chore(deps): bump the backend-dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #62 · DRYTRIX/CatMap

dependabot · 2026-09-07T11:26:55Z

Bumps the backend-dependencies group with 11 updates in the /backend directory:

Package	From	To
uvicorn	`0.52.1`	`0.52.4`
sqlalchemy	`2.0.51`	`2.0.52`
psycopg	`3.3.4`	`3.3.5`
pillow-heif	`1.5.0`	`1.6.0`
alembic	`1.19.0`	`1.19.1`
onnxruntime	`1.28.0`	`1.29.0`
numpy	`2.5.1`	`2.5.2`
sentry-sdk	`2.66.1`	`2.68.1`
pywebpush	`2.4.0`	`2.5.0`
google-auth	`2.56.3`	`2.57.1`
ruff	`0.16.1`	`0.16.6`

Updates uvicorn from 0.52.1 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Commits

8988c23 Stabilize macOS Python 3.13 signal shutdown tests (#3084)
898ddca Update PyPI publish action to version 1.14.2 (#3083)
3869f8a Restore Mermaid diagram rendering (#3080)
64148a9 Version 0.52.4 (#3079)
9e9e569 docs: correct release example PR number (#3072)
b783dac Remove duplicate Date header from SansIO WebSocket handshakes (#3078)
27019b2 chore(deps): bump the python-packages group across 1 directory with 11 update...
1b64273 Fix a typo in index.md (#3006)
a68da60 Version 0.52.3 (#3068)
6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

[platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

References: #13477

orm

[orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

References: #13439

[orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

References: #13485

[orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

See full diff in compare view

Updates psycopg from 3.3.4 to 3.3.5

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.5 ^^^^^^^^^^^^^

Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).

Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).

Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).

Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).

Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).

Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).

Fix building C extension with Cython 3.3.

Psycopg 3.3.4 ^^^^^^^^^^^^^

Fix possible spurious connection timeout in systems with very long uptimes in C extension (:ticket:[#1280](https://github.com/psycopg/psycopg/issues/1280)).

Fix client-side adaptation of enums whose name require quotes (:ticket:[#1298](https://github.com/psycopg/psycopg/issues/1298)).

Consistently populate ~Cursor.statusmessage after ~Cursor.executemany() (:ticket:[#1302](https://github.com/psycopg/psycopg/issues/1302)).

Psycopg 3.3.3 ^^^^^^^^^^^^^

Retain Error.pgconn when raising a single exception for multiple connection attempt errors (:ticket:[#1246](https://github.com/psycopg/psycopg/issues/1246)).

Return a proper error when server sends ErrorResponse for a Sync after a Parse (:ticket:[#1260](https://github.com/psycopg/psycopg/issues/1260)).

... (truncated)

Commits

ea542c9 chore: bump psycopg package version to 3.3.5
8d31e47 chore(deps): bump the actions group across 1 directory with 4 updates
268f863 Merge pull request #1370 from Sanjays2402/fix/truncated-binary-copy-error
a412fa4 docs: put together different issues fixed around copy parsing
f757307 fix: clearer error messages according to truncated copy message part
b1f17c4 test: move existing COPY format parsing tests into a single module
21eba57 test: drop useless parametrization of copy binary parsigh test
6780e17 fix(copy): handle truncated binary row headers
2f2fcfb Merge pull request #1364 from DylanYoung/fix_client_encoding_aliases
ccc351e refactor: don't store the encodings raw table as a dict
Additional commits viewable in compare view

Updates pillow-heif from 1.5.0 to 1.6.0

Release notes

Sourced from pillow-heif's releases.

v1.6.0

Added

Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456

Python 3.15 and 3.15t wheels added.

Changed

libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453

Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455

Changelog

Sourced from pillow-heif's changelog.

[1.6.0 - 2026-08-31]

Added

Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456

Python 3.15 and 3.15t wheels added.

Changed

libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453

Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455

Commits

11a2a9f v1.6.0
16be8c8 ci: fix leak tests failing the full Wheels matrix (#467)
2a7240c chore(deps): update dependency strukturag/libheif to v1.23.2 (#466)
c4e4ec9 [pre-commit.ci] pre-commit autoupdate (#465)
657f27d [pre-commit.ci] pre-commit autoupdate (#464)
a6d6e91 docs: fix the docs build and refresh the reference (#462)
434e64d chore(deps): update dependency macos to v26 (#422)
f1e15a7 ci: rework flaky memory leak tests (#461)
06dccd9 [pre-commit.ci] pre-commit autoupdate (#427)
38c39bb chore(deps): update dependency python to 3.14 (#429)
Additional commits viewable in compare view

Updates alembic from 1.19.0 to 1.19.1

Release notes

Sourced from alembic's releases.

1.19.1

Released: August 8, 2026

bug

[bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508 that failed to take into account column bound check constraints, leading to wrong autogenerate detections.

References: #1842

Commits

See full diff in compare view

Updates onnxruntime from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).

POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).

The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).

Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).

Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).

Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).

Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).

Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).

Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).

Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).

Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).

Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).

Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).

Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).

Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).

Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

2e2543f [CUDA] Update cuda archs in packaging pipelines (#31992)
9b174a4 [CUDA] Add GatedAdd contrib operator (#31835)
a29da16 Validate SkipLayerNorm prepacked lengths (#31676)
831fa2f Validate whisper beginning_timestamp_token_id bounds (#31636)
3cee186 Handle RNN activation parameters safely (#31675)
37d79e3 Harden CUDA fp16 transpose index math against int overflow (#31644)
45bdd4c Validate QLinearConv bias size against output channels (#31684)
f5de4c3 Fix TfIdfVectorizer weight indexing semantics (#31649)
d3abafc Validate FeatureVectorizer batch sizes (#31671)
1441b36 [WebGPU] Add MRotaryEmbedding support (#31976)
Additional commits viewable in compare view

Updates numpy from 2.5.1 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

Abhijeetsingh Meena +

Charalampos Stratakis

Charles Harris

Chris Ninham +

David Woods

Geonho +

Gopu Yeshwanth Reddy +

Iason Krommydas

Ijtihed Kilani

Jelle Zijlstra +

Joren Hammudoglu

Kumar Aditya

Mike Boyle

Nathan Goldbaum

Raghuveer Devulapalli

Sebastian Berg

... (truncated)

Commits

48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
ecf599c Merge pull request #32221 from charris/backport-32151
3c7ac97 Merge pull request #32220 from charris/backport-32205
23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
d8262bc MAINT: Update cibuildwheel to v4.2.0
988d94d Merge pull request #32158 from charris/backport-32133
b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
Additional commits viewable in compare view

Updates sentry-sdk from 2.66.1 to 2.68.1

Release notes

Sourced from sentry-sdk's releases.

2.68.1

enable_logs
(logs) Don't stop sending auto-collected logs when enable_logs=True by @sentrivana in #7237

If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.
import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
enable_logs=True,
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=False),
],
)
Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.
Bug Fixes 🐛

(django) Add failed_request_status_codes by @mgaligniana in #7140

(anthropic) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7207

(google_genai) Gate streaming gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7210

(langchain) Use gen_ai.tool.definitions attribute when data collection is enabled by @ericapisani in #7204

(langgraph,huggingface_hub) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7208

(openai) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7205

(openai_agents) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7209

2.68.0

Important
We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

Action Needed

If you had enable_logs set to True:

If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.

If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:
import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.68.1

enable_logs
(logs) Don't stop sending auto-collected logs when enable_logs=True by @sentrivana in #7237

If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.
import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
enable_logs=True,
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=False),
],
)
Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.
Bug Fixes 🐛

(django) Add failed_request_status_codes by @mgaligniana in #7140

(anthropic) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7207

(google_genai) Gate streaming gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7210

(langchain) Use gen_ai.tool.definitions attribute when data collection is enabled by @ericapisani in #7204

(langgraph,huggingface_hub) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7208

(openai) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7205

(openai_agents) Gate gen_ai.response.tool_calls on outputs, not inputs by @ericapisani in #7209

2.68.0

Important
We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

Action Needed

If you had enable_logs set to True:

If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.

If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:

... (truncated)

Commits

98f7d91 Update changelog
8f886ff release: 2.68.1
df4ec02 fix(logs): Don't stop sending auto-collected logs when enable_logs=True (#7...
e320318 test(pyramid): Add tests for data_collection gating of request body (#7218)
7b8a385 test(bottle): Add tests for data_collection gating of request body (#7217)
cbcadc9 test(sanic): Add tests for data_collection gating of request body (#7216)
e42c798 feat(tornado): Gate request body collection on data_collection option (#7215)
d05bb60 test(django): Add tests for data_collection gating of request body (#7213)
bcce67b feat(wsgi): Gate request body collection on data_collection option (#7212)
41220c4 fix(google_genai): Gate streaming gen_ai.response.tool_calls on outputs, no...
Additional commits viewable in compare view

Updates pywebpush from 2.4.0 to 2.5.0

Changelog

Sourced from pywebpush's changelog.

2.5.0

Add common status_code and retry_after accessors to WebPushException for synchronous and asynchronous responses.

2.3.0 (2026-02-09)

Cleanup from @Rotzbua

Use modern typing for annotations

Remove legacy python 2 import

remove redundant :type annotations

use [.dev] extras in CI

2.2.1 (2026-02-06)

add'l typing info (Thanks @rotzbua)

2.2.0 (2026-)

Update rst files to reflect md file changes

Add comment discussing additional work for Windows Notification Service (WNS)

Update the README.md file to mention the required, non-standard headers.

BREAKING_CHANGE This version also drops legacy support for GCM/FCM authorization keys, since those items are obsolete according to Google. See https://firebase.google.com/docs/cloud-messaging/auth-server#authorize-legacy-protocol-send-requests

2.1.2 (2025-11-10)

chore: fix formatting chore: update CHANGELOG chore: note admin update

2.1.1 (2025-10-14)

This was an administrative push to test a new publication system.

2.1.0 (2025-09-29)

feat: Add a async_webpush one call func and tests (15cf848)[https://github.com/web-push-libs/pywebpush/commit/15cf84885b4bc1cd4e8e58a8fc8f84bfc9b3387e] (thanks (@AlexUnder2003)[https://github.com/web-push-libs/pywebpush/commits?author=AlexUnder2003])

2.0.1 (2024-10-14)

docs: Use License classifiers in pyproject.toml (thanks @sevdog)

2.0.0 (2024-01-02)

... (truncated)

Commits

See full diff in compare view

Updates google-auth from 2.56.3 to 2.57.1

Release notes

Sourced from google-auth's releases.

google-auth: v2.57.1

2.57.1 (2026-09-03)

Bug Fixes

auth: parse hostname for mTLS and PSC endpoint certificate rotation (#18147) (#18201) (b18bb4c)

google-auth: v2.57.0

2.57.0 (2026-08-21)

Features

auth: add deprecation warning for grpcio < 1.83.0 (PQC support) (#18070) (68bdaba)

Bug Fixes

auth: parse hostname for mTLS and PSC endpoint certificate rotat… (#18153) (b642373)

auth: prevent TypeError and support home-dir cert fallback for X… (#18016) (b9a1379)

Documentation

handwritten: centralize CONTRIBUTING.rst pointers (#17642) (23b9499)

Commits

036f734 chore: release main (#18276)
a700117 chore(main): release google-shopping-merchant-loyaltycustomers 0.1.1 (#18283)
ffa6e54 fix: correct client version strings (#18282)
b3d76b9 chore(main): release google-shopping-merchant-loyaltycustomers 0.1.0 (#18278)
492a0e3 feat(google/shopping/merchant/loyaltycustomers/v1): add google-shopping-merch...
b18bb4c fix(auth): parse hostname for mTLS and PSC endpoint certificate rotation (#18...
ad2ef26 chore: release main (#18221)
182ff9f feat: add send and ack mutations Cloud Spanner Queues (#17728)
2d8093e chore(spanner): use nam6 instance config for test_create_instance_partition (...
7126a54 feat(bigtable): Rerouted DirectRow.commit to use mutate_row (#18191)
Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

Move pytest-fixture-autouse to the restriction category (#28219)

[flake8-pytest-style] Add an autofix for PT020 (#27993)

[flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)

[isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

Validate unary expressions when parsing (#28233)

[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)

[flake8-bugbear] Fix panic on match subjects (B031) (#27781)

[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)

[flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)

[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

[flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

Add another example and glob reference for lint.per-file-ignores (#28106)

Add duplicate work guidance (#28229)

[flake8-async] Document thread offloading (ASYNC240) (#28008)

[pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

@flying-sheep

@pikammmmm

@fly1d

@waterWang

@Pierre-Sassoulas

@ntBre

@jelle-openai

@ericbuehl

@tjkuson

@AbhinavMir

@Whning0513

@chirizxc

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

Move pytest-fixture-autouse to the restriction category (#28219)

[flake8-pytest-style] Add an autofix for PT020 (#27993)

[flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)

[isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

Validate unary expressions when parsing (#28233)

[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)

[flake8-bugbear] Fix panic on match subjects (B031) (#27781)

[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)

[flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)

[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

[flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

Add another example and glob reference for lint.per-file-ignores (#28106)

Add duplicate work guidance (#28229)

[flake8-async] Document thread offloading (ASYNC240) (#28008)

[pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

@flying-sheep

…ith 11 updates Bumps the backend-dependencies group with 11 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.51` | `2.0.52` | | [psycopg](https://github.com/psycopg/psycopg) | `3.3.4` | `3.3.5` | | [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.5.0` | `1.6.0` | | [alembic](https://github.com/sqlalchemy/alembic) | `1.19.0` | `1.19.1` | | [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` | | [numpy](https://github.com/numpy/numpy) | `2.5.1` | `2.5.2` | | [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.66.1` | `2.68.1` | | [pywebpush](https://github.com/web-push-libs/pywebpush) | `2.4.0` | `2.5.0` | | [google-auth](https://github.com/googleapis/google-cloud-python) | `2.56.3` | `2.57.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.6` | Updates `uvicorn` from 0.52.1 to 0.52.4 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.52.1...0.52.4) Updates `sqlalchemy` from 2.0.51 to 2.0.52 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `psycopg` from 3.3.4 to 3.3.5 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.3.4...3.3.5) Updates `pillow-heif` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/bigcat88/pillow_heif/releases) - [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md) - [Commits](bigcat88/pillow_heif@v1.5.0...v1.6.0) Updates `alembic` from 1.19.0 to 1.19.1 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `onnxruntime` from 1.28.0 to 1.29.0 - [Release notes](https://github.com/microsoft/onnxruntime/releases) - [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md) - [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0) Updates `numpy` from 2.5.1 to 2.5.2 - [Release notes](https://github.com/numpy/numpy/releases) - [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst) - [Commits](numpy/numpy@v2.5.1...v2.5.2) Updates `sentry-sdk` from 2.66.1 to 2.68.1 - [Release notes](https://github.com/getsentry/sentry-python/releases) - [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-python@2.66.1...2.68.1) Updates `pywebpush` from 2.4.0 to 2.5.0 - [Release notes](https://github.com/web-push-libs/pywebpush/releases) - [Changelog](https://github.com/web-push-libs/pywebpush/blob/main/CHANGELOG.md) - [Commits](https://github.com/web-push-libs/pywebpush/commits) Updates `google-auth` from 2.56.3 to 2.57.1 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-auth-v2.56.3...google-auth-v2.57.1) Updates `ruff` from 0.16.1 to 0.16.6 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.1...0.16.6) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.52.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: sqlalchemy dependency-version: 2.0.52 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: psycopg dependency-version: 3.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: pillow-heif dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: alembic dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: onnxruntime dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: numpy dependency-version: 2.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: sentry-sdk dependency-version: 2.68.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: pywebpush dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: google-auth dependency-version: 2.57.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: ruff dependency-version: 0.16.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: backend-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 7, 2026

Navigation Menu

Uh oh!

chore(deps): bump the backend-dependencies group across 1 directory with 11 updates - #62

chore(deps): bump the backend-dependencies group across 1 directory with 11 updates#62
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-542fbf6645

dependabot Bot commented on behalf of github Sep 7, 2026 •

edited

Loading

Action Needed

Action Needed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version 0.52.4

Fixed

Version 0.52.3

Changed

Version 0.52.2

Fixed

0.52.4 (August 18, 2026)

Fixed

0.52.3 (August 13, 2026)

Changed

0.52.2 (August 13, 2026)

Fixed

2.0.52

platform

orm

psycopg release notes

Current release

v1.6.0

Added

Changed

Fixed

[1.6.0 - 2026-08-31]

Added

Changed

Fixed

1.19.1

bug

ONNX Runtime v1.29.0

Announcements & Breaking Changes

Security Fixes

Path, bounds, and input validation

Supply chain and tooling

New Features

Core APIs & Runtime

Execution Provider ABI & Plugin EPs

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

MoE and quantized GEMM

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

Contributors

2.68.1

enable_logs

Bug Fixes 🐛

2.68.0

Important

Action Needed

2.68.1

enable_logs

Bug Fixes 🐛

2.68.0

Important

Action Needed

2.5.0

2.3.0 (2026-02-09)

2.2.1 (2026-02-06)

2.2.0 (2026-)

2.1.2 (2025-11-10)

2.1.1 (2025-10-14)

2.1.0 (2025-09-29)

2.0.1 (2024-10-14)

2.0.0 (2024-01-02)

google-auth: v2.57.1

2.57.1 (2026-09-03)

Bug Fixes

google-auth: v2.57.0

2.57.0 (2026-08-21)

Features

Bug Fixes

Documentation

0.16.6

Release Notes

Preview features

dependabot Bot commented on behalf of github Sep 7, 2026 •

edited

Loading

`psycopg` release notes

`PyArray_StringDTypeObject` is opaque under the abi3t stable ABI

`enable_logs`

`enable_logs`