chore(deps): Bump the python group with 5 updates

[dependabot]

Updates the requirements on httpx, sqlalchemy, fastapi, uvicorn and anthropic to permit the latest version.
Updates httpx to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

0.27.2 (27th August, 2024)

Fixed

• Reintroduced supposedly-private URLTypes shortcut. (#2673)

0.27.1 (27th August, 2024)

Added

• Support for zstd content decoding using the python zstandard package is added. Installable using httpx[zstd]. (#3139)

Fixed

• Improved error messaging for InvalidURL exceptions. (#3250)
• Fix app type signature in ASGITransport. (#3109)

0.27.0 (21st February, 2024)

... (truncated)

Commits

• 26d48e0 Version 0.28.1 (#3445)
• 89599a9 Fix verify=False, cert=... case. (#3442)
• 8ecb86f Add test for request params behavior changes (#3364) (#3440)
• 0cb7e5a Bump the python-packages group with 11 updates (#3434)
• 15e21e9 Updating deprecated docstring Client() class (#3426)
• 80960fa Version 0.28.0. (#3419)
• a33c878 Fix extensions type annotation. (#3380)
• ce7e14d Error on verify as str. (#3418)
• 47f4a96 Handle empty zstd responses (#3412)
• 189fc4b Update CHANGELOG.md, fix typo(s) (#3406)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates fastapi to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

... (truncated)

Commits

• 8988c23 Stabilize macOS Python 3.13 signal shutdown tests (#3084)
• 898ddca Update PyPI publish action to version 1.14.2 (#3083)
• 3869f8a Restore Mermaid diagram rendering (#3080)
• 64148a9 Version 0.52.4 (#3079)
• 9e9e569 docs: correct release example PR number (#3072)
• b783dac Remove duplicate Date header from SansIO WebSocket handshakes (#3078)
• 27019b2 chore(deps): bump the python-packages group across 1 directory with 11 update...
• 1b64273 Fix a typo in index.md (#3006)
• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• Additional commits viewable in compare view

Updates anthropic to 1.2.0

Release notes

Sourced from anthropic's releases.

v1.2.0

1.2.0 (2026-08-27)

Full Changelog: v1.1.0...v1.2.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (9df4565)

Bug Fixes

• aws,bedrock: sign raw request bytes so binary file uploads work (#531) (f50e910)
• ci: resolve assignment aliases in detect-breaking-changes (f2c4925)
• sessions: make event accumulator forward-compatible with new event types (#533) (cbbaf6e)
• tools: let read return a view_range of a file over the size cap (#538) (b68e876)
• tools: preserve exact file bytes in the agent toolset and memory tool (no newline translation) (#540) (56921a8)
• webhooks: require headers to be passed to unwrap() (0baa902)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (1832b27)

Changelog

Sourced from anthropic's changelog.

1.2.0 (2026-08-27)

Full Changelog: v1.1.0...v1.2.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (9df4565)

  The beta Files and Skills namespaces (client.beta.files, client.beta.skills) no longer send the files-api-2025-04-14 / skills-2025-10-02 headers and return the same shapes as client.files / client.skills (with Beta-prefixed type names under anthropic.types.beta). Requests that still send those headers on raw HTTP keep receiving the beta shapes.

  Changes in the beta namespaces:

  • client.beta.skills.delete() now deletes a Skill together with all of its versions (previously refused while any version existed). It returns BetaDeletedSkill (was SkillDeleteResponse).
  • Beta Messages type BetaSkill (container skill reference with skill_id, type, version) is renamed BetaContainerSkill; the request-side BetaSkillParams keeps its name. BetaSkill now names the Skill object returned by client.beta.skills.create() / retrieve() / list() (replacing SkillCreateResponse / SkillRetrieveResponse / SkillListResponse), and skill versions are BetaSkillVersion / BetaDeletedSkillVersion (replacing Version*Response).
  • client.beta.files.list() returns SyncPageCursor[BetaFileMetadata] / AsyncPageCursor[BetaFileMetadata] (with data / next_page) and paginates with page= / ids= (was SyncPage / AsyncPage with data, has_more, first_id, last_id and before_id= / after_id=); iterating the result for auto-pagination is unchanged. BetaSkill uses display_name (was display_title, also the create() keyword) and latest_version_id (was latest_version), and BetaSkillVersion is addressed by its skver_… id (the Unix-timestamp version field is gone).

  Migration guides: Migrate from files-api-2025-04-14 · Migrate from skills-2025-10-02

Bug Fixes

• aws,bedrock: sign raw request bytes so binary file uploads work (#531) (f50e910)
• ci: resolve assignment aliases in detect-breaking-changes (f2c4925)
• sessions: make event accumulator forward-compatible with new event types (#533) (cbbaf6e)
• tools: let read return a view_range of a file over the size cap (#538) (b68e876)
• tools: preserve exact file bytes in the agent toolset and memory tool (no newline translation) (#540) (56921a8)
• webhooks: require headers to be passed to unwrap() (0baa902)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (1832b27)

1.1.0 (2026-08-26)

Full Changelog: v1.0.0...v1.1.0

Features

• api: add updates thinking display mode (beta) (eb4a73f)
• api: add missing anthropic-beta values (dbebd15)
• api: add support for Organization API endpoints (5a5b8fc)

Bug Fixes

• docs: correct link for long requests error (#1884) (4474f31), closes #1883
• tools: keep the tool runner going on pause_turn (#343) (ab1ec60)

Chores

... (truncated)

Commits

• 071efb6 release: 1.2.0
• 6d48fd0 docs(api): clarify pagination on the organization rate-limit list endpoints
• 2f564a2 fix(tools): let read return a view_range of a file over the size cap (#538)
• dffb22d fix(tools): preserve exact file bytes in the agent toolset and memory tool (n...
• 932ab4b fix(ci): resolve assignment aliases in detect-breaking-changes
• e541b4d feat(api): beta files/skills namespaces use GA shapes; drop dated beta header...
• 0c1a85a fix(sessions): make event accumulator forward-compatible with new event types...
• 39a670c fix(webhooks): require headers to be passed to unwrap()
• 05532bc fix(aws,bedrock): sign raw request bytes so binary file uploads work (#531)
• 181e2e5 release: 1.1.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions