Skip to content

Bump the python group with 3 updates - #14

Merged
nathanvvong merged 1 commit into
mainfrom
dependabot/uv/python-0040da2e2a
Oct 22, 2026
Merged

Bump the python group with 3 updates#14
nathanvvong merged 1 commit into
mainfrom
dependabot/uv/python-0040da2e2a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 3 updates: httpx2, fastapi and ruff.

Updates httpx2 from 2.13.1 to 2.14.0

Release notes

Sourced from httpx2's releases.

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#1217), and writing after a peer closes TLS without close_notify raises WriteError (#1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#1233).

httpx2

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#1165).
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#1267).

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#1165).

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#1267).
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#1130).
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#1233).
  • Stop the sync WebSocket session from hanging on exit when its event queue is full (#1123).

httpcore2

Fixed

  • Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#1262).
  • Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#1217).
  • Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

Changelog

Sourced from httpx2's changelog.

2.14.0 (October 18th, 2026)

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
  • Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)
Commits
  • 4fa853a Prepare version 2.14.0 (#1271)
  • dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
  • cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
  • 53c11c4 Interrupt blocked queue puts during sync WebSocket teardown (#1123)
  • d989385 Support FIPS-enforced Python builds without hashlib.md5 in DigestAuth (#1...
  • 76d02ee Handle reads during ASGI WebSocket shutdown (#1233)
  • See full diff in compare view

Updates fastapi from 0.143.0 to 0.148.0

Release notes

Sourced from fastapi's releases.

0.148.0

Defaults for omitted Query, Header, Cookie, and Form parameters and model fields are no longer treated as user input. Defaults are not validated unless validate_default=True is enabled. If you rely on validators running for omitted values, enable default validation with Field(validate_default=True) for model fields or, for example, Query(validate_default=True) for individual parameters. Body(validate_default=True) is now honored too.

For parameter models, applying a default no longer marks a field as explicitly set, so model_dump(exclude_unset=True) excludes it. Default factories run once, and validation errors no longer include injected defaults in input.

Omitted boolean form fields still become False and count as explicitly set.

Breaking Changes

0.147.0

Omitted bool and bool | None form fields are now interpreted as False, matching unchecked HTML checkboxes. This applies to individual Form parameters and form models, including required fields and fields with defaults of True or None. The inferred value is considered explicitly set, including in model_dump(exclude_unset=True).

JSON requests and direct Pydantic validation are unchanged. See Boolean Form Fields.

Breaking Changes

Internal

  • ✅ Add tests for parameter defaults, nullability, and browser form behavior. PR #14829 by @​YuriiMotov.

0.146.0

The root_path parameter in FastAPI() is deprecated. Configure the server with fastapi run --root-path /api/v1 instead.

Breaking Changes

0.145.0

Breaking Changes

  • 🔥 Remove deprecated openapi_prefix and unused **extra from FastAPI. PR #16518 by @​tiangolo.

Docs

0.144.0

Features

0.143.5

Fixes

  • 🐛 Fix handling of empty value for byte file list parameter. PR #9383 by @​Viicos.

... (truncated)

Commits

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python group with 3 updates
b19f9af 
Bumps the python group with 3 updates: [httpx2](https://github.com/pydantic/httpx2), [fastapi](https://github.com/fastapi/fastapi) and [ruff](https://github.com/astral-sh/ruff).


Updates `httpx2` from 2.13.1 to 2.14.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.13.1...v2.14.0)

Updates `fastapi` from 0.143.0 to 0.148.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.143.0...0.148.0)

Updates `ruff` from 0.17.0 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.1)

---
updated-dependencies:
- dependency-name: httpx2
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: fastapi
  dependency-version: 0.148.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 22, 2026
@nathanvvong
nathanvvong merged commit 17a5480 into main Oct 22, 2026
4 checks passed
@nathanvvong
nathanvvong deleted the dependabot/uv/python-0040da2e2a branch October 22, 2026 16:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nathanvvong nathanvvong nathanvvong approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nathanvvong