster: each word is measured once, a paragrar width, and the parsedHTML is released before layout.
  • CSS warnings name the file, a <style> blockor a style attribute (#780).
  • Headings inside table s appear in <pdf:toc>.
  • Images Pillow refuses for their size are reported the same way max_image_pixels repor

🐛 Bug fixes

... (truncated)

Commits
  • 6692067 Release 0.2.24
  • e9e8942 Show what xhtml2pdf makes in the README
  • e07fbe4 Keep the comments of this release to what the code does
  • 642992b Let go of drawn table parts during a multiBuild
  • 92de3ea Put right-to-left text in drawing order a line at a time
  • a3b56b8 Draw dashed and dotted table borders dashed
  • 55f0281 Cut a table row that fits no page instead of failing the render
  • f461716 Move to pyHanko 0.37 and fix the two signing paths it exposed
  • dd8845b Replace python-bidi with our own bidirectional algorithm
  • f28aec3 Release 0.2.23
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

@dependabot
chore(deps): bump the backend-minor-and-patch group across 1 director…
c94d10f 
…y with 26 updates

Bumps the backend-minor-and-patch group with 26 updates in the /apps/backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.143.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.53.0` | `0.54.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.0` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.14.0` | `2.15.1` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.54` | `2.1.4` |
| [xhtml2pdf](https://github.com/xhtml2pdf/xhtml2pdf) | `0.2.20` | `0.2.24` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.8` | `0.17.1` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.5.1` | `3.5.2` |
| [dnspython](https://github.com/rthalley/dnspython) | `2.8.0` | `2.9.0` |
| [httptools](https://github.com/MagicStack/httptools) | `0.8.0` | `0.9.0` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.3` | `3.0.4` |
| [pycparser](https://github.com/eliben/pycparser) | `3.0` | `3.11` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.19.0` | `6.20.1` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.3` | `1.2.4` |
| [starlette](https://github.com/Kludex/starlette) | `1.6.0` | `1.8.0` |
| [svglib](https://github.com/deeplook/svglib) | `2.2.0` | `2.3.0` |
| [tzdata](https://github.com/python/tzdata) | `2026.4` | `2026.5` |
| [websockets](https://github.com/python-websockets/websockets) | `17.1` | `17.2` |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.11.2` | `0.13.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.1` | `7.16.2` |
| [iniconfig](https://github.com/pytest-dev/iniconfig) | `2.3.0` | `2.3.1` |
| [librt](https://github.com/mypyc/librt) | `0.15.0` | `0.16.0` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |



Updates `fastapi` from 0.141.1 to 0.143.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.143.2)

Updates `uvicorn` from 0.53.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.53.0...0.54.0)

Updates `pydantic` from 2.13.5 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.1)

Updates `pydantic-settings` from 2.15.0 to 2.16.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.0)

Updates `pyjwt` from 2.14.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.14.0...2.15.1)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.1...50.0.2)

Updates `sqlalchemy` from 2.0.54 to 2.1.4
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `xhtml2pdf` from 0.2.20 to 0.2.24
- [Release notes](https://github.com/xhtml2pdf/xhtml2pdf/releases)
- [Commits](xhtml2pdf/xhtml2pdf@v0.2.20...v0.2.24)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `ruff` from 0.16.8 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.8...0.17.1)

Updates `charset-normalizer` from 3.5.1 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.5.1...3.5.2)

Updates `dnspython` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.8.0...v2.9.0)

Updates `httptools` from 0.8.0 to 0.9.0
- [Release notes](https://github.com/MagicStack/httptools/releases)
- [Commits](MagicStack/httptools@v0.8.0...v0.9.0)

Updates `markupsafe` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.3...3.0.4)

Updates `pycparser` from 3.0 to 3.11
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Commits](eliben/pycparser@release_v3.00...release_v3.11)

Updates `pypdf` from 6.19.0 to 6.20.1
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.19.0...6.20.1)

Updates `python-dotenv` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4)

Updates `starlette` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.6.0...1.8.0)

Updates `svglib` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/deeplook/svglib/releases)
- [Changelog](https://github.com/deeplook/svglib/blob/main/CHANGELOG.md)
- [Commits](deeplook/svglib@v2.2.0...v2.3.0)

Updates `tzdata` from 2026.4 to 2026.5
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.4...2026.5)

Updates `websockets` from 17.1 to 17.2
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@17.1...17.2)

Updates `ast-serialize` from 0.11.2 to 0.13.0
- [Commits](mypyc/ast_serialize@v0.11.2...v0.13.0)

Updates `coverage` from 7.16.1 to 7.16.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.1...7.16.2)

Updates `iniconfig` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/pytest-dev/iniconfig/releases)
- [Changelog](https://github.com/pytest-dev/iniconfig/blob/main/CHANGELOG)
- [Commits](pytest-dev/iniconfig@v2.3.0...v2.3.1)

Updates `librt` from 0.15.0 to 0.16.0
- [Commits](mypyc/librt@v0.15.0...v0.16.0)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pluggy@1.6.0...1.7.0)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.143.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: sqlalchemy
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: xhtml2pdf
  dependency-version: 0.2.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: httptools
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: pycparser
  dependency-version: '3.11'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: pypdf
  dependency-version: 6.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: starlette
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: svglib
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: websockets
  dependency-version: '17.2'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: ast-serialize
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: librt
  dependency-version: 0.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 19, 2026
@vercel

vercel Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
partha-frontend Ready Ready Preview Oct 19, 2026 6:19am UTC

This branch was successfully deployed

1 active deployment
Preview — c94d10f3 Deployed Oct 19, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SHAURYAKSHARMA24 SHAURYAKSHARMA24 Awaiting requested review from SHAURYAKSHARMA24 SHAURYAKSHARMA24 is a code owner
@parthrohit22 parthrohit22 Awaiting requested review from parthrohit22 parthrohit22 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants