Bump the python-deps group across 1 directory with 4 updates

[dependabot]

Updates the requirements on uvicorn, sqlalchemy, asyncmy and python-dotenv to permit the latest version.
Updates uvicorn to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

... (truncated)

Commits

• 8988c23 Stabilize macOS Python 3.13 signal shutdown tests (#3084)
• 898ddca Update PyPI publish action to version 1.14.2 (#3083)
• 3869f8a Restore Mermaid diagram rendering (#3080)
• 64148a9 Version 0.52.4 (#3079)
• 9e9e569 docs: correct release example PR number (#3072)
• b783dac Remove duplicate Date header from SansIO WebSocket handshakes (#3078)
• 27019b2 chore(deps): bump the python-packages group across 1 directory with 11 update...
• 1b64273 Fix a typo in index.md (#3006)
• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates asyncmy to 0.2.14

Release notes

Sourced from asyncmy's releases.

v0.2.14

• Set the PEP 249 module globals apilevel, threadsafety and paramstyle, and export the exception classes from asyncmy (#77).
• Expose the server's SQLSTATE on exceptions as MySQLError.sqlstate; args is unchanged (#138).
• Fix ssl=True silently connecting in plaintext: it now builds a default TLS context, and an ssl argument that is neither True, a dict, nor an ssl.SSLContext raises ValueError instead of disabling TLS (#90).
• Connection.cursor() is now awaitable, so aiomysql's cur = await conn.cursor() spelling works; conn.cursor() and async with conn.cursor() are unaffected (#145).
• Add Gtid.__hash__ / GtidSet.__hash__ — defining __eq__ had made Gtid unhashable, which made GtidSet (and therefore GTID replication) unusable (#59).
• Declare the Cython modules free-threading compatible. Without this, importing asyncmy re-enables the GIL for the whole process on a free-threaded build. Module-level state is built during import and read-only afterwards; this does not make a single Connection/Cursor safe to share between threads. Requires Cython 3.1+, and CI now runs the suite on 3.14t. Thanks @​honglei (#151).
• Read the version from the installed package metadata instead of repeating it in asyncmy/version.py, so pyproject.toml is the single source and the _client_version the server sees cannot drift. Thanks @​waketzheng (#149).
• Ship type information (PEP 561): py.typed plus .pyi stubs for the Cython modules, so mypy and Pylance see real signatures instead of nothing. make stubs regenerates them and make check runs stubtest, which fails on any drift from the compiled modules (#78).
• Add connect(password_creator=...): a callable consulted before every connection attempt, including the ones a pool makes when it recycles or reconnects, so short-lived credentials such as AWS RDS IAM tokens can be refreshed. May return an awaitable. Thanks @​DolevGabay (#139).
• Fix ping(reconnect=True) never actually reconnecting: _connected stayed set when the ping failed, so connect() returned early and the follow-up ping ran on the dead connection.
• Add connect(query_callback=...), called as callback(cursor, query, elapsed_ms) after every statement. Lets statement logging go somewhere other than echo's hardcoded INFO line — a slow-query log, a tracing span, a different level. executemany/callproc report once per call. Independent of echo, which is unchanged (#81, #69).
• Add connect(sock=...): speak MySQL over a socket the caller has already connected. Combined with ssl the TLS handshake runs before the MySQL handshake instead of being negotiated in-protocol, which is what connectors fronting the server with a TLS proxy need (#71).
• Mark the connection secure after the TLS handshake. _secure was only set for unix sockets, so caching_sha2_password full authentication over TLS took the RSA branch instead of sending the password in the clear, and the server rejected it with 1045 Access denied (#117).

Changelog

Sourced from asyncmy's changelog.

0.2.14

• Set the PEP 249 module globals apilevel, threadsafety and paramstyle, and export the exception classes from asyncmy (#77).
• Expose the server's SQLSTATE on exceptions as MySQLError.sqlstate; args is unchanged (#138).
• Fix ssl=True silently connecting in plaintext: it now builds a default TLS context, and an ssl argument that is neither True, a dict, nor an ssl.SSLContext raises ValueError instead of disabling TLS (#90).
• Connection.cursor() is now awaitable, so aiomysql's cur = await conn.cursor() spelling works; conn.cursor() and async with conn.cursor() are unaffected (#145).
• Add Gtid.__hash__ / GtidSet.__hash__ — defining __eq__ had made Gtid unhashable, which made GtidSet (and therefore GTID replication) unusable (#59).
• Declare the Cython modules free-threading compatible. Without this, importing asyncmy re-enables the GIL for the whole process on a free-threaded build. Module-level state is built during import and read-only afterwards; this does not make a single Connection/Cursor safe to share between threads. Requires Cython 3.1+, and CI now runs the suite on 3.14t. Thanks @​honglei (#151).
• Read the version from the installed package metadata instead of repeating it in asyncmy/version.py, so pyproject.toml is the single source and the _client_version the server sees cannot drift. Thanks @​waketzheng (#149).
• Ship type information (PEP 561): py.typed plus .pyi stubs for the Cython modules, so mypy and Pylance see real signatures instead of nothing. make stubs regenerates them and make check runs stubtest, which fails on any drift from the compiled modules (#78).
• Add connect(password_creator=...): a callable consulted before every connection attempt, including the ones a pool makes when it recycles or reconnects, so short-lived credentials such as AWS RDS IAM tokens can be refreshed. May return an awaitable. Thanks @​DolevGabay (#139).
• Fix ping(reconnect=True) never actually reconnecting: _connected stayed set when the ping failed, so connect() returned early and the follow-up ping ran on the dead connection.
• Add connect(query_callback=...), called as callback(cursor, query, elapsed_ms) after every statement. Lets statement logging go somewhere other than echo's hardcoded INFO line — a slow-query log, a tracing span, a different level. executemany/callproc report once per call. Independent of echo, which is unchanged (#81, #69).
• Add connect(sock=...): speak MySQL over a socket the caller has already connected. Combined with ssl the TLS handshake runs before the MySQL handshake instead of being negotiated in-protocol, which is what connectors fronting the server with a TLS proxy need (#71).
• Mark the connection secure after the TLS handshake. _secure was only set for unix sockets, so caching_sha2_password full authentication over TLS took the RSA branch instead of sending the password in the clear, and the server rejected it with 1045 Access denied (#117).

0.2.13

• Add server-side prepared statements (binary protocol): stmt = await conn.prepare(sql), await stmt.execute(args). Parameters are sent in binary form (no client-side escaping) and results are parsed from the binary protocol — no text parsing for numeric/temporal columns. Large scans are ~35% faster than the text protocol; on the cross-language benchmark asyncmy's binary scan is now the fastest, ahead of go-sql-driver and mysql_async.
• Add transparent statement cache: connect(stmt_cache_size=N) makes plain cursor.execute("... %s ...", args) run as cached server-side prepared statements (binary protocol) with silent text-protocol fallback for unpreparable queries. Opt-in because FLOAT columns return the exact stored value under the binary protocol.

... (truncated)

Commits

• 11fb891 chore: bump version to 0.2.14
• 6cf4fc6 feat: declare Cython modules free-threading compatible
• 74ce861 fix: single-source the version from package metadata
• 534eedb feat: ship type information (PEP 561)
• 64bfe94 Merge pull request #140 from DolevGabay: password_creator
• d3d75c0 feat: query_callback for statement logging
• 5308b87 feat: connect(sock=...) and fix caching_sha2 full auth over TLS
• 8d2045e ci: run lint once and cut redundant matrix runs
• df4501e feat: PEP 249 globals, error SQLSTATE, awaitable cursor
• 3ab31b8 fix: refresh dynamic password on ping reconnect
• Additional commits viewable in compare view

Updates python-dotenv to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

[1.2.2] - 2026-03-01

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

• The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Dropped Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

[1.2.1] - 2025-10-26

• Move more config to pyproject.toml, removed setup.cfg
• Add support for reading .env from FIFOs (Unix) by [@​sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

... (truncated)

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

[alo-is]

@dependabot rebase