Bump uvicorn from 0.48.0 to 0.49.0 in /backend (#1733)

Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.48.0 to
0.49.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/releases">uvicorn's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.49.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump httptools minimum version to 0.8.0 by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2962">Kludex/uvicorn#2962</a></li>
<li>Consume duplicate forwarding headers in ProxyHeadersMiddleware
(reverses the 0.48.0 behavior of ignoring them) by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2971">Kludex/uvicorn#2971</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0">https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.0 (June 3, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Bump <code>httptools</code> minimum version to 0.8.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2962">#2962</a>)</li>
<li>Consume duplicate forwarding headers in
<code>ProxyHeadersMiddleware</code> (reverses the 0.48.0 behavior of
ignoring them) (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2971">#2971</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/uvicorn/commit/3ef2e3e08e3d9ad9572800f8bc54f3eaed9eab0a"><code>3ef2e3e</code></a>
Version 0.49.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2973">#2973</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/eeb64b1d1c95a14096ed3313377c74b485f558fc"><code>eeb64b1</code></a>
Consume duplicate forwarding headers in ProxyHeadersMiddleware (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2971">#2971</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/630f4aca14e79183617c71be714030842a1041c5"><code>630f4ac</code></a>
Make the watchfiles reload tests deterministic (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2972">#2972</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/9154922e3730f7aba68ecc3ecbf536680ee8fd1c"><code>9154922</code></a>
chore(deps): bump the github-actions group across 1 directory with 6
updates ...</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/739727a1d80e468d1e47e98bbd824ee9e3c9554b"><code>739727a</code></a>
Migrate docs deploy from Cloudflare Pages to Workers (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2967">#2967</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/be4a240488d3fb678a11b8e8f83505266f5f1de7"><code>be4a240</code></a>
Gate docs preview deploy on Cloudflare token presence (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2966">#2966</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/c489d7e10dfe653a2bba914feedf2a632a026e6f"><code>c489d7e</code></a>
Bump httptools minimum version to 0.8.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2962">#2962</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/9f547bd82ef52bcba206e04170b359bd6daa25b3"><code>9f547bd</code></a>
Skip docs preview deploy for Dependabot PRs (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2961">#2961</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/44446b894e37ca76830d6aa83df4349795400ed4"><code>44446b8</code></a>
Migrate documentation from MkDocs Material to Zensical (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2959">#2959</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/cfd659c4f18b526adce9c255c96707bab20af40c"><code>cfd659c</code></a>
Bump pymdown-extensions to 10.21.3 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2958">#2958</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uvicorn&package-manager=uv&previous-version=0.48.0&new-version=0.49.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

backend/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "types-aiofiles==25.1.0.20251011",
     "types-passlib==1.7.7.20241221",
     "types-simplejson==3.20.0.20250218",
-    "uvicorn==0.48.0",
+    "uvicorn==0.49.0",
 ]
 
 [tool.pytest.ini_options]

backend/uv.lock

@@ -443,7 +443,7 @@ requires-dist = [
     { name = "types-aiofiles", specifier = "==25.1.0.20251011" },
     { name = "types-passlib", specifier = "==1.7.7.20241221" },
     { name = "types-simplejson", specifier = "==3.20.0.20250218" },
-    { name = "uvicorn", specifier = "==0.48.0" },
+    { name = "uvicorn", specifier = "==0.49.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1754,15 +1754,15 @@ wheels = [
 
 [[package]]
 name = "uvicorn"
-version = "0.48.0"
+version = "0.49.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click" },
     { name = "h11" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/e6/bf/f6544ba992ddb9a6077343a576f9844f7f8f06ab819aefd00206e9255f18/uvicorn-0.48.0.tar.gz", hash = "sha256:a5504207195d08c2511bf9125ede5ac4a4b71725d519e758d01dcf0bc2d31c37", size = 91074, upload-time = "2026-05-24T12:08:41.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c4/1f/fa18009dea8469069cca78a4e877a008ab78f08b064bfc9ab891579077ff/uvicorn-0.49.0.tar.gz", hash = "sha256:ebf4271aa580d9de97f93192d4595176df6e91f9aae919ca73e4fc07df1e66a3", size = 91284, upload-time = "2026-06-03T22:01:30.448Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/01/be/72532be3da7acc5fdfbccdb95215cd04f995a0886532a5b423f929cda4cc/uvicorn-0.48.0-py3-none-any.whl", hash = "sha256:48097851328b87ec36117d3d575234519eb58c2b22d79666e9bbc6c49a761dad", size = 71410, upload-time = "2026-05-24T12:08:40.258Z" },
+    { url = "https://files.pythonhosted.org/packages/88/fa/e1388bbcf24ef3274f45c0c1c7b501fd14971037c1b6ee23610553307497/uvicorn-0.49.0-py3-none-any.whl", hash = "sha256:ba3d14c3ee7e41c6c654c46c9eb489d33213cdd30aa1696eab1374337c13f68f", size = 71376, upload-time = "2026-06-03T22:01:29.037Z" },
 ]
 
 [[package]]