chore(deps): bump the production-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #162 · smswithoutborders/RelaySMS-Publisher

dependabot · 2026-06-15T17:24:26Z

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
alembic	`1.13.1`	`1.18.4`
cachetools	`7.1.3`	`7.1.4`
cryptography	`48.0.0`	`49.0.0`
fastapi	`0.136.1`	`0.137.1`
grpcio	`1.80.0`	`1.81.1`
grpcio-testing	`1.80.0`	`1.81.1`
grpcio-tools	`1.80.0`	`1.81.1`
phonenumbers	`9.0.30`	`9.0.32`
pymysql	`1.1.3`	`1.2.0`
sentry-sdk	`2.60.0`	`2.62.0`
sqlalchemy	`2.0.50`	`2.0.51`
tqdm	`4.67.3`	`4.68.2`

Updates alembic from 1.13.1 to 1.18.4

Release notes

Sourced from alembic's releases.

1.18.4

Released: February 10, 2026

bug

[bug] [operations] Reverted the behavior of Operations.add_column() that would automatically render the "PRIMARY KEY" keyword inline when a Column with primary_key=True is added. The automatic behavior, added in version 1.18.2, is now opt-in via the new Operations.add_column.inline_primary_key parameter. This change restores the ability to render a PostgreSQL SERIAL column, which is required to be primary_key=True, while not impacting the ability to render a separate primary key constraint. This also provides consistency with the Operations.add_column.inline_references parameter and gives users explicit control over SQL generation.

To render PRIMARY KEY inline, use the Operations.add_column.inline_primary_key parameter set to True:

op.add_column( "my_table", Column("id", Integer, primary_key=True), inline_primary_key=True )References: #1232

1.18.3

Released: January 29, 2026

bug

[bug] [autogenerate] Fixed regression in version 1.18.0 due to #1771 where autogenerate would raise NoReferencedTableError when a foreign key constraint referenced a table that was not part of the initial table load, including tables filtered out by the EnvironmentContext.configure.include_name callable or tables in remote schemas that were not included in the initial reflection run.

The change in #1771 was a performance optimization that eliminated additional reflection queries for tables that were only referenced by foreign keys but not explicitly included in the main reflection run. However, this optimization inadvertently removed the creation of Table objects for these referenced tables, causing autogenerate to fail when processing foreign key constraints that pointed to them.

The fix creates placeholder Table objects for foreign key targets

... (truncated)

Commits

See full diff in compare view

Updates cachetools from 7.1.3 to 7.1.4

Changelog

Sourced from cachetools's changelog.

v7.1.4 (2026-05-22)

Minor unit test improvements.

Update build environment.

Commits

48284d7 Release v7.1.4.
55ea96b Update build environment.
c5439fe Add threading tests for lock-only decorators.
91828fc Run threading tests unconditionally with timeout.
See full diff in compare view

Updates cryptography from 48.0.0 to 49.0.0

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12


* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table>

... (truncated)

Commits

e300bbe bump version and changelog for 49.0.0 (#15030)
fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
6080dc7 Bump dependencies that dependabot isn't (#15026)
121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
829520b Add more robust processing for DH parameters. (#15016)
0f05001 Bump downstream dependencies in CI (#15025)
Additional commits viewable in compare view

Updates fastapi from 0.136.1 to 0.137.1

Release notes

Sourced from fastapi's releases.

0.137.1

Fixes

🚨 Fix typing checks for APIRoute. PR #15765 by @tiangolo.

🐛 Fix bug, allow empty path in path operation in prefixless router. PR #15763 by @tiangolo.

0.137.0

Breaking Changes

♻️ Refactor internals to preserve APIRouter and APIRoute instances. PR #15745 by @tiangolo.

Unblocks ✨ SO MANY THINGS ✨

Before this, router.include_router(other_router) would take each path operation from other_router and "clone" it, or recreate it from scratch.

This would mean that in the end there was only one top level router, part of the app.

The way it is structured here is that there are a few additional classes to handle intermediate metadata for router and route inclusion. That way the information of "router X includes Y and Y includes Z" is stored somewhere, without affecting (recreating / clonning) the final route.

Non Objectives

Dependencies for 404: previously I intended to support dependencies that would be executed even for 404, but that would conflict with the fact that a router could not find a match, but the next router did find a match. Executing dependencies in the router that did not find a match would not make sense, they could consume the request, body, etc. This original idea was discarded.

Specific Breaking Changes

Now router.routes is no longer a plain list of APIRoute objects, it can contain these intermediate objects that can contain additional routers, forming a tree.

Any logic that depended on iterating on the router.routes directly would be affected, that logic cannot expect to be able to extract data from a plain list of routes, as it's no longer a plain list but a tree.

Additionally, any logic that iterated on router.routes to modify them would now also see these new objects, and would not see all the routes in the app.

router.routes should be considered an internal implementation detail, only passed around to the FastAPI functions that need it.

Features

Adding routes (path operations) after a router is included now works, they are reflected as they are not copied.

Including subrouter in mainrouter can be done before adding routes (path operations) to subrouter, because now the the entire object is stored instead of copying the routes.

As routes are not copied, in some cases that might save some memory.

Alpha Features

This is not documented yet, so it's not officially supported yet and could change in the future.

But, as APIRoute and APIRouter instances are now preserved, they could be customized.

APIRouter has two new methods, .matches() and .handle(), counterpart to the existing ones in APIRoute. With this a router could customize how it matches and handles requests. For example, it could match only requests that include some specific header, for example for handling versions in headers.

Still, for now, consider this very experimental and potentially changing and breaking in the future.

Future Features Enabled

... (truncated)

Commits

a82e5f2 🔖 Release version 0.137.1 (#15766)
edd1461 📝 Update release notes
b78c822 🚨 Fix typing checks for APIRoute (#15765)
e0f8cad 📝 Update release notes
d8aad20 🐛 Fix bug, allow empty path in path operation in prefixless router (#15763)
9a9c4ad 🔖 Release version 0.137.0 (#15748)
c6d5897 📝 Update release notes
31d097f 📝 Update release notes (#15747)
ba609a8 📝 Update release notes
8e1d774 ♻️ Refactor internals to preserve APIRouter and APIRoute instances (#15745)
Additional commits viewable in compare view

Updates grpcio from 1.80.0 to 1.81.1

Release notes

Sourced from grpcio's releases.

Release v1.81.1

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

[EventEngine] Fix a potential use-after-free error on Windows. (#42078)

[ssl] Server side handshaker factory stores a map of key signers. (#42002)

[Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)

[EventEngine] Fix a Windows race that causes an assertion error. (#41563)

[grpc_error] enable error_flatten experiment in OSS. (#41471)

[Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Objective-C

[ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

[Python] Add typing_extensions dep to aio Bazel target. (#42001)

[Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)

[Python] Drop 3.9. (#42145)

[Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)

[Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)

[Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)

[Python] Support observability in AsyncIO stack. (#41573)

Ruby

[Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)

[Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

... (truncated)

Commits

e84a8a2 [Release] Bump version to 1.81.1 (on v1.81.x branch) (#42584)
4706d6a [xDS] fix use-after-free in global XdsClient map (#42559)
42a6b5b [Core][Release] Update BCR presubmit job definition (#42561)
8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
0029e06 Move all gRPC Session classes to the experimental namespace (#42462)
1f18268 [CI] Fix Asan thread_stress_test error by reducing thread count (#42424) (#42...
ee3fed7 Backport MacOS fix cl/917004588 to v1.81.x (#42441)
6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
1108777 [Release] Bump core version to 54.0.0 for upcoming release (#42321)
74940e8 [fix] Add back the do-while loop that handles the TSI_RESULT correctly.
Additional commits viewable in compare view

Updates grpcio-testing from 1.80.0 to 1.81.1

Updates grpcio-tools from 1.80.0 to 1.81.1

Release notes

Sourced from grpcio-tools's releases.

Release v1.81.1

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

[EventEngine] Fix a potential use-after-free error on Windows. (#42078)

[ssl] Server side handshaker factory stores a map of key signers. (#42002)

[Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)

[EventEngine] Fix a Windows race that causes an assertion error. (#41563)

[grpc_error] enable error_flatten experiment in OSS. (#41471)

[Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Objective-C

[ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

[Python] Add typing_extensions dep to aio Bazel target. (#42001)

[Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)

[Python] Drop 3.9. (#42145)

[Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)

[Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)

[Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)

[Python] Support observability in AsyncIO stack. (#41573)

Ruby

[Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)

[Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

... (truncated)

Commits

e84a8a2 [Release] Bump version to 1.81.1 (on v1.81.x branch) (#42584)
8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
820f933 [Python] Drop 3.9 (#42145)
451521c [Core CI] Make windows python distrib tests use ccache. (#42171)
cb09882 [Build] Upgrade protobuf to 33.5 (#41976)
a2bf3f1 [Release] Bump version to 1.81.0-dev (on master branch) (#41843)
See full diff in compare view

Updates phonenumbers from 9.0.30 to 9.0.32

Commits

facd74c Prep for 9.0.32 release
8ea3d6a Generated files for metadata
1d40b76 Merge metadata changes from upstream 9.0.32
43a9c86 Prep for 9.0.31 release
98c625e Generated files for metadata
9161226 Merge metadata changes from upstream 9.0.31
See full diff in compare view

Updates pymysql from 1.1.3 to 1.2.0

Release notes

Sourced from pymysql's releases.

v1.2.0

What's Changed

Bump the all-dependencies group with 2 updates by @dependabot[bot] in PyMySQL/PyMySQL#1232

Reorganize TLS options: implement PREFERRED/REQUIRED SSL mode behavior by @Copilot in PyMySQL/PyMySQL#1234

Support MySQL 8 row/column alias syntax in executemany INSERT regex by @Copilot in PyMySQL/PyMySQL#1235

Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting by @Copilot in PyMySQL/PyMySQL#1236

Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity) by @Copilot in PyMySQL/PyMySQL#1237

docs: update outdated requirements and reference links by @Copilot in PyMySQL/PyMySQL#1239

Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes by @Copilot in PyMySQL/PyMySQL#1238

deprecate db and passwd again by @methane in PyMySQL/PyMySQL#1240

deprecate reconnect in Connection.ping() by @methane in PyMySQL/PyMySQL#1241

Deprecate Connection.set_charset() at runtime and document warning behavior by @Copilot in PyMySQL/PyMySQL#1243

Release v1.2.0 by @methane in PyMySQL/PyMySQL#1244

New Contributors

@Copilot made their first contribution in PyMySQL/PyMySQL#1234

Full Changelog: PyMySQL/PyMySQL@v1.1.3...v1.2.0

Changelog

Sourced from pymysql's changelog.

v1.2.0

Release date: 2026-05-19

Breaking changes

Connection.ping() change the default to not reconnect and deprecate reconnect argument. Create a new connection if you want to reconnect. (#1241)

Error classes in Cursor class are removed. (#1240)

connect() arguments db and passwd now emit DeprecationWarning. Use database and password instead. (#1240)

Reorganize TLS connection behavior.

PyMySQL uses TLS by default when server supports it. Use ssl_disabled=True to prohibit SSL. (#1213)

When ssl_verify_cert=True, ssl_verify_identity=True, an ssl.SSLContext is passed, or when any other SSL option is configured, the connection requires SSL and raises OperationalError (CR_SSL_CONNECTION_ERROR) if the server doesn't support it. (#1234)

Other changes

Support MySQL 8 row/column alias syntax in executemany INSERT regex. (#1235)

Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting. (#1236)

Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity). (#1237)

Connection.set_charset(charset) now emits DeprecationWarning.

Commits

0f1c324 use ubuntu-latest for pypi publishing
53b16b2 Release v1.2.0 (#1244)
637fe7e Deprecate Connection.set_charset() at runtime and document warning behavior...
23ca04a add AGENTS.md
7349a44 deprecate reconnect in Connection.ping() (#1241)
ad5c50c update CHANGELOG
c963edb Deprecation and removals (#1240)
af6b9b4 Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes (#1238)
c7bf73f docs: update outdated requirements and reference links (#1239)
c532b8d Reject non-finite decimal.Decimal query parameters (NaN, sNaN, `±Infini...
Additional commits viewable in compare view

Updates sentry-sdk from 2.60.0 to 2.62.0

Release notes

Sourced from sentry-sdk's releases.

2.62.0

New Features ✨
Add integration for aiomysql by @tonal in #4703

We're adding support for the aiomysql package. To enable the integration, add it to your integrations list:
import sentry_sdk
from sentry_sdk.integrations.aiomysql import AioMySQLIntegration
sentry_sdk.init(
traces_sample_rate=1.0,
integrations=[AioMySQLIntegration()],
)
Support HTTPX2 by @sentrivana in #6463

We're adding out-of-the-box support for HTTPX2. As long as use the package, the Sentry integration will be enabled automatically and you should see your requests instrumented in Sentry.
import httpx2
import sentry_sdk
sentry_sdk.init(...)
with sentry_sdk.start_transaction(name="testing_sentry"):
httpx2.get("https://sentry.io/")
Bug Fixes 🐛

(arq) Never capture control flow exceptions by @alexander-alderman-webb in #6507

(client) Guard against dotless qualified_name in _setup_instrumentation by @devteamaegis in #6452

(pydantic-ai) Only use hooks when ModelRequestContext.model exists by @alexander-alderman-webb in #6480

(rq) Restore functools.wraps() for patched functions by @alexander-alderman-webb in #6532

(tracing_utils) Handle baggage values containing '=' in from_incoming_header by @devteamaegis in #6450

(utils) Handle image_url string shorthand in _is_image_type_with_blob_content by @devteamaegis in #6478

Internal Changes 🔧

(arq) Only pin fakeredis<2.36.0 in tests by @alexander-alderman-webb in #6444

(flaky) Change env for flaky test detector by @sl0thentr0py in #6492

(pydantic-ai) Create event loop before invoking sync methods by @alexander-alderman-webb in #6475

Use package-ecosystem: uv in dependabot by @sentrivana in #6522

🤖 Update test matrix with new releases (06/08) by @github-actions in #6519

Raise minimum supported aiomysql version and update text matrix by @alexander-alderman-webb in #6496

Deprecate OpenTelemetryIntegration in favor of OTLPIntegration and no-op for span first by @sl0thentr0py in #6494

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.62.0

New Features ✨
Add integration for aiomysql by @tonal in #4703

We're adding support for the aiomysql package. To enable the integration, add it to your integrations list:
import sentry_sdk
from sentry_sdk.integrations.aiomysql import AioMySQLIntegration
sentry_sdk.init(
traces_sample_rate=1.0,
integrations=[AioMySQLIntegration()],
)
Support HTTPX2 by @sentrivana in #6463

We're adding out-of-the-box support for HTTPX2. As long as use the package, the Sentry integration will be enabled automatically and you should see your requests instrumented in Sentry.
import httpx2
import sentry_sdk
sentry_sdk.init(...)
with sentry_sdk.start_transaction(name="testing_sentry"):
httpx2.get("https://sentry.io/")
Bug Fixes 🐛

(arq) Never capture control flow exceptions by @alexander-alderman-webb in #6507

(client) Guard against dotless qualified_name in _setup_instrumentation by @devteamaegis in #6452

(pydantic-ai) Only use hooks when ModelRequestContext.model exists by @alexander-alderman-webb in #6480

(rq) Restore functools.wraps() for patched functions by @alexander-alderman-webb in #6532

(tracing_utils) Handle baggage values containing '=' in from_incoming_header by @devteamaegis in #6450

(utils) Handle image_url string shorthand in _is_image_type_with_blob_content by @devteamaegis in #6478

Internal Changes 🔧

(arq) Only pin fakeredis<2.36.0 in tests by @alexander-alderman-webb in #6444

(flaky) Change env for flaky test detector by @sl0thentr0py in #6492

(pydantic-ai) Create event loop before invoking sync methods by @alexander-alderman-webb in #6475

Use package-ecosystem: uv in dependabot by @sentrivana in #6522

🤖 Update test matrix with new releases (06/08) by @github-actions in #6519

Raise minimum supported aiomysql version and update text matrix by @alexander-alderman-webb in #6496

... (truncated)

Commits

0bac65a Update CHANGELOG.md
4a53c10 release: 2.62.0
afff0e2 fix(rq): Restore functools.wraps() for patched functions (#6532)
33ca589 build(deps-dev): bump openfeature-sdk from 0.9.0 to 0.10.0 (#6528)
4fdd8e0 build(deps): bump pip from 26.1.1 to 26.1.2 (#6530)
b466c27 build(deps-dev): bump httpx2 from 2.2.0 to 2.3.0 (#6523)
0be028f build(deps-dev): bump typer from 0.26.2 to 0.26.7 (#6526)
344c013 build(deps-dev): bump ruff from 0.15.14 to 0.15.16 (#6529)
7d38a49 ci: Use package-ecosystem: uv in dependabot (#6522)
8c50017 build(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml fro...
Additional commits viewable in compare view

Updates sqlalchemy from 2.0.50 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

[orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

References: #13207

[orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

References: #13356

engine

[engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

References: #9427

sql

[sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

References: #10827

... (truncated)

Commits

See full diff in compare view

Updates tqdm from 4.67.3 to 4.68.2

Release notes

Sourced from tqdm's releases.

tqdm v4.68.2 stable

revert accidental change to ascii default (fixes #1760)

UnicodeEncodeError: 'charmap' codec can't encode characters in position 6-7: character maps to <undefined> can be fixed by installing tqdm!=4.68.0,!=4.68.1

misc docs updates

fix links

replace stray rst -> md syntax

consistent "progress bar" terminology (#1737)

tests: fix coverage (fixes #1760)

tqdm v4.68.1 stable

set name of monitor thread (#1669, #1752 <- #1435)

fix monitor thread atexit deadlock (#1751 <- #528, #627, #1435, #1564)

docs: minor copyediting

tqdm v4.68.0 stable

utils: simplify terminal size detection (#1760)

contrib

itertools (#1760)

add chain, permutations, combinations, combinations_with_replacement, batched

add product(repeat=1) keyword argument (#1428)

fix discord, telegram error handling

fix discord, slack, telegram format for total=None

soft-deprecate tqdm.utils.envwrap -> envwrap

benchmarks: fix asv

misc linting

misc framework updates

CI: migrate manual job to pre-commit.ci

bump workflow actions & pre-commit hooks

Commits

4b33952 revert accidental change to tqdm(ascii) default
b10848f docs: fix links
85b62dd docs: replace stray rst -> md
d2fb04a docs: mention OpenAI sponsorship
85940f9 docs: consistent progress bar terminology
9dbb36b tests: fix coverage
67cf355 Merge pull request #1751 from jaltmayerpizzorno/fix-atexit-monitor-deadlock
cfa4a85 minor docstring updates
f83290c Fix TMonitor deadlock at interpreter shutdown
59029c3 Set name for tqdm monitor thread (#1752)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 12 updates Bumps the production-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [alembic](https://github.com/sqlalchemy/alembic) | `1.13.1` | `1.18.4` | | [cachetools](https://github.com/tkem/cachetools) | `7.1.3` | `7.1.4` | | [cryptography](https://github.com/pyca/cryptography) | `48.0.0` | `49.0.0` | | [fastapi](https://github.com/fastapi/fastapi) | `0.136.1` | `0.137.1` | | [grpcio](https://github.com/grpc/grpc) | `1.80.0` | `1.81.1` | | [grpcio-testing](https://grpc.io) | `1.80.0` | `1.81.1` | | [grpcio-tools](https://github.com/grpc/grpc) | `1.80.0` | `1.81.1` | | [phonenumbers](https://github.com/daviddrysdale/python-phonenumbers) | `9.0.30` | `9.0.32` | | [pymysql](https://github.com/PyMySQL/PyMySQL) | `1.1.3` | `1.2.0` | | [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.60.0` | `2.62.0` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.50` | `2.0.51` | | [tqdm](https://github.com/tqdm/tqdm) | `4.67.3` | `4.68.2` | Updates `alembic` from 1.13.1 to 1.18.4 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `cachetools` from 7.1.3 to 7.1.4 - [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst) - [Commits](tkem/cachetools@v7.1.3...v7.1.4) Updates `cryptography` from 48.0.0 to 49.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...49.0.0) Updates `fastapi` from 0.136.1 to 0.137.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.136.1...0.137.1) Updates `grpcio` from 1.80.0 to 1.81.1 - [Release notes](https://github.com/grpc/grpc/releases) - [Commits](grpc/grpc@v1.80.0...v1.81.1) Updates `grpcio-testing` from 1.80.0 to 1.81.1 Updates `grpcio-tools` from 1.80.0 to 1.81.1 - [Release notes](https://github.com/grpc/grpc/releases) - [Commits](grpc/grpc@v1.80.0...v1.81.1) Updates `phonenumbers` from 9.0.30 to 9.0.32 - [Commits](daviddrysdale/python-phonenumbers@v9.0.30...v9.0.32) Updates `pymysql` from 1.1.3 to 1.2.0 - [Release notes](https://github.com/PyMySQL/PyMySQL/releases) - [Changelog](https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md) - [Commits](PyMySQL/PyMySQL@v1.1.3...v1.2.0) Updates `sentry-sdk` from 2.60.0 to 2.62.0 - [Release notes](https://github.com/getsentry/sentry-python/releases) - [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-python@2.60.0...2.62.0) Updates `sqlalchemy` from 2.0.50 to 2.0.51 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `tqdm` from 4.67.3 to 4.68.2 - [Release notes](https://github.com/tqdm/tqdm/releases) - [Commits](tqdm/tqdm@v4.67.3...v4.68.2) --- updated-dependencies: - dependency-name: alembic dependency-version: 1.18.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: cachetools dependency-version: 7.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: cryptography dependency-version: 49.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: fastapi dependency-version: 0.137.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: grpcio dependency-version: 1.81.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: grpcio-testing dependency-version: 1.81.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: grpcio-tools dependency-version: 1.81.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: phonenumbers dependency-version: 9.0.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pymysql dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: sentry-sdk dependency-version: 2.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: sqlalchemy dependency-version: 2.0.51 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: tqdm dependency-version: 4.68.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the production-dependencies group across 1 directory with 12 updates#162

chore(deps): bump the production-dependencies group across 1 directory with 12 updates#162
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/pip/staging/production-dependencies-d9442c8faa

dependabot Bot commented on behalf of github Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 15, 2026

1.18.4

bug

1.18.3

bug

v7.1.4 (2026-05-22)

0.137.1

Fixes

0.137.0

Breaking Changes

Non Objectives

Specific Breaking Changes

Features

Alpha Features

Future Features Enabled

Release v1.81.1

Core

Objective-C

Python

Ruby

Release v1.81.0

Core

Release v1.81.1

Core

Objective-C

Python

Ruby

Release v1.81.0

Core

v1.2.0

What's Changed

New Contributors

v1.2.0

Breaking changes

Other changes

2.62.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

2.62.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

2.0.51

orm

engine

sql

tqdm v4.68.2 stable

tqdm v4.68.1 stable

tqdm v4.68.0 stable

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants