chore(deps): bump uvicorn[standard] from 0.52.1 to 0.52.3 in the python group across 1 directory

[dependabot]

Bumps the python group with 1 update in the / directory: uvicorn[standard].

Updates uvicorn[standard] from 0.52.1 to 0.52.3

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Changelog

Sourced from uvicorn[standard]'s changelog.

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Commits

• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• 2a5ff18 Version 0.52.2 (#3066)
• 1920297 Update zttp to 0.0.22 (#3063)
• 5c560da chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3061)
• See full diff in compare view

[hleroy]

SAFE TO MERGE

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian ✅ · MERGEABLE/CLEAN

Package	Old → New	Type	Finding
uvicorn[standard]	0.52.1 → 0.52.3	patch	Two patch releases (0.52.2, 0.52.3, both Aug 13 2026). Upstream notes name only one change per release: updating the bundled zttp parser (0.0.22 fixing bodyless request receives; 0.0.24 combined-receive fast path). zttp is an opt-in HTTP implementation (--http zttp, still marked experimental upstream); the default http=auto selects HttpToolsProtocol when httptools is installed (uvicorn/protocols/http/auto.py), so nothing loads zttp_impl.py here. Wheel diff shows only two changed files vs 0.52.1 — __init__.py version bump and zttp_impl.py internals — no other module touched. Requires-Dist in METADATA is byte-identical to 0.52.1 (httptools>=0.8.0, uvloop>=0.15.1, websockets>=13.0, etc.) — no new floor to break uv.lock. No advisories on PyPI for either version.

Impact on this codebase: Grepped for launcher config — compose/production/django/start runs gunicorn … -k uvicorn_worker.UvicornWorker, and uvicorn-worker 0.4.0's CONFIG_KWARGS = {"loop": "auto", "http": "auto"} (verified from the shipped wheel) means auto/httptools; compose/local/django/start runs uvicorn config.asgi:application with no --http flag = same. Neither passes --http zttp, so the only code path the release changes is unreachable. Nothing else in radar/ imports uvicorn internals (only comments in radar/providers/rainviewer.py, radar/providers/meteofrance_auth.py, radar/cache.py mention it descriptively).

Invariants: Considered CLAUDE.md's async-view / event-loop / ASGI seams — untouched (the httptools_impl.py, h11_impl.py, WebSocket protocol modules, Config, Server, main all identical between 0.52.1 and 0.52.3). The cache.py "rebuild client on loop change" comment refers to Redis, not uvicorn. Not a ruff PR.

Verdict rationale: The only behavioral change lives in an opt-in code path the launcher never selects; the wheel is otherwise a pure version bump. Green CI on Linux/Postgres exercises the real request path via httptools. Safe to squash.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code