Skip to content

build(deps): bump the minor-and-patch group with 5 updates - #80

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/minor-and-patch-1787864f37
Oct 24, 2026
Merged

build(deps): bump the minor-and-patch group with 5 updates#80
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/minor-and-patch-1787864f37

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 5 updates:

Package From To
fastapi 0.143.0 0.156.4
authlib 1.8.0 1.9.1
pydantic-settings 2.15.0 2.16.1
starlette 1.8.0 1.9.0
fastmcp 4.1.1 4.1.3

Updates fastapi from 0.143.0 to 0.156.4

Release notes

Sourced from fastapi's releases.

0.156.4

Fixes

0.156.3

Fixes

  • 🐛 Fix AliasChoices for query parameters, headers, and cookies. PR #16555 by @​tiangolo.

0.156.2

Fixes

  • 🐛 Preserve Pydantic field metadata in inferred request parameters. PR #16553 by @​tiangolo.

0.156.1

Fixes

  • 🐛 Preserve Pydantic field metadata when request options are omitted. PR #16549 by @​tiangolo.

0.156.0

Fixes

  • 🐛 Preserve Pydantic Field() attributes in request parameters. PR #16547 by @​tiangolo.

0.155.0

The deprecated **extra keyword arguments have been removed from Path, Query, Header, Cookie, Body, Form, and File. Unknown keyword arguments now raise TypeError. For additional JSON Schema properties, replace, for example, Query(custom="value") with Query(json_schema_extra={"custom": "value"}).

Breaking Changes

0.154.0

Features

0.153.0

Unions of form models now apply the same browser form handling as individual models. Empty scalar fields use defaults or produce missing-field errors, empty list items are preserved, omitted boolean fields become False, and unselected files are treated as missing. JSON request bodies are unchanged.

Fixes

  • 🐛 Apply browser form handling to unions of Pydantic models. PR #16540 by @​tiangolo.

0.152.0

Validation errors for header parameter models now report the HTTP header name, such as int-val, instead of the Python field name, int_val. Explicit aliases, Header(convert_underscores=False), and Pydantic models with loc_by_alias=False keep their existing behavior.

Fixes

... (truncated)

Commits

Updates authlib from 1.8.0 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

Commits
  • 46b9487 chore: release 1.9.1
  • abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
  • 1bd2a31 Merge commit from fork
  • 311da11 docs: more detailed PKCE instructions
  • 873f72c docs: rpinitiated instructions
  • 4ff30db Merge commit from fork
  • 9a86ff3 docs: rpinitiated sequence chart
  • 1c35757 docs: RFC 9101 sequence chart
  • a755e28 docs: add a sequence diagram to the token introspection page
  • 1996c56 docs: PKCE flow chart illustration
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

  • Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
  • A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
  • f651a7a Keep list of dicts CLI values as lists (#1049)
  • ecf7d90 Harden CI (#1044)
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • Additional commits viewable in compare view

Updates starlette from 1.8.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.
Commits
  • 1840c9d Version 1.9.0 (#3676)
  • 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
  • 414af4f Remove unmaintained packages from the third-party packages page (#3674)
  • d4df01a Add adminsite to the third-party packages (#3654)
  • 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
  • a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
  • 6b11cd7 Honor streaming responses in TestClient (#3491)
  • b7901fb Use byte length for typed memoryview response bodies (#3622)
  • 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
  • See full diff in compare view

Updates fastmcp from 4.1.1 to 4.1.3

Release notes

Sourced from fastmcp's releases.

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

What's Changed

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in PrefectHQ/fastmcp#5945.

Enhancements ✨

Fixes 🐞

Documentation 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

Enhancements ✨

Fixes 🐞

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in #5945.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

Security 🔒

Enhancements ✨

... (truncated)

Commits
  • aa13708 docs: add v4.1.3 changelog entries (#5948)
  • ec1a8e0 fix: require patched certifi trust stores (#5945)
  • bfe314f Preserve tool-body timeout errors (#5940)
  • 8f0d481 Honor per-server MCP config timeouts (#5758)
  • b918dd9 fix(tools): materialize generator transform_fn results in TransformedTool.run...
  • 0b1a6ba test(mount): make unreachable proxy failures deterministic (#5584)
  • 5910eb2 fix: preserve empty session visibility selections (#5944)
  • ceb465a Default upstream token auth method to none without a client secret (#5879)
  • 75ee327 Chart public backlog counts and closure outcomes (#5942)
  • 0f4674e docs: add v4.1.2 changelog entries (#5936)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group with 5 updates
14ba5e6 
Bumps the minor-and-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.143.0` | `0.156.4` |
| [authlib](https://github.com/authlib/authlib) | `1.8.0` | `1.9.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.1` |
| [starlette](https://github.com/Kludex/starlette) | `1.8.0` | `1.9.0` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `4.1.1` | `4.1.3` |


Updates `fastapi` from 0.143.0 to 0.156.4
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.143.0...0.156.4)

Updates `authlib` from 1.8.0 to 1.9.1
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.8.0...v1.9.1)

Updates `pydantic-settings` from 2.15.0 to 2.16.1
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.1)

Updates `starlette` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.8.0...1.9.0)

Updates `fastmcp` from 4.1.1 to 4.1.3
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v4.1.1...v4.1.3)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.156.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pydantic-settings
  dependency-version: 2.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: starlette
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: fastmcp
  dependency-version: 4.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 24, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) October 24, 2026 00:46
@github-actions
github-actions Bot merged commit 7b9d351 into main Oct 24, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/minor-and-patch-1787864f37 branch October 24, 2026 00:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants