deps(python): bump the python group in /backend with 10 updates

DE
13h ago
+352-332

Bumps the python group in /backend with 10 updates:

PackageFromTo
aiohttp3.14.43.14.5
fastapi0.143.00.143.2
multidict6.9.17.1.0
pymongo4.18.34.19.0
starlette1.7.01.8.0
wrapt2.5.02.5.1
pluggy1.6.01.7.0
pytest-env1.7.11.8.0
ruff0.17.00.17.1
pipdeptree4.2.64.2.8

Updates aiohttp from 3.14.4 to 3.14.5
Updates fastapi from 0.143.0 to 0.143.2

Release notes

Sourced from fastapi's releases.

0.143.2

Fixes

Translations

Internal

0.143.1

Fixes

Commits

Updates multidict from 6.9.1 to 7.1.0

Release notes

Sourced from multidict's releases.

7.1.0 is a correctness and housekeeping release. It changes what keys() yields, fixes a long list of crashes and inconsistencies that Python code run in the middle of an operation could trigger, stores the common all-str multidicts in half the space, and deprecates multidict.upstr.

Behaviour changes. keys() and iteration over a multidict yield each key once, as spelled in its first item, so len(d.keys()) counts distinct keys; items(), values() and len(d) still see every item. A str subclass's own lower() is no longer called to compute the case-insensitive identity of a CIMultiDict key.

Robustness. Finalizers, __eq__(), __repr__(), lower() and argument iterators that read or mutate the multidict in the middle of __init__(), update(), merge(), del d[key], popall(), popitem(), to_dict() or repr() no longer crash the C extension, lose or duplicate pairs, or make the two backends disagree. Two data races against lock-free readers on the free-threaded build are gone too.

Memory. A MultiDict whose keys are all exact str, and a CIMultiDict whose keys are all exact istr, are stored in a compact table without a separate identity and hash per entry, which cuts their size by about 45%.

Bug fixes

  • Fixed building the C extension on platforms where char is unsigned, such as ARM, PowerPC, s390x and RISC-V, and with GCC 9, which flags CPython's own headers from 3.12 on; both failed on a sign conversion warning since -Wconversion took effect. GCC 9 builds the extension without -Wconversion -- by @​asvetlov.

    Related issues and pull requests on GitHub: #1759, #1760.

  • Fixed getversion() returning only the low 32 bits of the version on Windows and on 32-bit platforms, where two different versions could compare equal, and fixed a race in the pure-Python implementation on GIL builds that could give two multidicts mutated at the same time from different threads the same version -- by @​asvetlov.

    Related issues and pull requests on GitHub: #1607, #1610.

... (truncated)

Changelog

Sourced from multidict's changelog.

7.1.0

(2026-10-08)

7.1.0 is a correctness and housekeeping release. It changes what :meth:~multidict.MultiDict.keys yields, fixes a long list of crashes and inconsistencies that Python code run in the middle of an operation could trigger, stores the common all-:class:str multidicts in half the space, and deprecates multidict.upstr.

Behaviour changes. :meth:~multidict.MultiDict.keys and iteration over a multidict yield each key once, as spelled in its first item, so len(d.keys()) counts distinct keys; :meth:~multidict.MultiDict.items, :meth:~multidict.MultiDict.values and len(d) still see every item. A :class:str subclass's own lower() is no longer called to compute the case-insensitive identity of a :class:~multidict.CIMultiDict key.

Robustness. Finalizers, __eq__(), __repr__(), lower() and argument iterators that read or mutate the multidict in the middle of __init__(), update(), merge(), del d[key], :meth:~multidict.MultiDict.popall, :meth:~multidict.MultiDict.popitem, :meth:~multidict.MultiDict.to_dict or :func:repr no longer crash the C extension, lose or duplicate pairs, or make the two backends disagree. Two data races against lock-free readers on the free-threaded build are gone too.

Memory. A :class:~multidict.MultiDict whose keys are all exact :class:str, and a :class:~multidict.CIMultiDict whose keys are all exact :class:~multidict.istr, are stored in a compact table without a separate identity and hash per entry, which cuts their size by about 45%.

Bug fixes

  • Fixed building the C extension on platforms where char is unsigned, such as ARM, PowerPC, s390x and RISC-V, and with GCC 9, which flags CPython's own headers from 3.12 on; both failed on a sign conversion warning since -Wconversion took effect. GCC 9 builds the extension without -Wconversion -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1759, :issue:1760.

  • Fixed :func:~multidict.getversion returning only the low 32 bits of the version on Windows and on 32-bit platforms, where two different versions could compare equal, and fixed a race in the pure-Python implementation on GIL builds that could give two multidicts mutated at the same time from different threads the same version

... (truncated)

Commits
  • 709f260 Trim the test run of the emulated wheel jobs (#1762)
  • dbc3aba Build(deps): Bump pypa/cibuildwheel from 4.2.1 to 4.3.0 (#1761)
  • ef68371 Build without -Wconversion on GCC 9 (#1760)
  • e812c4f Fix the C extension build where char is unsigned (#1759)
  • f9459a1 Release 7.1.0 (#1758)
  • 45552bd Fold the hash chain walk into _md_update() (#1757)
  • 84c5412 Move to_dict() into to_dict.h and mark only later duplicates (#1756)
  • cfd8ea2 Reserve room for update() and merge() only when keys are added (#1755)
  • fb828e3 Prefix header-local helpers with an underscore (#1753)
  • 3c3fc84 Move istr_canonical() into istr_object.h (#1754)
  • Additional commits viewable in compare view

Updates pymongo from 4.18.3 to 4.19.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.19.0

Release notes: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52147

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.19.0 (2026/10/14)

PyMongo 4.19 brings a number of changes including:

.. warning:: PyMongo 4.19 drops support for Python 3.9 and 3.10 and removes PyPy support: Python 3.11+ is now required.

  • Added support for Python 3.15.
  • Dropped support for Python 3.9 and 3.10.
  • Removed support for PyPy.
  • Removed the deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVIEW members (PYTHON-6009_).
  • Added support for running the synchronous and asynchronous clients in subinterpreters, including inside concurrent.futures.InterpreterPoolExecutor (Python 3.14+). Only in subinterpreters, which do not allow daemon threads, the synchronous client's monitor threads now start as non-daemon threads and are stopped and joined when the interpreter is torn down. Monitor threads in the main interpreter remain daemon threads and shutdown behavior is unchanged. Note that because these threads are non-daemon, a subinterpreter may block on teardown until any in-flight monitor work completes.
  • Added support for routing Key Management Service (KMS) requests for Client-Side Field Level Encryption and Queryable Encryption through an HTTP proxy, using the new kms_connect_callback option on :class:~pymongo.encryption_options.AutoEncryptionOpts, :class:~pymongo.encryption.ClientEncryption, and :class:~pymongo.asynchronous.encryption.AsyncClientEncryption. The callback opens the connection and the driver performs the KMS TLS handshake over it, so verification still targets the KMS host rather than the proxy. For an ordinary HTTP proxy, pass :class:~pymongo.encryption_options.HTTPProxyKMSConnect or :class:~pymongo.encryption_options.AsyncHTTPProxyKMSConnect instead of writing a callback. Both helpers accept custom CONNECT headers, e.g. Proxy-Authorization for proxies that require authentication.
  • Added the srv_host_validator keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient, an alternative to srvAllowedHostsSuffix for deployments whose acceptable SRV hosts cannot be expressed as a single suffix. The callback is invoked once per SRV-returned host and must return a boolean: True to accept the host and False to reject it. During initial DNS discovery a non-boolean return raises an error; during SRV polling it is treated as a rejection. It is mutually exclusive with srvAllowedHostsSuffix and, because it takes a callable, cannot be set in a connection string. See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
  • srvAllowedHostsSuffix may now be set to a single label reserved for private or special use, such as localhost, test, or internal.

... (truncated)

Commits
  • a58b4f4 Prep 4.19 Release (#3122)
  • 3242611 PYTHON-6147 Add CSFLE HTTP proxy KMS connect helpers (#3101)
  • b5a7f26 PYTHON-6009 Remove deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVI...
  • f3f19df PYTHON-6170 [BF] AWS ECS test container cannot install uv (#3120)
  • a740cdf PYTHON-6063 Remove PyPy support (#3119)
  • ed74401 PYTHON-6138 followup -- Drop Python 3.9 and 3.10 Support (#3118)
  • e0b11bf PYTHON-6163 Pure-Python decode_all silently accepts 1-byte invalid BSON (#3117)
  • b5a36cc PYTHON-6111 C extension accepts BSON documents where element data overlaps th...
  • 1f64ecd PYTHON-6158 Clean up version-gated code paths (#3112)
  • 0cc64d6 PYTHON-6161 Fix mod_wsgi CI: run apt-get update before install (#3115)
  • Additional commits viewable in compare view

Updates starlette from 1.7.0 to 1.8.0

Release notes

Sourced from starlette's releases.

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Changelog

Sourced from starlette's changelog.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.
Commits
  • 7b2948f Version 1.8.0 (#3660)
  • 5b544ce Send response start immediately when GZipMiddleware cannot compress (#3631)
  • 96d5023 Emit Max-Age=0 on session cookie when max_age=0 (#3651)
  • 0a15da3 Include allowed methods in StaticFiles 405 responses (#3640)
  • ff5b4df Close Request.stream() generators with aclosing (#3628)
  • 7cb2f09 Mark sessions as accessed when popping existing keys (#3186)
  • c67ca4e Add HTTP 103 Early Hints support (#3435)
  • 04741d0 Update broken external documentation links (#3621)
  • 470f986 Correct the documented WebSocket and Request constructor signatures (#3580)
  • b2e8750 Bracket IPv6 hostnames in URL.replace() (#3617)
  • Additional commits viewable in compare view

Updates wrapt from 2.5.0 to 2.5.1

Release notes

Sourced from wrapt's releases.

wrapt 2.5.1

Full release notes: https://wrapt.readthedocs.io/en/latest/changes.html#version-2-5-1

Install from PyPi (recommended):

pip install wrapt==2.5.1

PyPi uploads follow each GitHub release; if pip reports the version is unavailable, the matching PyPi upload may not have happened yet.

Pre-built wheels are provided for a range of Python versions and platforms (Linux x86_64/aarch64/riscv64, macOS x86_64 and arm64, Windows x86_64 and arm64, plus PyPy and free-threaded builds). The source distribution is also attached together with SHA256SUMS for verification.

wrapt 2.5.1rc1

Release candidate. Release notes for the upcoming 2.5.1 final (work in progress): https://wrapt.readthedocs.io/en/latest/changes.html#version-2-5-1

May be installable from PyPi:

pip install wrapt==2.5.1rc1

If pip reports the version is unavailable, this candidate either has not been uploaded yet or is not being published to PyPi. Use the attached wheels or build from the source distribution instead:

tar xf wrapt-2.5.1rc1.tar.gz
cd wrapt-2.5.1rc1
pip install .

SHA256SUMS is attached for verification of the archives.

wrapt 2.5.1.dev1

Development snapshot. Not normally published to PyPi (occasionally uploaded to exercise the release pipeline).

Release notes for the upcoming 2.5.1 final (work in progress): https://wrapt.readthedocs.io/en/latest/changes.html#version-2-5-1

Platform wheels and the source distribution are attached. To test against your Python install, either grab a matching wheel or build from the source distribution:

pip install wrapt-2.5.1.dev1-<python>-<abi>-<platform>.whl

or

... (truncated)

Changelog

Sourced from wrapt's changelog.

Version 2.5.1

Bugs Fixed

  • A LazyObjectProxy created with an interface argument that declared a path-like type, such as os.PathLike or pathlib.Path, did not define the __fspath__() special method on the class it generated. Because os.fspath() looks up __fspath__() on the type of the object, passing such a proxy to os.fspath(), the builtin open() or other standard library functions accepting paths raised TypeError before the factory callable had been invoked to create the wrapped object. The __fspath__() special method is now added when the declared interface provides it, in the same way as is already done for the other special methods looked up on the type, so the first path conversion triggers creation of the wrapped object and succeeds. With thanks to Muneeb Sheikh for pull request [#360](https://github.com/GrahamDumpleton/wrapt/issues/360) <https://github.com/GrahamDumpleton/wrapt/pull/360>_.

  • A callback passed to wrapt.WeakFunctionProxy which was callable but evaluated as false, such as an event emitter object which reports its number of subscribers via __len__() and is empty when first created, was passed the underlying weak reference object instead of the proxy when the wrapped function expired. Where the wrapped function was a bound method, such a callback could also be called twice, once each when the instance and the function expired. Only None is now treated as meaning no callback was supplied, which mirrors the behaviour of weakref.ref() and weakref.proxy() in the standard library, so these callbacks now receive the proxy and are called only once, as for any other callback. With thanks to Huanyi Xie for pull request [#359](https://github.com/GrahamDumpleton/wrapt/issues/359) <https://github.com/GrahamDumpleton/wrapt/pull/359>_.

  • A wrapt.AdapterFactory instance passed as the adapter argument to wrapt.decorator was ignored, and so never called, if the instance evaluated as false, such as when the factory class defined __bool__() or __len__(). The decorated function then retained its original signature instead of that produced by the factory. Whether an adapter factory was supplied is now determined by type before the truth value of the adapter is considered, so such factories are always called. As a consequence of this change a factory can now also return None, or any other false value, to indicate that no adapter should be used for a particular function, where previously this failed with an obscure error. With thanks to Luochenchen for pull request [#358](https://github.com/GrahamDumpleton/wrapt/issues/358) <https://github.com/GrahamDumpleton/wrapt/pull/358>_ which identified the issue.

Commits
  • dbbb21f Merge branch 'release/2.5.1'
  • 95e2afb Drop the release candidate suffix for the 2.5.1 release.
  • 1ed68ca Update to 2.5.1rc1.
  • 77e826d Recognise adapter factories by type so one which evaluates as false is not ig...
  • 13efe63 Move change note for PR #359 under 2.5.1 and add clarifying comments.
  • 6ba6048 Reorder fspath handling in lazy proxy and add change note for PR #360.
  • 5e97e2d Update to 2.5.1.dev1.
  • e9d491c Merge pull request #359 from xiehuanyi/fix-falsey-weak-proxy-callbacks
  • 0d6c935 Merge pull request #360 from muneikh/fix-lazy-pathlike-interface
  • de574aa Honor the declared pathlike interface in lazy proxies
  • Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

  • [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

  • [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

  • [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

    A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

  • [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

  • [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

  • [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

  • [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

    As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits
  • 4c7f636 Preparing release 1.7.0
  • 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
  • 628959b docs: remove outdated hookimpl default args paragraph
  • 2edab5e Merge pull request #752 from bluetech/register-none-allow
  • 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
  • 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
  • 6a7e84e Add changelog fragment for #776
  • d22cfb5 Drop tox from the dev dependency group
  • 74cbfa2 Relock pytest and tox that dependabot downgraded
  • 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
  • Additional commits viewable in compare view

Updates pytest-env from 1.7.1 to 1.8.0

Release notes

Sourced from pytest-env's releases.

1.8.0

  • Document [pytest] env configuration in pytest.toml / .pytest.toml (#262)
  • 👷 ci: pin ubuntu-26.04 and bump dependencies (#268)
  • feat(python): require 3.11 and default to 3.15 (#270)

PyPI release

Full Changelog: https://github.com/pytest-dev/pytest-env/compare/1.7.1...1.8.0

Changelog

Sourced from pytest-env's changelog.

1.8.0 (2026-10-10)

  • Document [pytest] env configuration in pytest.toml / .pytest.toml (#262)
  • 👷 ci: pin ubuntu-26.04 and bump dependencies (#268)
  • feat(python): require 3.11 and default to 3.15 (#270)
Commits
  • 484cdae feat(python): require 3.11 and default to 3.15 (#270)
  • 5c8b323 [pre-commit.ci] pre-commit autoupdate (#269)
  • 6bfeb12 👷 ci: pin ubuntu-26.04 and bump dependencies (#268)
  • d6ad54f build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
  • ca0dad2 [pre-commit.ci] pre-commit autoupdate (#266)
  • 0334ce8 build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
  • 0cf852c [pre-commit.ci] pre-commit autoupdate (#264)
  • d842d15 [pre-commit.ci] pre-commit autoupdate (#263)
  • e8c1b87 Document [pytest] env configuration in pytest.toml / .pytest.toml (#262)
  • See full diff in compare view

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates pipdeptree from 4.2.6 to 4.2.8

Release notes

Sourced from pipdeptree's releases.

4.2.8

Features - 4.2.8

  • Add -o cyclonedx-json and render(output_format="cyclonedx-json") to export CycloneDX 1.5 JSON using cyclonedx-bom, including dependency relationships, available installed licenses and extras, component external references, a timestamp, and a unique serial number. The renderer supports installed environments, PEP 751 locks, and index resolution. ()

PyPI release

Full Changelog: https://github.com/tox-dev/pipdeptree/compare/4.2.7...4.2.8

4.2.7

Features - 4.2.7

  • Show declared requirement ranges, markers and extras for dependencies resolved with from-index. (#723)

PyPI release

Full Changelog: https://github.com/tox-dev/pipdeptree/compare/4.2.6...4.2.7

Changelog

Sourced from pipdeptree's changelog.

Features - 4.2.8

  • Add -o cyclonedx-json and render(output_format="cyclonedx-json") to export CycloneDX 1.5 JSON using cyclonedx-bom, including dependency relationships, available installed licenses and extras, component external references, a timestamp, and a unique serial number. The renderer supports installed environments, PEP 751 locks, and index resolution. ()

4.2.7 (2026-10-10)

Features - 4.2.7

  • Show declared requirement ranges, markers and extras for dependencies resolved with from-index. (:issue:723)

4.2.6 (2026-10-10)

Commits
  • 03602a2 release 4.2.8
  • b725d5a 🔧 build(rust): require Rust 1.99 to take patched time (#734)
  • cb3f208 👷 ci(dist): build wheels on the newest runners (#733)
  • ce19b60 🧪 test(api): render extras from a fixture site (#732)
  • 2713b82 feat: Add CycloneDX JSON SBOM output (#731)
  • 5855a82 build(deps): bump the github-actions group with 4 updates (#729)
  • 0319526 build(deps): bump serde_json from 1.0.151 to 1.0.154 in the cargo group (#730)
  • a14c938 [pre-commit.ci] pre-commit autoupdate (#728)
  • cefd5cd release 4.2.7
  • a4fb8ac ✨ feat(index): retain declared requirements (#727)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps 10 Python dependencies in backend/ for bug fixes and minor feature updates.

Notable changes

  • multidict is a major bump (6.9.1 → 7.1.0): keys() now yields each key once, multidict.upstr is deprecated, and all-str multidicts use ~45% less memory.
  • starlette 1.8.0 and pymongo 4.19.0 raise their minimum supported Python versions; the project already requires Python >= 3.14, so no impact.
  • fastapi 0.143.2 fixes blocking frontend fallback file checks; wrapt 2.5.1 fixes lazy proxy and callback bugs.

The remaining updates are patch/minor bumps for linting and test tooling (pluggy, pytest-env, ruff, pipdeptree).