mirror of
https://github.com/evroon/bracket.git
synced 2026-07-31 02:10:50 -04:00
copilot/remove-databases-dependency
393 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
copilot-swe-agent[bot]
|
96a80fdbea | Merge origin/master and resolve conflicts | ||
|
copilot-swe-agent[bot]
|
be9dca98f5 | Use fixed query map for test table cleanup | ||
|
copilot-swe-agent[bot]
|
ad2af69695 | Validate table names in test row counter | ||
|
copilot-swe-agent[bot]
|
9635911924 | Fix remaining PR review findings | ||
|
copilot-swe-agent[bot]
|
4262ee5378 | Scope round dependency by tournament | ||
|
copilot-swe-agent[bot]
|
4835aa7311 |
Replace databases dependency with asyncpg, remove SQLAlchemy except schema.py
- Rewrite database.py with asyncpg pool-based DatabasePool class - Support named params (:param) → positional ($N) conversion - Transaction context manager using contextvars for connection reuse - Replace all SQLAlchemy query building with raw SQL in routes and sql modules - Update utils/db.py to use raw SQL strings instead of SQLAlchemy Select - Update utils/db_init.py to use local engine creation for DDL only - Update all test files to use string table names and raw SQL - Remove databases and sqlalchemy-stubs from dependencies - Keep sqlalchemy only for schema.py definitions and alembic migrations |
||
|
Copilot
|
8fb557aa81 |
Fix SQLAlchemy and operator misuse causing broken query predicates and cross-tournament access (#1721)
Python's `and` operator is unsafe with SQLAlchemy clause elements: in
SQLAlchemy 2.0 it raises `TypeError` (routes return 500); in older
versions it short-circuits to the right-hand operand, silently dropping
the `id = X` filter and enabling cross-tournament entity access.
## Changes
**`routes/util.py`**
- `team_dependency`: replace `and` with `&`
- `round_dependency` / `match_dependency`: `rounds` and `matches` have
no direct `tournament_id`; replace the broken `and` chain with proper
JOINs through `stage_items → stages` to enforce tournament scoping
**`routes/courts.py`**
- `create_court` post-insert fetch: replace `and` with `&`
**`tests/.../teams_test.py`**
- Add `test_cross_tournament_team_access_denied`: asserts that a `PUT`
on tournament A's URL using a `team_id` belonging to tournament B
returns 404
```python
# Before (BROKEN — evaluates to just the right-hand side)
teams.select().where(teams.c.id == team_id and teams.c.tournament_id == tournament_id)
# After (CORRECT)
teams.select().where((teams.c.id == team_id) & (teams.c.tournament_id == tournament_id))
# round_dependency — no tournament_id on rounds table, use JOIN
rounds.select()
.join(stage_items, rounds.c.stage_item_id == stage_items.c.id)
.join(stages, stage_items.c.stage_id == stages.c.id)
.where((rounds.c.id == round_id) & (stages.c.tournament_id == tournament_id))
```
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
|
||
|
dependabot[bot]
|
05811b8c14 |
Bump aiohttp from 3.14.0 to 3.14.1 in /backend (#1748)
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to 3.14.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's changelog</a>.</em></p> <blockquote> <h1>3.14.1 (2026-06-07)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed a race condition in :py:class:<code>~aiohttp.TCPConnector</code> where closing the connector while a DNS resolution was in-flight could raise :py:exc:<code>AttributeError</code> instead of :py:exc:<code>~aiohttp.ClientConnectionError</code> -- by :user:<code>goingforstudying-ctrl</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12497</code>.</p> </li> <li> <p>Fixed <code>CancelledError</code> not closing a connection -- by :user:<code>aiolibsbot</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12795</code>.</p> </li> <li> <p>Tightened up some websocket parser checks -- by :user:<code>Dreamsorcerer</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12817</code>.</p> </li> <li> <p>Fixed :class:<code>~aiohttp.CookieJar</code> dropping the host-only flag of cookies when persisted with :meth:<code>~aiohttp.CookieJar.save</code> and reloaded with :meth:<code>~aiohttp.CookieJar.load</code>, so a cookie set without a <code>Domain</code> attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:<code>~aiohttp.CookieJar.load</code> now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:<code>~aiohttp.CookieJar.update_cookies</code>, so a cookie for an IP-address host is dropped when loaded into a jar created without <code>unsafe=True</code> -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12824</code>.</p> </li> <li> <p>Scoped :class:<code>~aiohttp.DigestAuthMiddleware</code> credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 <code>domain</code> directive -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12825</code>.</p> </li> <li> <p>Fixed the C HTTP parser not enforcing <code>max_line_size</code> on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising <code>LineTooLong</code>. The accumulated length is now checked, matching the pure-Python parser -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
23ebf88d8a |
Bump python-multipart from 0.0.27 to 0.0.31 in /backend (#1747)
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.27 to 0.0.31. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>Version 0.0.31</h2> <h2>What's Changed</h2> <ul> <li>Speed up multipart header parsing and callback dispatch by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/295">Kludex/python-multipart#295</a></li> <li>Bound header field name size before validating by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/296">Kludex/python-multipart#296</a></li> <li>Validate Content-Length is non-negative in parse_form by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/297">Kludex/python-multipart#297</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31">https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31</a></p> <h2>Version 0.0.30</h2> <h2>What's Changed</h2> <ul> <li>Treat only <code>&</code> as the urlencoded field separator by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/290">Kludex/python-multipart#290</a></li> <li>Ignore RFC 2231 extended parameters in <code>parse_options_header</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/291">Kludex/python-multipart#291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30">https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30</a></p> <h2>Version 0.0.29</h2> <h2>What's Changed</h2> <ul> <li>Handle malformed RFC 2231 continuations in <code>parse_options_header</code> by <a href="https://github.com/manunio"><code>@manunio</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/270">Kludex/python-multipart#270</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29">https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29</a></p> <h2>Version 0.0.28</h2> <h2>What's Changed</h2> <ul> <li>Speed up partial-boundary tail scan via <code>bytes.find</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/281">Kludex/python-multipart#281</a></li> <li>Cap multipart boundary length at 256 bytes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/282">Kludex/python-multipart#282</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28">https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.31 (2026-06-04)</h2> <ul> <li>Speed up multipart header parsing and callback dispatch <a href="https://redirect.github.com/Kludex/python-multipart/pull/295">#295</a>.</li> <li>Bound header field name size before validating <a href="https://redirect.github.com/Kludex/python-multipart/pull/296">#296</a>.</li> <li>Validate <code>Content-Length</code> is non-negative in <code>parse_form</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/297">#297</a>.</li> </ul> <h2>0.0.30 (2026-05-31)</h2> <ul> <li>Parse <code>application/x-www-form-urlencoded</code> bodies per the WHATWG URL standard, treating only <code>&</code> as a field separator <a href="https://redirect.github.com/Kludex/python-multipart/pull/290">#290</a>.</li> <li>Ignore RFC 2231/5987 extended parameters (<code>name*</code>, <code>filename*</code>) in <code>parse_options_header</code>, keeping the plain parameter authoritative per <a href="https://datatracker.ietf.org/doc/html/rfc7578#section-4.2">RFC 7578 §4.2</a> <a href="https://redirect.github.com/Kludex/python-multipart/pull/291">#291</a>.</li> </ul> <h2>0.0.29 (2026-05-17)</h2> <ul> <li>Handle malformed RFC 2231 continuations in <code>parse_options_header</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/270">#270</a>.</li> </ul> <h2>0.0.28 (2026-05-10)</h2> <ul> <li>Speed up partial-boundary tail scan via <code>bytes.find</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/281">#281</a>.</li> <li>Cap multipart boundary length at 256 bytes <a href="https://redirect.github.com/Kludex/python-multipart/pull/282">#282</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
5bd2a5bd24 |
Bump pyrefly from 1.0.0 to 1.1.1 in /backend (#1741)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 1.0.0 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v1.1.1</h2> <p><em>Release date: June 18, 2026</em></p> <p>Pyrefly v1.1.1 is a patch release with a single bug fix.</p> <hr /> <h2>🐛 Bug fixes</h2> <ul> <li><strong><a href="https://redirect.github.com/facebook/pyrefly/issues/3867">#3867</a>:</strong> Fixed a regression introduced in 1.1.0 where <code>isinstance()</code> narrowing of a union variable silently stopped working when an earlier sibling branch in the same <code>if</code>/<code>elif</code>/<code>else</code> chain narrowed a different variable with <code>isinstance()</code> and returned. The later narrowing left the union untouched, producing false <code>missing-attribute</code> errors on code that checked correctly in 1.0.0.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a>.</p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==1.1.1 </code></pre> <h3>How to safely upgrade your codebase</h3> <p>Upgrading the version of Pyrefly you're using or a third-party library you depend on can reveal new type errors in your code. Fixing them all at once is often unrealistic. We've written scripts to help you temporarily silence them. After upgrading, follow these steps:</p> <ol> <li><code>pyrefly check --suppress-errors</code></li> <li>Run your code formatter of choice</li> <li><code>pyrefly check --remove-unused-ignores</code></li> <li>Repeat until you achieve a clean formatting run and a clean type check.</li> </ol> <p>This will add <code># pyrefly: ignore</code> comments to your code, enabling you to silence errors and return to fix them later. This can make the process of upgrading a large codebase much more manageable.</p> <p>Read more about error suppressions in the <a href="https://pyrefly.org/en/docs/error-suppressions/">Pyrefly documentation</a>.</p> <h2>Pyrefly v1.1.0</h2> <p><em>Release date: June 17, 2026</em></p> <p>Pyrefly v1.1.0 bundles <strong>250 commits</strong> from <strong>25 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <h3>Type Checking</h3> <ul> <li>Pyrefly now correctly narrows <code>TypedDict</code> types after <code>isinstance(x, dict)</code> checks, treating them as runtime <code>dict</code> instances while preserving field information in the positive branch.</li> <li>Type narrowing for bounded and constrained <code>TypeVar</code>s has been significantly improved. <code>isinstance</code> checks now correctly narrow <code>Self</code> and bounded type variables via their disjoint-base representatives, and negative narrowing on bounded TypeVars no longer produces false positives.</li> <li>Constrained <code>TypeVar</code>s are now preserved through method calls and binary operations, so <code>T & int</code> where <code>T: (int, str)</code> correctly returns <code>T & int</code> instead of losing the TypeVar.</li> <li>Classes decorated with <code>@dataclass(slots=True)</code> are now recognized as PEP 800 disjoint bases when they synthesize non-empty <code>__slots__</code>, enabling proper multiple-inheritance conflict detection and type narrowing.</li> <li>Pyrefly now detects when methods override parent class methods without using the <code>@override</code> decorator, and a new quick fix can automatically add the decorator for you.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
878d0b4ce2 |
Bump fastapi from 0.136.0 to 0.138.0 in /backend (#1740)
Bumps [fastapi](https://github.com/fastapi/fastapi) from 0.136.0 to 0.138.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastapi/fastapi/releases">fastapi's releases</a>.</em></p> <blockquote> <h2>0.138.0</h2> <h3>Features</h3> <ul> <li>✨ Add support for <code>app.frontend("/", directory="dist")</code> and <code>router.frontend("/", directory="dist")</code>. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15800">#15800</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>. <ul> <li>Read the docs: <a href="https://fastapi.tiangolo.com/tutorial/frontend/">Frontend</a>.</li> </ul> </li> </ul> <h3>Docs</h3> <ul> <li>📝 Fix typo in release notes. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15807">#15807</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>📝 Add <code>app.frontend()</code> instructions to Agent Library Skill. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15805">#15805</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>📝 Update release notes link. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15802">#15802</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>✏️ Update white space characters in bigger apps. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15801">#15801</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>✏️ Fix grammar, typos, and broken links in docs. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15694">#15694</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> <h3>Translations</h3> <ul> <li>🌐 Enable Hindi docs translations. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15554">#15554</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> <h3>Internal</h3> <ul> <li>🐛 Fix failing test, update format for raised errors. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15804">#15804</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>👷 Fix test-alls-green. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15803">#15803</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🔧 Enable checking <code>release-notes.md</code> for typos. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15796">#15796</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> <li>📝 Tweak wording about deploying to FastAPI Cloud. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15793">#15793</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🔨 Use <code>gpt-5.5</code> model in <code>translate.py</code>, specify <code>-chat</code> to avoid warnings. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15792">#15792</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> <h2>0.137.2</h2> <h3>Features</h3> <ul> <li>✨ Add <code>iter_route_contexts()</code> for advanced use cases that used to use <code>router.routes</code> (e.g. Jupyverse). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15785">#15785</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <h3>Translations</h3> <ul> <li>🌐 Fix broken Markdown in Korean custom response docs. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15774">#15774</a> by <a href="https://github.com/kooqooo"><code>@kooqooo</code></a>.</li> <li>🌐 Update translations for fr (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15761">#15761</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for zh-hant (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15760">#15760</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for de (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15759">#15759</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for ko (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15757">#15757</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for uk (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15756">#15756</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for zh (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15755">#15755</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for tr (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15754">#15754</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for pt (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15753">#15753</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for es (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15752">#15752</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for ja (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15751">#15751</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for ru (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15758">#15758</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <h3>Internal</h3> <ul> <li>🔧 Update sponsors: add BairesDev. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15787">#15787</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🔨 Update sponsors script to simplify previews. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15786">#15786</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4ad9494c7e |
Bump sentry-sdk from 2.62.0 to 2.63.0 in /backend (#1739)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.62.0 to 2.63.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.63.0</h2> <h3>Bug Fixes 🐛</h3> <h4>Fastapi</h4> <ul> <li>Prevent double wrapping of sync handlers on FastAPI >= 0.137 by <a href="https://github.com/jhonny-on"><code>@jhonny-on</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6569">#6569</a></li> <li>Use effective_route_context path for prefixed routers by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6572">#6572</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Gate query string and client IP behind send_default_pii by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6501">#6501</a></li> <li>(serializer) Avoid creating reference cycles on every call by <a href="https://github.com/Malkiz223"><code>@Malkiz223</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6563">#6563</a></li> <li>(user) Set <code>user.ip_address</code> on telemetry if present by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6555">#6555</a></li> <li>Remove 0000 trace_id fallbacks by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6570">#6570</a></li> <li>MANIFEST.in: Graft tests directory. by <a href="https://github.com/charlesroelli"><code>@charlesroelli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6237">#6237</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(fastapi) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6287">#6287</a></li> <li>(starlette) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6269">#6269</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.63.0</h2> <h3>Bug Fixes 🐛</h3> <h4>Fastapi</h4> <ul> <li>Prevent double wrapping of sync handlers on FastAPI >= 0.137 by <a href="https://github.com/jhonny-on"><code>@jhonny-on</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6569">#6569</a></li> <li>Use effective_route_context path for prefixed routers by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6572">#6572</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Gate query string and client IP behind send_default_pii by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6501">#6501</a></li> <li>(serializer) Avoid creating reference cycles on every call by <a href="https://github.com/Malkiz223"><code>@Malkiz223</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6563">#6563</a></li> <li>(user) Set <code>user.ip_address</code> on telemetry if present by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6555">#6555</a></li> <li>Remove 0000 trace_id fallbacks by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6570">#6570</a></li> <li>MANIFEST.in: Graft tests directory. by <a href="https://github.com/charlesroelli"><code>@charlesroelli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6237">#6237</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(fastapi) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6287">#6287</a></li> <li>(starlette) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6269">#6269</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
edce9f8b43 |
Bump starlette from 1.2.1 to 1.3.1 in /backend (#1737)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.2.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
9ee493a8b2 |
Bump sentry-sdk from 2.61.0 to 2.62.0 in /backend (#1736)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.61.0 to 2.62.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.62.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add integration for <code>aiomysql</code> by <a href="https://github.com/tonal"><code>@tonal</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/4703">#4703</a></p> <p>We're adding support for the <code>aiomysql</code> package. To enable the integration, add it to your <code>integrations</code> list:</p> <pre lang="python"><code>import sentry_sdk from sentry_sdk.integrations.aiomysql import AioMySQLIntegration <p>sentry_sdk.init( traces_sample_rate=1.0, integrations=[AioMySQLIntegration()], ) </code></pre></p> </li> <li> <p>Support HTTPX2 by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6463">#6463</a></p> <p>We're adding out-of-the-box support for HTTPX2. As long as use the package, the Sentry integration will be enabled automatically and you should see your requests instrumented in Sentry.</p> <pre lang="python"><code>import httpx2 import sentry_sdk <p>sentry_sdk.init(...)</p> <p>with sentry_sdk.start_transaction(name="testing_sentry"): httpx2.get("<a href="https://sentry.io/">https://sentry.io/</a>") </code></pre></p> </li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li>(arq) Never capture control flow exceptions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6507">#6507</a></li> <li>(client) Guard against dotless qualified_name in _setup_instrumentation by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6452">#6452</a></li> <li>(pydantic-ai) Only use hooks when <code>ModelRequestContext.model</code> exists by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6480">#6480</a></li> <li>(rq) Restore <code>functools.wraps()</code> for patched functions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6532">#6532</a></li> <li>(tracing_utils) Handle baggage values containing '=' in from_incoming_header by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6450">#6450</a></li> <li>(utils) Handle image_url string shorthand in _is_image_type_with_blob_content by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6478">#6478</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(arq) Only pin <code>fakeredis<2.36.0</code> in tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6444">#6444</a></li> <li>(flaky) Change env for flaky test detector by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6492">#6492</a></li> <li>(pydantic-ai) Create event loop before invoking sync methods by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6475">#6475</a></li> <li>Use <code>package-ecosystem: uv</code> in dependabot by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6522">#6522</a></li> <li>🤖 Update test matrix with new releases (06/08) by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6519">#6519</a></li> <li>Raise minimum supported <code>aiomysql</code> version and update text matrix by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6496">#6496</a></li> <li>Deprecate OpenTelemetryIntegration in favor of OTLPIntegration and no-op for span first by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6494">#6494</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.62.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add integration for <code>aiomysql</code> by <a href="https://github.com/tonal"><code>@tonal</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/4703">#4703</a></p> <p>We're adding support for the <code>aiomysql</code> package. To enable the integration, add it to your <code>integrations</code> list:</p> <pre lang="python"><code>import sentry_sdk from sentry_sdk.integrations.aiomysql import AioMySQLIntegration <p>sentry_sdk.init( traces_sample_rate=1.0, integrations=[AioMySQLIntegration()], ) </code></pre></p> </li> <li> <p>Support HTTPX2 by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6463">#6463</a></p> <p>We're adding out-of-the-box support for HTTPX2. As long as use the package, the Sentry integration will be enabled automatically and you should see your requests instrumented in Sentry.</p> <pre lang="python"><code>import httpx2 import sentry_sdk <p>sentry_sdk.init(...)</p> <p>with sentry_sdk.start_transaction(name="testing_sentry"): httpx2.get("<a href="https://sentry.io/">https://sentry.io/</a>") </code></pre></p> </li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li>(arq) Never capture control flow exceptions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6507">#6507</a></li> <li>(client) Guard against dotless qualified_name in _setup_instrumentation by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6452">#6452</a></li> <li>(pydantic-ai) Only use hooks when <code>ModelRequestContext.model</code> exists by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6480">#6480</a></li> <li>(rq) Restore <code>functools.wraps()</code> for patched functions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6532">#6532</a></li> <li>(tracing_utils) Handle baggage values containing '=' in from_incoming_header by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6450">#6450</a></li> <li>(utils) Handle image_url string shorthand in _is_image_type_with_blob_content by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6478">#6478</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(arq) Only pin <code>fakeredis<2.36.0</code> in tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6444">#6444</a></li> <li>(flaky) Change env for flaky test detector by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6492">#6492</a></li> <li>(pydantic-ai) Create event loop before invoking sync methods by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6475">#6475</a></li> <li>Use <code>package-ecosystem: uv</code> in dependabot by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6522">#6522</a></li> <li>🤖 Update test matrix with new releases (06/08) by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6519">#6519</a></li> <li>Raise minimum supported <code>aiomysql</code> version and update text matrix by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6496">#6496</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
279f66be12 |
Bump pytest from 9.0.3 to 9.1.0 in /backend (#1735)
Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to 9.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/releases">pytest's releases</a>.</em></p> <blockquote> <h2>9.1.0</h2> <h1>pytest 9.1.0 (2026-06-13)</h1> <h2>Removals and backward incompatible breaking changes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14533">#14533</a>: When using <code>--doctest-modules</code>, autouse fixtures with <code>module</code>, <code>package</code> or <code>session</code> scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.</p> <p>If this is undesirable, move the fixture definition to a <code>conftest.py</code> file if possible.</p> <p>Technical explanation for those interested: When using <!-- raw HTML omitted -->--doctest-modules<!-- raw HTML omitted -->, pytest possibly collects Python modules twice, once as <code>pytest.Module</code> and once as a <code>DoctestModule</code> (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the <code>DoctestModule</code> collects a fixture, it is now visible to it only, and not to the <code>Module</code>. This means that both need to register the fixtures independently.</p> </li> </ul> <h2>Deprecations (removal in next major release)</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/10819">#10819</a>: Added a deprecation warning for class-scoped fixtures defined as instance methods (without <code>@classmethod</code>). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use <code>@classmethod</code> decorator instead -- by <code>yastcher</code>.</p> <p>See <code>10819</code> and <code>14011</code>.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/12882">#12882</a>: Calling <code>request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue></code> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.</p> <p>See <code>dynamic-fixture-request-during-teardown</code> for details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13409">#13409</a>: Using non-<code>~collections.abc.Collection</code> iterables (such as generators, iterators, or custom iterable objects) for the <code>argvalues</code> parameter in <code>@pytest.mark.parametrize <pytest.mark.parametrize ref></code> and <code>metafunc.parametrize <pytest.Metafunc.parametrize></code> is now deprecated.</p> <p>These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running <code>pytest.main()</code> multiple times, using class-level parametrize decorators, or collecting tests multiple times.</p> <p>See <code>parametrize-iterators</code> for details and suggestions.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>: The private <code>config.inicfg</code> attribute is now deprecated. Use <code>config.getini() <pytest.Config.getini></code> to access configuration values instead.</p> <p>See <code>config-inicfg</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14004">#14004</a>: Passing <code>baseid</code> to <code>~pytest.FixtureDef</code> or <code>nodeid</code> strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.</p> <p>Use the <code>node</code> parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used <code>nodeid=None</code>, pass <code>node=session</code> instead.</p> <p>This will be removed in pytest 10.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14335">#14335</a>: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See <code>hook-markers</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14434">#14434</a>: The <code>--pastebin</code> option is now deprecated.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
d5f5a40986 |
Bump aiohttp from 3.13.4 to 3.14.0 in /backend (#1732)
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7cb4638f61 |
Bump uvicorn from 0.48.0 to 0.49.0 in /backend (#1733)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.48.0 to 0.49.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.49.0</h2> <h2>What's Changed</h2> <ul> <li>Bump httptools minimum version to 0.8.0 by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2962">Kludex/uvicorn#2962</a></li> <li>Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2971">Kludex/uvicorn#2971</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0">https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.49.0 (June 3, 2026)</h2> <h3>Changed</h3> <ul> <li>Bump <code>httptools</code> minimum version to 0.8.0 (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2962">#2962</a>)</li> <li>Consume duplicate forwarding headers in <code>ProxyHeadersMiddleware</code> (reverses the 0.48.0 behavior of ignoring them) (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2971">#2971</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8a6d86980f |
Bump uvicorn from 0.47.0 to 0.48.0 in /backend (#1726)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.47.0 to 0.48.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.48.0</h2> <h2>What's Changed</h2> <ul> <li>Default <code>ssl_ciphers</code> to <code>None</code> and use OpenSSL defaults by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2940">Kludex/uvicorn#2940</a></li> <li>Ignore duplicate forwarding headers in <code>ProxyHeadersMiddleware</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2944">Kludex/uvicorn#2944</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0">https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.48.0 (May 24, 2026)</h2> <h3>Changed</h3> <ul> <li>Default <code>ssl_ciphers</code> to <code>None</code> and use OpenSSL defaults (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2940">#2940</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ignore duplicate forwarding headers in <code>ProxyHeadersMiddleware</code> (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2944">#2944</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8376072d5f |
Bump starlette from 1.1.0 to 1.2.1 in /backend (#1725)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.1.0 to 1.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
0c8f1eb2de |
Bump sentry-sdk from 2.60.0 to 2.61.0 in /backend (#1724)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.60.0 to 2.61.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.61.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add <code>server.address</code> to transformed spans when <code>stream_gen_ai_spans=True</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6307">#6307</a></p> </li> <li> <p>Allow integrations to define control flow exceptions by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6425">#6425</a></p> </li> <li> <p>Disable string truncation for events by default by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6290">#6290</a></p> <p>Following a previous significant increase of the string truncation limit, we've now completely removed the limit by default. In case you have large strings in your events, you should now be able to see them.</p> <p>In rare cases, if you have really long strings (or a lot of them), you might see envelopes being dropped because of their size. If that happens, you can set the <code>max_value_length</code> <code>init</code> option to the previous value of <code>100_000</code>:</p> <pre lang="python"><code>sentry_sdk.init( ..., max_value_length=100_000, ) </code></pre> </li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Langchain</h4> <ul> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6301">#6301</a></li> <li>Catch <code>TypeError</code> on <code>langchain.agents</code> import by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6268">#6268</a></li> </ul> <h4>Openai Agents</h4> <ul> <li>Handle <code>starting_agent</code> keyword argument in runner patches by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6428">#6428</a></li> <li>Remove hosted MCP tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6391">#6391</a></li> <li>Use <code>name</code>, not <code>description</code> in <code>start_span</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6323">#6323</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6303">#6303</a></li> </ul> <h4>Pydantic AI</h4> <ul> <li>Stop setting tokens on Invoke Agent spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6320">#6320</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6302">#6302</a></li> <li>Remove <code>Agent.run_stream_events()</code> patch by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6281">#6281</a></li> </ul> <h4>Strawberry</h4> <ul> <li>Wrap yields in try-except to ensure span cleanup by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6381">#6381</a></li> <li>Fix <code>AttributeError</code> on <code>graphql_span</code> in <code>resolve</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6289">#6289</a></li> </ul> <h4>Other</h4> <ul> <li>(anthropic) Do not set <code>gen_ai.response.model</code> to <code>None</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6312">#6312</a></li> <li>(asyncpg) Use Sentry span attribute name conventions by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6306">#6306</a></li> <li>(boto3) Guard setting method by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6288">#6288</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.61.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add <code>server.address</code> to transformed spans when <code>stream_gen_ai_spans=True</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6307">#6307</a></p> </li> <li> <p>Allow integrations to define control flow exceptions by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6425">#6425</a></p> </li> <li> <p>Disable string truncation for events by default by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6290">#6290</a></p> <p>Following a previous significant increase of the string truncation limit, we've now completely removed the limit by default. In case you have large strings in your events, you should now be able to see them.</p> <p>In rare cases, if you have really long strings (or a lot of them), you might see envelopes being dropped because of their size. If that happens, you can set the <code>max_value_length</code> <code>init</code> option to the previous value of <code>100_000</code>:</p> <pre lang="python"><code>sentry_sdk.init( ..., max_value_length=100_000, ) </code></pre> </li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Langchain</h4> <ul> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6301">#6301</a></li> <li>Catch <code>TypeError</code> on <code>langchain.agents</code> import by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6268">#6268</a></li> </ul> <h4>Openai Agents</h4> <ul> <li>Handle <code>starting_agent</code> keyword argument in runner patches by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6428">#6428</a></li> <li>Remove hosted MCP tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6391">#6391</a></li> <li>Use <code>name</code>, not <code>description</code> in <code>start_span</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6323">#6323</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6303">#6303</a></li> </ul> <h4>Pydantic AI</h4> <ul> <li>Stop setting tokens on Invoke Agent spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6320">#6320</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6302">#6302</a></li> <li>Remove <code>Agent.run_stream_events()</code> patch by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6281">#6281</a></li> </ul> <h4>Strawberry</h4> <ul> <li>Wrap yields in try-except to ensure span cleanup by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6381">#6381</a></li> <li>Fix <code>AttributeError</code> on <code>graphql_span</code> in <code>resolve</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6289">#6289</a></li> </ul> <h4>Other</h4> <ul> <li>(anthropic) Do not set <code>gen_ai.response.model</code> to <code>None</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6312">#6312</a></li> <li>(asyncpg) Use Sentry span attribute name conventions by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6306">#6306</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8aa1bb1c36 |
Bump pytest-asyncio from 1.3.0 to 1.4.0 in /backend (#1723)
Bumps [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) from 1.3.0 to 1.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest-asyncio/releases">pytest-asyncio's releases</a>.</em></p> <blockquote> <h2>pytest-asyncio v1.4.0</h2> <h1><a href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.0">1.4.0</a> - 2026-05-26</h1> <h2>Deprecated</h2> <ul> <li>Overriding the <em>event_loop_policy</em> fixture is deprecated. Use the <code>pytest_asyncio_loop_factories</code> hook instead. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1419">#1419</a>)</li> </ul> <h2>Added</h2> <ul> <li> <p>Added the <code>pytest_asyncio_loop_factories</code> hook to parametrize asyncio tests with custom event loop factories.</p> <p>The hook returns a mapping of factory names to loop factories, and <code>pytest.mark.asyncio(loop_factories=[...])</code> selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.</p> <p>Synchronous <code>@pytest_asyncio.fixture</code> functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via <code>asyncio.run()</code> or <code>asyncio.set_event_loop(None)</code>). (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1164">#1164</a>)</p> </li> </ul> <h2>Changed</h2> <ul> <li>Improved the readability of the warning message that is displayed when <code>asyncio_default_fixture_loop_scope</code> is unset (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1298">#1298</a>)</li> <li>Only import <code>asyncio.AbstractEventLoopPolicy</code> for type checking to avoid raising a DeprecationWarning. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1394">#1394</a>)</li> <li>Updated minimum supported pytest version to v8.4.0. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1397">#1397</a>)</li> </ul> <h2>Fixed</h2> <ul> <li>Fixed a <code>ResourceWarning: unclosed event loop</code> warning that could occur when a synchronous test called <code>asyncio.run()</code> or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/724">#724</a>)</li> </ul> <h2>Notes for Downstream Packagers</h2> <ul> <li>Added dependency on <code>sphinx-tabs >= 3.5</code> to organize documentation examples into tabs. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1395">#1395</a>)</li> </ul> <h2>pytest-asyncio v1.4.0a2</h2> <h1><a href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.0a2">1.4.0a2</a> - 2026-05-02</h1> <h2>Deprecated</h2> <ul> <li>Overriding the <em>event_loop_policy</em> fixture is deprecated. Use the <code>pytest_asyncio_loop_factories</code> hook instead. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1419">#1419</a>)</li> </ul> <h2>Added</h2> <ul> <li> <p>Added the <code>pytest_asyncio_loop_factories</code> hook to parametrize asyncio tests with custom event loop factories.</p> <p>The hook returns a mapping of factory names to loop factories, and <code>pytest.mark.asyncio(loop_factories=[...])</code> selects a subset of configured factories per test. When a single factory is configured, test names are unchanged on pytest 8.4+.</p> <p>Synchronous <code>@pytest_asyncio.fixture</code> functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via <code>asyncio.run()</code> or <code>asyncio.set_event_loop(None)</code>). (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1164">#1164</a>)</p> </li> </ul> <h2>Changed</h2> <ul> <li>Improved the readability of the warning message that is displayed when <code>asyncio_default_fixture_loop_scope</code> is unset (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1298">#1298</a>)</li> <li>Only import <code>asyncio.AbstractEventLoopPolicy</code> for type checking to avoid raising a DeprecationWarning. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1394">#1394</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
1d5e71fc20 |
Bump starlette from 1.0.1 to 1.1.0 in /backend (#1720)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.1.0</h2> <h2>What's Changed</h2> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback by <a href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3283">Kludex/starlette#3283</a></li> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3286">Kludex/starlette#3286</a></li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3287">Kludex/starlette#3287</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3283">Kludex/starlette#3283</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.0.1...1.1.0">https://github.com/Kludex/starlette/compare/1.0.1...1.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
611dfdbcfc |
Bump pydantic-settings from 2.14.0 to 2.14.2 in /backend (#1719)
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.14.0 to 2.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's releases</a>.</em></p> <blockquote> <h2>v2.14.2</h2> <h2>What's Changed</h2> <p>This is a security patch release.</p> <ul> <li>Prevent <code>NestedSecretsSettingsSource</code> from following symlinks outside <code>secrets_dir</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/889">pydantic/pydantic-settings#889</a></li> <li>Prepare release 2.14.2 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/890">pydantic/pydantic-settings#890</a></li> </ul> <h3>Security</h3> <p>Fixes <a href="https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j">GHSA-4xgf-cpjx-pc3j</a>: <code>NestedSecretsSettingsSource</code> with <code>secrets_nested_subdir=True</code> could follow a symbolic link inside <code>secrets_dir</code> pointing outside it, reading out-of-tree files into settings values and bypassing the <code>secrets_dir_max_size</code> cap. Affected versions: <code>>= 2.12.0, < 2.14.2</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2">https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2</a></p> <h2>v2.14.1</h2> <h2>What's Changed</h2> <ul> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/850">pydantic/pydantic-settings#850</a></li> <li>Bump the python-packages group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/854">pydantic/pydantic-settings#854</a></li> <li>Bump the github-actions group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/853">pydantic/pydantic-settings#853</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/856">pydantic/pydantic-settings#856</a></li> <li>Fix field named <code>cls</code> conflicting with classmethod parameter by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/858">pydantic/pydantic-settings#858</a></li> <li>Prepare release 2.14.1 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/859">pydantic/pydantic-settings#859</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1">https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
9077b2d0a0 |
Bump uvicorn from 0.46.0 to 0.47.0 in /backend (#1718)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.46.0 to 0.47.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.47.0</h2> <h2>What's Changed</h2> <ul> <li>Eagerly import the ASGI app in the parent process by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2919">Kludex/uvicorn#2919</a></li> <li>Add <code>ssl_context_factory</code> for custom <code>SSLContext</code> configuration by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2920">Kludex/uvicorn#2920</a></li> <li>Treat <code>fd=0</code> as a valid file descriptor with reload/workers by <a href="https://github.com/eltoder"><code>@eltoder</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2927">Kludex/uvicorn#2927</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0">https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.47.0 (May 14, 2026)</h2> <h3>Added</h3> <ul> <li>Add <code>ssl_context_factory</code> for custom <code>SSLContext</code> configuration (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2920">#2920</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Eagerly import the ASGI app in the parent process (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2919">#2919</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Treat <code>fd=0</code> as a valid file descriptor with reload/workers (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2927">#2927</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8c80246c97 |
Bump mypy from 2.0.0 to 2.1.0 in /backend (#1717)
Bumps [mypy](https://github.com/python/mypy) from 2.0.0 to 2.1.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h2>Mypy 2.1</h2> <p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>librt.vecs: Fast Growable Array Type for Mypyc</h3> <p>The new <code>librt.vecs</code> module provides an efficient growable array type <code>vec</code> that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be <strong>several times faster</strong> than <code>list</code>, and tens of times faster than <code>array.array</code> in code compiled using mypyc. It also supports nested <code>vec</code> objects and non-value-type items, such as <code>vec[vec[str]]</code>.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo.</p> <h3>librt.random: Fast Pseudo-Random Number Generation</h3> <p>The new <code>librt.random</code> module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib <code>random</code> module in compiled code.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo (PR <a href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p> <h3>Mypyc Improvements</h3> <ul> <li>Enable incremental self-compilation (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21369">21369</a>)</li> <li>Make compilation order with multiple files consistent (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li> <li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li> <li>Fix incremental compilation with <code>separate</code> flag (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li> </ul> <h3>Fixes to Crashes</h3> <ul> <li>Fix crash on partial type with <code>--allow-redefinition</code> and <code>global</code> declaration (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li> <li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
284d2eceb6 |
Bump pyrefly from 0.64.1 to 1.0.0 in /backend (#1716)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.64.1 to 1.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v1.0.0</h2> <p><strong>Status: STABLE</strong> <em>Release date: 12 May 2026</em></p> <h2>Pyrefly v1.0.0 is here!</h2> <p>We're thrilled to announce that Pyrefly has reached its stable 1.0.0 release! Since our <a href="https://github.com/facebook/pyrefly/releases/tag/0.42.0">beta release</a> in November 2025, we've fixed hundreds of bugs, improved performance, and added lots of new functionality. Pyrefly is already the default type checker for Instagram at Meta and has been adopted by other large production codebases like PyTorch and JAX. Today, we're making it official: Pyrefly is production ready.</p> <p>This would not have been possible without our amazing open-source community. To everyone who filed GitHub issues, submitted pull requests, gave us feedback at conferences, or joined us on Discord: thank you. Your contributions shaped this release.</p> <p>These release notes cover the major highlights since our beta release. For the full history, see our <a href="https://github.com/facebook/pyrefly/releases">past weekly release notes</a>.</p> <hr /> <h2>Performance Improvements</h2> <p>We've continued to push Pyrefly's performance since the <a href="https://pyrefly.org/blog/2026/02/06/performance-improvements/">speed improvements we shared in February</a>. Since beta:</p> <ul> <li><strong>2–125x faster updated diagnostics</strong> after saving a file (no, that’s not a typo!). Thanks to fine-grained dependency tracking and streaming diagnostics, updates now consistently arrive in milliseconds</li> <li><strong>20–36% faster full type checking</strong> on large projects like PyTorch and Pandas</li> <li><strong>2–3x faster initial indexing</strong> when Pyrefly first scans your project</li> <li><strong>40–60% less memory usage</strong> during both indexing and incremental type checking</li> </ul> <p>(Tested on an M4 Macbook Pro using open-source benchmarks from <a href="https://github.com/lolpack/type_coverage_py">type_coverage_py</a> and <a href=" |
||
|
dependabot[bot]
|
0de812c8b9 |
Bump sentry-sdk from 2.59.0 to 2.60.0 in /backend (#1715)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.59.0 to 2.60.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.60.0</h2> <p>Adds a new <code>stream_gen_ai_spans</code> option that controls how <code>gen_ai</code> spans are sent to Sentry. When set, the SDK extracts all <code>gen_ai</code> spans out of a transaction and sends them as v2 envelope items.</p> <p>Enable this option if <code>gen_ai</code> spans are being dropped because the transaction payload exceeds size limits.</p> <pre lang="python"><code>import sentry_sdk <p>sentry_sdk.init(<br /> dsn='https://<a href="mailto:examplePublicKey@o0.ingest.sentry.io">examplePublicKey@o0.ingest.sentry.io</a>/0',<br /> stream_gen_ai_spans=True,<br /> )<br /> </code></pre></p> <h3>New Features ✨</h3> <ul> <li>(asyncpg) Add cursor span support via BaseCursor method patching by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6252">#6252</a></li> <li>(integrations) Pass along the conversation ID for openai <code>responses</code> calls by <a href="https://github.com/constantinius"><code>@constantinius</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6199">#6199</a></li> <li>(wsgi,asgi) Introduce substitute values for filtered fields in span-streaming mode by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6178">#6178</a></li> <li>Remove truncation when <code>stream_gen_ai_spans</code> is enabled by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6260">#6260</a></li> <li>Add option to send GenAI spans in the new span format by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6079">#6079</a></li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Openai</h4> <ul> <li>Guard against <code>choices=None</code> by <a href="https://github.com/cla7aye15I4nd"><code>@cla7aye15I4nd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6216">#6216</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6192">#6192</a></li> <li>Only finish relevant spans in Responses patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6191">#6191</a></li> <li>Only finish relevant spans in Chat Completions patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6190">#6190</a></li> </ul> <h4>Other</h4> <ul> <li>(stdlib) Instrument response body read for chunked HTTP responses by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6202">#6202</a></li> <li>(typing) Add <code>@sentry_sdk.traces.trace</code> overloads to fix typing by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6236">#6236</a></li> <li>Use proto version 2 to fix backfilled user agent and IP by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6256">#6256</a></li> <li>Make sure <code>http.server</code> spans are segments by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6230">#6230</a></li> <li>Handle mypy 2.0 related failures by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6218">#6218</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Django</h4> <ul> <li>Check transaction annotations on transaction events by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6251">#6251</a></li> <li>Reload middleware on test teardown by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6249">#6249</a></li> </ul> <h4>Openai</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.60.0</h2> <p>Adds a new <code>stream_gen_ai_spans</code> option that controls how <code>gen_ai</code> spans are sent to Sentry. When set, the SDK extracts all <code>gen_ai</code> spans out of a transaction and sends them as v2 envelope items.</p> <p>Enable this option if <code>gen_ai</code> spans are being dropped because the transaction payload exceeds size limits.</p> <pre lang="python"><code>import sentry_sdk <p>sentry_sdk.init(<br /> dsn='https://<a href="mailto:examplePublicKey@o0.ingest.sentry.io">examplePublicKey@o0.ingest.sentry.io</a>/0',<br /> stream_gen_ai_spans=True,<br /> )<br /> </code></pre></p> <h3>New Features ✨</h3> <ul> <li>(asyncpg) Add cursor span support via BaseCursor method patching by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6252">#6252</a></li> <li>(integrations) Pass along the conversation ID for openai <code>responses</code> calls by <a href="https://github.com/constantinius"><code>@constantinius</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6199">#6199</a></li> <li>(wsgi,asgi) Introduce substitute values for filtered fields in span-streaming mode by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6178">#6178</a></li> <li>Remove truncation when <code>stream_gen_ai_spans</code> is enabled by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6260">#6260</a></li> <li>Add option to send GenAI spans in the new span format by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6079">#6079</a></li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Openai</h4> <ul> <li>Guard against <code>choices=None</code> by <a href="https://github.com/cla7aye15I4nd"><code>@cla7aye15I4nd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6216">#6216</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6192">#6192</a></li> <li>Only finish relevant spans in Responses patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6191">#6191</a></li> <li>Only finish relevant spans in Chat Completions patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6190">#6190</a></li> </ul> <h4>Other</h4> <ul> <li>(stdlib) Instrument response body read for chunked HTTP responses by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6202">#6202</a></li> <li>(typing) Add <code>@sentry_sdk.traces.trace</code> overloads to fix typing by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6236">#6236</a></li> <li>Use proto version 2 to fix backfilled user agent and IP by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6256">#6256</a></li> <li>Make sure <code>http.server</code> spans are segments by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6230">#6230</a></li> <li>Handle mypy 2.0 related failures by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6218">#6218</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Django</h4> <ul> <li>Check transaction annotations on transaction events by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6251">#6251</a></li> <li>Reload middleware on test teardown by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6249">#6249</a></li> </ul> <h4>Openai</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
d9c06d0d5d |
Bump click from 8.3.0 to 8.4.0 in /backend (#1714)
Bumps [click](https://github.com/pallets/click) from 8.3.0 to 8.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pallets/click/releases">click's releases</a>.</em></p> <blockquote> <h2>8.4.0</h2> <p>This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.</p> <p>We encourage everyone to upgrade. You can read more about our <a href="https://palletsprojects.com/versions">Version Support Policy</a> on our website.</p> <p>PyPI: <a href="https://pypi.org/project/click/8.4.0/">https://pypi.org/project/click/8.4.0/</a> Changes: <a href="https://click.palletsprojects.com/page/changes/#version-8-4-0">https://click.palletsprojects.com/page/changes/#version-8-4-0</a> Milestone <a href="https://github.com/pallets/click/milestone/30">https://github.com/pallets/click/milestone/30</a></p> <ul> <li> <p><code>ParamType</code> typing improvements. <a href="https://redirect.github.com/pallets/click/issues/3371">#3371</a></p> <ul> <li>:class:<code>ParamType</code> is now a generic abstract base class, parameterized by its converted value type.</li> <li>:meth:<code>~ParamType.convert</code> return types are narrowed on all concrete types (<code>str</code> for :class:<code>STRING</code>, <code>int</code> for :class:<code>INT</code>, etc.).</li> <li>:meth:<code>~ParamType.to_info_dict</code> returns specific :class:<code>~typing.TypedDict</code> subclasses instead of <code>dict[str, Any]</code>.</li> <li>:class:<code>CompositeParamType</code> and the number-range base are now generic with abstract methods.</li> </ul> </li> <li> <p>Refactor <code>convert_type</code> to extract type inference into a private <code>_guess_type</code> helper, and add :func:<code>typing.overload</code> signatures. <a href="https://redirect.github.com/pallets/click/issues/3372">#3372</a></p> </li> <li> <p><code>Parameter</code> typing improvements. <a href="https://redirect.github.com/pallets/click/issues/2805">#2805</a></p> <ul> <li>:class:<code>Parameter</code> is now an abstract base class, making explicit that it cannot be instantiated directly.</li> <li>:attr:<code>Parameter.name</code> is now <code>str</code> instead of <code>str | None</code>. When <code>expose_value=False</code>, the name is set to <code>""</code> instead of <code>None</code>.</li> <li>The <code>ctx</code> parameter of :meth:<code>Parameter.get_error_hint</code> is now typed as <code>Context | None</code>, matching the runtime behavior.</li> </ul> </li> <li> <p>Split string values from <code>default_map</code> for parameters with <code>nargs > 1</code> or :class:<code>Tuple</code> type, matching environment variable behavior. <a href="https://redirect.github.com/pallets/click/issues/2745">#2745</a> <a href="https://redirect.github.com/pallets/click/issues/3364">#3364</a></p> </li> <li> <p>Auto-detect <code>type=UNPROCESSED</code> for <code>flag_value</code> of non-basic types (not <code>str</code>, <code>int</code>, <code>float</code>, or <code>bool</code>), so programmer-provided Python objects like classes and enum members are passed through unchanged instead of being stringified. Previously <code>type=click.UNPROCESSED</code> had to be set explicitly. <a href="https://redirect.github.com/pallets/click/issues/2012">#2012</a> <a href="https://redirect.github.com/pallets/click/issues/3363">#3363</a></p> </li> <li> <p>The error hint now uses <code>Command.get_help_option_names</code> to pick non-shadowed help option names, so <code>Try '... -h'</code> no longer points to a subcommand option that shadows <code>-h</code>. All surviving names are shown (<code>-h/--help</code>). <a href="https://redirect.github.com/pallets/click/issues/2790">#2790</a> <a href="https://redirect.github.com/pallets/click/issues/3208">#3208</a></p> </li> <li> <p>Fix readline functionality on non-Windows platforms. Prompt text is now passed directly to readline instead of being printed separately, allowing proper backspace, line editing, and line wrapping behavior. <a href="https://redirect.github.com/pallets/click/issues/2968">#2968</a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pallets/click/blob/main/CHANGES.md">click's changelog</a>.</em></p> <blockquote> <h2>Version 8.4.0</h2> <p>Released 2026-05-17</p> <ul> <li> <p>{class}<code>ParamType</code> typing improvements. {pr}<code>3371</code></p> <ul> <li>{class}<code>ParamType</code> is now a generic abstract base class, parameterized by its converted value type.</li> <li>{meth}<code>~ParamType.convert</code> return types are narrowed on all concrete types (<code>str</code> for {class}<code>STRING</code>, <code>int</code> for {class}<code>INT</code>, etc.).</li> <li>{meth}<code>~ParamType.to_info_dict</code> returns specific {class}<code>~typing.TypedDict</code> subclasses instead of <code>dict[str, Any]</code>.</li> <li>{class}<code>CompositeParamType</code> and the number-range base are now generic with abstract methods.</li> </ul> </li> <li> <p>Refactor <code>convert_type</code> to extract type inference into a private <code>_guess_type</code> helper, and add {func}<code>typing.overload</code> signatures. {pr}<code>3372</code></p> </li> <li> <p>{class}<code>Parameter</code> typing improvements. {pr}<code>2805</code></p> <ul> <li>{class}<code>Parameter</code> is now an abstract base class, making explicit that it cannot be instantiated directly.</li> <li>{attr}<code>Parameter.name</code> is now <code>str</code> instead of <code>str | None</code>. When <code>expose_value=False</code>, the name is set to <code>""</code> instead of <code>None</code>.</li> <li>The <code>ctx</code> parameter of {meth}<code>Parameter.get_error_hint</code> is now typed as <code>Context | None</code>, matching the runtime behavior.</li> </ul> </li> <li> <p>Split string values from <code>default_map</code> for parameters with <code>nargs > 1</code> or {class}<code>Tuple</code> type, matching environment variable behavior. {issue}<code>2745</code> {pr}<code>3364</code></p> </li> <li> <p>Auto-detect <code>type=UNPROCESSED</code> for <code>flag_value</code> of non-basic types (not <code>str</code>, <code>int</code>, <code>float</code>, or <code>bool</code>), so programmer-provided Python objects like classes and enum members are passed through unchanged instead of being stringified. Previously <code>type=click.UNPROCESSED</code> had to be set explicitly. {issue}<code>2012</code> {pr}<code>3363</code></p> </li> <li> <p>The error hint now uses {meth}<code>Command.get_help_option_names</code> to pick non-shadowed help option names, so <code>Try '... -h'</code> no longer points to a subcommand option that shadows <code>-h</code>. The longest surviving name is shown (<code>--help</code> over <code>-h</code>) for readability. {issue}<code>2790</code> {pr}<code>3208</code></p> </li> <li> <p>Fix readline functionality on non-Windows platforms. Prompt text is now passed directly to readline instead of being printed separately, allowing proper backspace, line editing, and line wrapping behavior. {issue}<code>2968</code> {pr}<code>2969</code></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
3ccaafd6cd |
Bump pyjwt from 2.12.0 to 2.13.0 in /backend (#1712)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.12.0 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> <h2>2.12.1</h2> <h2>What's Changed</h2> <ul> <li>Add typing_extensions dependency for Python < 3.11 by <a href="https://github.com/jpadilla"><code>@jpadilla</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__</li> </ul> <p><code>v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;</code>__ </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
e0a455995f |
Bump mypy from 1.20.0 to 2.0.0 in /backend (#1709)
Bumps [mypy](https://github.com/python/mypy) from 1.20.0 to 2.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h2>Mypy 2.1</h2> <p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>librt.vecs: Fast Growable Array Type for Mypyc</h3> <p>The new <code>librt.vecs</code> module provides an efficient growable array type <code>vec</code> that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be <strong>several times faster</strong> than <code>list</code>, and tens of times faster than <code>array.array</code> in code compiled using mypyc. It also supports nested <code>vec</code> objects and non-value-type items, such as <code>vec[vec[str]]</code>.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo.</p> <h3>librt.random: Fast Pseudo-Random Number Generation</h3> <p>The new <code>librt.random</code> module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib <code>random</code> module in compiled code.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo (PR <a href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p> <h3>Mypyc Improvements</h3> <ul> <li>Enable incremental self-compilation (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21369">21369</a>)</li> <li>Make compilation order with multiple files consistent (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li> <li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li> <li>Fix incremental compilation with <code>separate</code> flag (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li> </ul> <h3>Fixes to Crashes</h3> <ul> <li>Fix crash on partial type with <code>--allow-redefinition</code> and <code>global</code> declaration (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li> <li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4f1dc6ae80 |
Bump pyrefly from 0.63.1 to 0.64.1 in /backend (#1710)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.63.1 to 0.64.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.64.1</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/facebook/pyrefly/compare/0.64.0...0.64.1">https://github.com/facebook/pyrefly/compare/0.64.0...0.64.1</a></p> <h2>Pyrefly v0.64.0</h2> <p><strong>Status : BETA</strong> <em>Release date: May 05, 2026</em></p> <p>Pyrefly v0.64.0 bundles <strong>190 commits</strong> from <strong>20 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- You can now pass generic or overloaded callables to higher-order functions and Pyrefly will preserve their structure in the return type. For example, <code>identity(identity)</code> now correctly returns a generic callable instead of degrading to <code>Unknown</code>. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Same-scope class rebinds (like <code>Real = Dummy</code> after <code>class Real</code>) are now checked against the original class as if it were an implicit <code>type[Real]</code> annotation, preventing silent type changes and fixing spurious constructor-call errors. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Generic classes with missing type arguments in lax mode now default to <code>Any</code> instead of raising variance errors, improving consistency with how we handle other incomplete types. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Pydantic <code>field_validator</code> decorators with <code>mode='before'</code> and <code>mode='plain'</code> are now supported, allowing validators to accept broader input types before coercion. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Spurious unpack diagnostics are no longer emitted when the right-hand side involves <code>Never</code> (e.g. <code>a, b, c = never()</code> or <code>a, b = (never(), 1)</code>). The unpack solver is now <code>Never</code>-aware, recognizing that the producing expression cannot complete and any error message at the unpack site would be misleading. <!-- raw HTML omitted --><!-- raw HTML omitted -->- <code>assert</code> statements now check that <code>__bool__</code> is callable on the test expression, matching the behavior already in place for <code>if</code>, <code>while</code>, and ternary expressions (and aligning with mypy and pyright).</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- The language server now advertises both <code>source.fixAll</code> and <code>source.fixAll.pyrefly</code> code action kinds, enabling selective fix-on-save configuration across editors that implement the LSP protocol. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Document highlights now correctly distinguish between read and write references, setting <code>DocumentHighlightKind::WRITE</code> for assignments and declarations. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Go-to-definition on relative imports in site-packages files now correctly resolves to the package source instead of returning null when a <code>pyproject.toml</code> exists at the project root. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Notebook cell index resolution has been fixed to prevent mismatches between code cells and markdown cells, eliminating panics and incorrect byte offset calculations in Jupyter notebooks. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Cross-module "find references" (external references) is now enabled by default, returning references across the entire project rather than just the current file. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new quick fix turns the existing "Did you mean <code>Foo.BAR</code>?" diagnostic note for missing enum members into a code action that replaces the offending string literal with the proper enum member access. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code># pyrefly: ignore</code> quick fix inserts a suppression comment for the diagnostic at the cursor, automatically merging into an existing pyrefly-ignore directive on the same line or on a comment-only line above when present. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Numeric parameter defaults now preserve their source spelling (e.g. <code>0o777</code>, <code>0xFF</code>, <code>0b101</code>) in hover and signature display rather than being normalized to decimal. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Code actions documentation has been added to the IDE Supported Features page, covering quick fixes and <code>source.fixAll.pyrefly</code> configuration.</td> </tr> <tr> <td><strong>Onboarding & VS Code Extension</strong></td> <td>- A redesigned unconfigured-project experience: when no <code>pyrefly.toml</code> is found, Pyrefly auto-detects nearby <code>mypy.ini</code>, <code>pyrightconfig.json</code>, or <code>[tool.mypy]</code>/<code>[tool.pyright]</code> sections in <code>pyproject.toml</code> and synthesizes an in-memory configuration migrated from those settings (using the <code>legacy</code> or <code>default</code> preset respectively). With no detectable configuration, the new <code>basic</code> preset is used. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code>python.pyrefly.typeCheckingMode</code> workspace setting (auto / off / basic / legacy / default / strict, default <code>auto</code>) lets users pick a preset for files not covered by an explicit Pyrefly configuration, directly from the VS Code settings UI. The legacy <code>python.pyrefly.displayTypeErrors</code> setting is now deprecated, with values transparently mapped to the new model. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code>python.pyrefly.disableTypeErrors</code> workspace setting provides a clean per-workspace kill switch for diagnostics, independent of the type-checking mode. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The VS Code status bar has been redesigned: it now shows the active preset (e.g. "Pyrefly (Legacy)", "Pyrefly (Basic)") and the tooltip explains why that preset was chosen and links to the relevant docs. <!-- raw HTML omitted --><!-- raw HTML omitted -->- After a <code>pyrefly check</code> on an unconfigured project, the CLI now prints a short upsell to <strong>stderr</strong> explaining what configuration was synthesized and pointing at <code>pyrefly init</code>. The message is routed to stderr so machine-readable stdout formats (e.g. <code>--output-format json</code>) remain untouched.</td> </tr> <tr> <td><strong>Configuration</strong></td> <td>- Configuration presets (<code>off</code>, <code>basic</code>, <code>legacy</code>, <code>default</code>, <code>strict</code>) are now available via the <code>preset</code> option, providing named collections of error severities and behavior settings as a base configuration that user settings can override. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>legacy</code> preset is now used by <code>pyrefly init</code> for mypy migration, disabling checks mypy doesn't have and setting looser inference defaults. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>implicit-any</code> error code has been split into sub-kinds (<code>implicit-any-attribute</code>, <code>implicit-any-empty-container</code>, <code>implicit-any-parameter</code>, <code>implicit-any-type-argument</code>) with <code>implicit-any</code> as the parent, allowing finer-grained control over where implicit <code>Any</code> is flagged. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>unbound-name</code> error is now disabled in the <code>legacy</code> preset to match mypy's default behavior, which does not flag possibly-undefined variables.</td> </tr> <tr> <td><strong>Error Reporting</strong></td> <td>- A new <code>incompatible-overload-residual</code> error kind has been introduced for cases where all branches of an overloaded callable are pruned during higher-order function analysis, making it easier to configure these errors independently. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Error messages for all-pruned overload residuals now describe the incompatibility in terms of "solved type variables" rather than "solved type constraints" for better clarity. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>pyrefly suppress</code> command now correctly handles removal of unused ignores via the <code>--remove-unused</code> flag, which was previously broken.</td> </tr> <tr> <td><strong>Factory Boy Support</strong></td> <td>- Pyrefly now infers the correct model return types for <code>create()</code>, <code>build()</code>, <code>create_batch()</code>, and <code>build_batch()</code> methods on <code>DjangoModelFactory</code> subclasses by reading the inner <code>Meta.model</code> attribute. <!-- raw HTML omitted --><!-- raw HTML omitted -->- False-positive <code>bad-override</code> errors on the inner <code>Meta</code> class in factory-boy factories are now suppressed, matching how we handle Django and Marshmallow.</td> </tr> <tr> <td><strong>Reporting</strong></td> <td>- The <code>pyrefly report</code> JSON output now includes a <code>path</code> field on each <code>ModuleReport</code>, for compatibility with typestats and similar tooling.</td> </tr> <tr> <td><strong>Performance</strong></td> <td>- Deeply-nested dict literals no longer cause exponential memory growth during type inference. A depth-25 dict literal that previously consumed ~7.7 GB now uses ~239 MB by computing the union of field types on demand instead of storing it redundantly. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Callable residual finalization has been optimized to avoid redundant type cloning and traversals, reducing memory churn in attribute-heavy code. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Eliminated some bugs that caused Pyrefly to unnecessarily analyze dependencies, improving latency and memory use, especially in the IDE.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed <strong>15</strong> bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3057">#3057</a>: Fixed an issue where string concatenation with the <code>+</code> operator was incorrectly flagging <code>str</code> as not assignable to <code>LiteralString</code> attributes. Pyrefly now preserves <code>LiteralString</code> style when adding two explicit string literals and uses implicit style otherwise.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/105">#105</a>: Fixed premature type pinning in function calls where arguments were incorrectly narrowed before all constraints were solved. For example, <code>foo(x, y)</code> with <code>x: int | None</code> and <code>y: int | None</code> no longer incorrectly narrows <code>x</code> to <code>None</code> when passed to a generic <code>foo[T](https://github.com/facebook/pyrefly/blob/HEAD/a: T, b: T)</code>.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3198">#3198</a>: Fixed <code>pyrefly suppress --remove-unused</code> which was not actually removing unused error suppressions. The command now correctly processes the <code>--remove-unused</code> flag.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3024">#3024</a>: The language server now advertises <code>source.fixAll.pyrefly</code> in addition to <code>source.fixAll</code>, allowing users to selectively enable or disable Pyrefly's fix-all actions in editors that support LSP code action kinds.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2819">#2819</a>: Fixed incorrect variance errors when using generic classes like Pydantic's <code>RootModel</code> in lax mode. Missing type arguments now degrade to <code>Any</code> instead of raising errors, matching our handling of other incomplete types.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3000">#3000</a>: Fixed "find references" failures in Cursor and other editors caused by relative imports in site-packages not resolving correctly when a <code>pyproject.toml</code> existed at the project root.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2563">#2563</a>: Fixed go-to-definition on relative imports in virtual environment site-packages, which was returning null because the project root's import path was matching before the more specific site-package prefix.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3193">#3193</a>: Fixed an error where <code>list["A|B"]</code> was incorrectly rejected as <code>not-a-type</code>. Type argument subscripts are now bound as type expressions even in value context, allowing forward-ref strings to be parsed.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3286">#3286</a>: Fixed exponential memory blowup when type-checking deeply-nested dict literals, which could cause VSCode to be killed by the OS. Memory usage for a depth-25 dict dropped from ~7.7 GB to ~239 MB.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3261">#3261</a>: Fixed a false positive <code>bad-class-definition</code> when a dataclass field was assigned inside a <code>@classmethod</code> or <code>__init_subclass__</code>. Pyrefly was incorrectly extracting these as dataclass fields, even though Python's <code>dataclasses.dataclass</code> ignores them at runtime.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2914">#2914</a>: <code>assert</code> statements now flag a non-callable <code>__bool__</code> on the test expression, closing a gap that previously only caught the issue inside <code>if</code>, <code>while</code>, and ternary expressions.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2867">#2867</a>: Fixed <code>urlunparse</code> being inferred as returning <code>Literal[b'']</code> instead of <code>str</code>. The fix reworks <code>as_superclass</code> so tuple-like <code>NamedTuple</code> subclasses are upcast through their erased tuple element types, which stops <code>ParseResult</code> from spuriously matching <code>Iterable[None]</code> and selecting the bytes overload.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3266">#3266</a>: Added a quick fix for the existing "Did you mean <code>Foo.BAR</code>?" diagnostic note for missing enum members, turning the suggestion into a code action that rewrites the surrounding string literal.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3230">#3230</a>: Numeric parameter defaults now preserve their original spelling (e.g. <code>0o777</code>) in hover and signature display rather than being normalized to a decimal value.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3302">#3302</a>: Added a <code>path</code> field to the <code>pyrefly report</code> JSON <code>ModuleReport</code>, restoring compatibility with typestats.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
9a47d9cf6a |
Bump gunicorn from 25.3.0 to 26.0.0 in /backend (#1708)
Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 25.3.0 to 26.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>26.0.0</h2> <h2>Breaking Changes</h2> <ul> <li><strong>Eventlet worker removed</strong>: The <code>eventlet</code> worker class has been dropped. Migrate to <code>gevent</code>, <code>gthread</code>, or <code>tornado</code>.</li> </ul> <h2>New Features</h2> <ul> <li><strong>ASGI Framework Compatibility Suite</strong>: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).</li> <li><strong>ASGI Test Suite Expansion</strong>: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.</li> </ul> <h2>Security</h2> <ul> <li><strong>HTTP/1.1 Request-Target Validation</strong> (RFC 9112 sections 3.2.3, 3.2.4): <ul> <li>Reject <code>authority-form</code> request-target outside <code>CONNECT</code></li> <li>Reject <code>asterisk-form</code> request-target outside <code>OPTIONS</code></li> <li>Reject <code>relative-reference</code> request-targets</li> </ul> </li> <li><strong>Header Field Hardening</strong> (RFC 9110): <ul> <li>Reject control characters in header field-value (section 5.5)</li> <li>Reject forbidden trailer field-names (section 6.5.1)</li> <li>Reject <code>Content-Length</code> list form (RFC 9112 section 6.3)</li> </ul> </li> <li><strong>Request Smuggling Hardening</strong>: <ul> <li>Tighten keepalive gate and scope <code>finish_body</code> byte cap</li> <li>Keep <code>_body_receiver</code> alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body</li> <li>Address parser/protocol findings from a six-point WSGI/ASGI audit</li> </ul> </li> <li><strong>PROXY Protocol (ASGI)</strong>: Enforce <code>proxy_allow_ips</code> and tighten v1/v2 parsing in the ASGI callback parser.</li> <li><strong>Connection Draining</strong>: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.</li> </ul> <h2>Bug Fixes</h2> <ul> <li><strong>Body Framing on HEAD/204/304</strong>: <ul> <li>Keep <code>Content-Length</code> on HEAD and 304 responses (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>)</li> <li>Drop body framing on HEAD/204/304 even when the framework set it</li> <li>Warn once when an ASGI app emits a body for a no-body response</li> </ul> </li> <li><strong>HTTP/2 ASGI</strong>: <ul> <li>Fix <code>_handle_stream_ended</code> to set <code>_body_complete</code> in the async HTTP/2 handler so request bodies finalize correctly on stream end</li> <li>Add <code>InvalidChunkExtension</code> mapping and fast-parser support in ASGI tests (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3565">#3565</a>)</li> </ul> </li> <li><strong>HTTP/1.1 100-Continue</strong>: Stop adding <code>Transfer-Encoding: chunked</code> to 100-Continue interim responses.</li> <li><strong>WebSocket Close Handshake</strong> (RFC 6455): <ul> <li>Comply with the close handshake state machine</li> <li>Close the transport after the close handshake completes</li> <li>Fix binary send when the <code>text</code> key is <code>None</code></li> </ul> </li> <li><strong>Early Hints</strong>: Validate headers in the <code>early_hints</code> callback to match <code>process_headers</code>; pass only the header name to <code>InvalidHeader</code> (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3588">#3588</a>).</li> <li><strong>ASGI Framework Fixes</strong>: <ul> <li>Fix ASGI disconnect handling for Django-style apps</li> <li>Fix Litestar request handling (use raw ASGI receive for body/headers)</li> <li>Fix Litestar HTTP endpoints for compatibility tests</li> <li>Fix Quart headers endpoint to normalize keys to lowercase</li> <li>Fix Quart WebSocket close test app (missing <code>accept()</code>)</li> <li>Fix duplicate <code>Transfer-Encoding</code> header for BlackSheep streaming</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
280a573976 |
Bump starlette from 1.0.0 to 1.0.1 in /backend (#1706)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.0 to 1.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.0.1</h2> <h2>What's Changed</h2> <ul> <li>Ignore malformed <code>Host</code> header when constructing <code>request.url</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3279">Kludex/starlette#3279</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.0.0...1.0.1">https://github.com/Kludex/starlette/compare/1.0.0...1.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.0.1 (May 21, 2026)</h2> <h4>Fixed</h4> <ul> <li>Ignore malformed <code>Host</code> header when constructing <code>request.url</code> <a href="https://redirect.github.com/encode/starlette/pull/3279">#3279</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
0b8e32af0a |
Bump sentry-sdk from 2.58.0 to 2.59.0 in /backend (#1704)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.58.0 to 2.59.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.59.0</h2> <h3>New Features ✨</h3> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> on Invoke Agent Spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5926">#5926</a></li> <li>Record <code>run_name</code> in <code>on_tool_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5925">#5925</a></li> <li>Record <code>run_name</code> in <code>on_chat_model_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5924">#5924</a></li> </ul> <h4>Other</h4> <ul> <li>(ci) Cancel in-progress PR workflows on new commit push by <a href="https://github.com/joshuarli"><code>@joshuarli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5994">#5994</a></li> <li>(consts) Add updated span convention constants to SPANDATA by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6093">#6093</a></li> <li>(fastapi) Support span streaming in active thread tracking by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6118">#6118</a></li> <li>(httpx) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6084">#6084</a></li> <li>(huggingface_hub) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6124">#6124</a></li> <li>(mcp) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6131">#6131</a></li> <li>Add <code>db.driver.name</code> spans to database integrations by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6082">#6082</a></li> </ul> <h3>Bug Fixes 🐛</h3> <p>We've put additional data that might contain sensitive information, like GraphQL documents, behind the <code>send_default_pii</code> option.</p> <h4>Httpx</h4> <ul> <li>Consistently early-exit when adding request source by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6151">#6151</a></li> <li>Set <code>code.namespace</code> and <code>code.function</code> instead of <code>code.function.name</code> in span streaming by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6150">#6150</a></li> </ul> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> for text completions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6073">#6073</a></li> <li>Set agent name as <code>gen_ai.agent.name</code> for chat and tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5877">#5877</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Use <code>inspect.iscoroutinefunction</code> on Python 3.14+ by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6135">#6135</a></li> <li>(batcher) Reset lock and flusher in child after fork by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6163">#6163</a></li> <li>(google_genai) Redact binary data in inline_data and fix multi-part message extraction by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5977">#5977</a></li> <li>(grpc) Add isolation_scope to async server interceptor by <a href="https://github.com/robinvd"><code>@robinvd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5940">#5940</a></li> <li>(metrics,logs) Don't attach <code>span_id</code> if no active span by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6162">#6162</a></li> <li>(monitor) Release <code>Monitor._thread_lock</code> after fork (<a href="https://redirect.github.com/getsentry/sentry-python/issues/6148">#6148</a>) by <a href="https://github.com/vokracko"><code>@vokracko</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6159">#6159</a></li> <li>(openai-agents) Resolve agent from <code>bindings</code> for openai-agents >= 0.14 by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6102">#6102</a></li> <li>(profiler) Stop nulling buffer on teardown by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6075">#6075</a></li> <li>(quart) Use <code>inspect.iscoroutinefunction</code> when Quart does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6133">#6133</a></li> <li>(security) Prevent GitHub script injection in update-tox workflow by <a href="https://github.com/fix-it-felix-sentry"><code>@fix-it-felix-sentry</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6171">#6171</a></li> <li>(starlette/fastapi) Use <code>inspect.iscoroutinefunction</code> when Starlette does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6134">#6134</a></li> <li>(tornado) Make sure context manager doesn't double yield by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6152">#6152</a></li> <li>Introduce <code>_get_current_streamed_span()</code> to keep types backwards compatible by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6177">#6177</a></li> </ul> <h3>Internal Changes 🔧</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.59.0</h2> <h3>New Features ✨</h3> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> on Invoke Agent Spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5926">#5926</a></li> <li>Record <code>run_name</code> in <code>on_tool_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5925">#5925</a></li> <li>Record <code>run_name</code> in <code>on_chat_model_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5924">#5924</a></li> </ul> <h4>Other</h4> <ul> <li>(ci) Cancel in-progress PR workflows on new commit push by <a href="https://github.com/joshuarli"><code>@joshuarli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5994">#5994</a></li> <li>(consts) Add updated span convention constants to SPANDATA by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6093">#6093</a></li> <li>(fastapi) Support span streaming in active thread tracking by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6118">#6118</a></li> <li>(httpx) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6084">#6084</a></li> <li>(huggingface_hub) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6124">#6124</a></li> <li>(mcp) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6131">#6131</a></li> <li>Add <code>db.driver.name</code> spans to database integrations by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6082">#6082</a></li> </ul> <h3>Bug Fixes 🐛</h3> <p>We've put additional data that might contain sensitive information, like GraphQL documents, behind the <code>send_default_pii</code> option.</p> <h4>Httpx</h4> <ul> <li>Consistently early-exit when adding request source by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6151">#6151</a></li> <li>Set <code>code.namespace</code> and <code>code.function</code> instead of <code>code.function.name</code> in span streaming by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6150">#6150</a></li> </ul> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> for text completions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6073">#6073</a></li> <li>Set agent name as <code>gen_ai.agent.name</code> for chat and tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5877">#5877</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Use <code>inspect.iscoroutinefunction</code> on Python 3.14+ by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6135">#6135</a></li> <li>(batcher) Reset lock and flusher in child after fork by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6163">#6163</a></li> <li>(google_genai) Redact binary data in inline_data and fix multi-part message extraction by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5977">#5977</a></li> <li>(grpc) Add isolation_scope to async server interceptor by <a href="https://github.com/robinvd"><code>@robinvd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5940">#5940</a></li> <li>(metrics,logs) Don't attach <code>span_id</code> if no active span by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6162">#6162</a></li> <li>(monitor) Release <code>Monitor._thread_lock</code> after fork (<a href="https://redirect.github.com/getsentry/sentry-python/issues/6148">#6148</a>) by <a href="https://github.com/vokracko"><code>@vokracko</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6159">#6159</a></li> <li>(openai-agents) Resolve agent from <code>bindings</code> for openai-agents >= 0.14 by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6102">#6102</a></li> <li>(profiler) Stop nulling buffer on teardown by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6075">#6075</a></li> <li>(quart) Use <code>inspect.iscoroutinefunction</code> when Quart does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6133">#6133</a></li> <li>(security) Prevent GitHub script injection in update-tox workflow by <a href="https://github.com/fix-it-felix-sentry"><code>@fix-it-felix-sentry</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6171">#6171</a></li> <li>(starlette/fastapi) Use <code>inspect.iscoroutinefunction</code> when Starlette does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6134">#6134</a></li> <li>(tornado) Make sure context manager doesn't double yield by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6152">#6152</a></li> <li>Introduce <code>_get_current_streamed_span()</code> to keep types backwards compatible by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6177">#6177</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
119d097795 |
Bump pyrefly from 0.62.0 to 0.63.1 in /backend (#1703)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.62.0 to 0.63.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.63.1</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/facebook/pyrefly/compare/0.63.0...0.63.1">https://github.com/facebook/pyrefly/compare/0.63.0...0.63.1</a></p> <h2>Pyrefly v0.63.0</h2> <p><strong>Status : BETA</strong> <em>Release date: April 27, 2026</em></p> <p>Pyrefly v0.63.0 bundles <strong>129 commits</strong> from <strong>26 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- Enum member types are preserved even when the metaclass conflicts with <code>EnumMeta</code>, reducing noise in projects using custom metaclasses with enums. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Constrained <code>TypeVar</code>s no longer get pinned to a specific constraint when matched against <code>Any</code>, preventing false positives. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Self/cls annotations on all methods and classmethods are validated to ensure they reference the defining class or a superclass, catching more annotation errors.</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- The LSP now reports <code>unused-ignore</code> diagnostics when configured to do so, helping you clean up stale suppression comments. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Completions for attribute override definitions are available in class bodies, surfacing base-class members filtered by fuzzy match. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The LSP server no longer crashes on Jupyter notebook cell URIs (<code>vscode-notebook-cell:</code>), with full support for resolving notebook cell paths and position offsets. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Workspace symbol search uses the correct location for re-exported symbols, preventing panics on multi-byte UTF-8 characters. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Inlay hints are clickable for built-in types like <code>tuple</code>, <code>dict</code>, and <code>str</code>, enabling go-to-definition directly from hint overlays.</td> </tr> <tr> <td><strong>Error Messages</strong></td> <td>- A new <code>unnecessary-type-conversion</code> lint warns when <code>str()</code>, <code>int()</code>, or <code>float()</code> is called on an argument that is already of that exact type.</td> </tr> <tr> <td><strong>Reporting & Coverage</strong></td> <td>- Public symbol filtering is available via <code>pyrefly report --public-only</code>, using cross-module tracing to report only public symbols.</td> </tr> <tr> <td><strong>Performance</strong></td> <td>- TypedDict subset checks are now cached on the Solver, reducing CPU time by ~5.3x and wall time by ~6.7x on pydantic (from 9.5s to 1.4s).</td> </tr> <tr> <td><strong>Configuration & Initialization</strong></td> <td>- <code>pyrefly init</code> supports <code>--dry-run</code> for safe previews without writing files, and <code>--print-config</code> for machine-readable TOML output.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed <strong>9</strong> bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3099">#3099</a>: Fixed an issue where property setters and deleters inflated typable counts in <code>pyrefly report</code> by incorrectly counting their trivial <code>-> None</code> return types.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3098">#3098</a>: Fixed an issue where overloads in <code>pyrefly report</code> were not deduplicated, causing parameters and callable signatures to be counted multiple times and inflate coverage metrics.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3067">#3067</a>: Fixed an issue where the type display path was dropping the unpack marker (<code>*</code>) for direct <code>TypeVarTuple</code> arguments, causing <code>Shape</code> to render bare instead of <code>*Shape</code>.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3040">#3040</a>: Fixed an issue where properties on metaclasses were not taking precedence over properties on the class during class-level attribute access, causing false <code>bad-assignment</code> and <code>bad-return</code> errors.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3150">#3150</a>: Fixed an issue where type aliases were inflating type coverage in <code>pyrefly report</code> by being counted as typable entities.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3041">#3041</a>: Fixed a panic during workspace/symbol requests on re-exported symbols with multi-byte UTF-8 characters, caused by using the canonical module's byte offset against the re-exporting file's buffer.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3109">#3109</a>: Added a new <code>unnecessary-type-conversion</code> lint that warns when <code>str()</code>, <code>int()</code>, or <code>float()</code> is called on an argument that is already of that exact type, making the conversion redundant.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3187">#3187</a>: Fixed a panic in <code>pyrefly report</code> when <code>@no_type_check</code> decorator was used, caused by a missing key lookup for skipped parameter annotations.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3090">#3090</a>: Improved the unused-coroutine error message when an <code>await</code> expression already has <code>await</code> but produces a coroutine due to an incorrect return type annotation on the function definition.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==0.63.0 </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
1e1e1788e6 |
Bump uvicorn from 0.44.0 to 0.46.0 in /backend (#1698)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.44.0 to 0.46.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.46.0</h2> <h2>What's Changed</h2> <ul> <li>Support <code>ws_max_size</code> in <code>wsproto</code> implementation by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2915">Kludex/uvicorn#2915</a></li> <li>Support <code>ws_ping_interval</code> and <code>ws_ping_timeout</code> in <code>wsproto</code> implementation by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2916">Kludex/uvicorn#2916</a></li> <li>Use <code>bytearray</code> for incoming WebSocket message buffer in websockets-sansio by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2917">Kludex/uvicorn#2917</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.45.0...0.46.0">https://github.com/Kludex/uvicorn/compare/0.45.0...0.46.0</a></p> <h2>Version 0.45.0</h2> <h2>What's Changed</h2> <ul> <li>Preserve forwarded client ports in proxy headers middleware by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2903">Kludex/uvicorn#2903</a></li> <li>Accept <code>os.PathLike</code> for <code>log_config</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2905">Kludex/uvicorn#2905</a></li> <li>Accept <code>log_level</code> strings case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2907">Kludex/uvicorn#2907</a></li> <li>Raise helpful <code>ImportError</code> when PyYAML is missing for YAML log config by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2906">Kludex/uvicorn#2906</a></li> <li>Revert empty context for ASGI runs by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2911">Kludex/uvicorn#2911</a></li> <li>Add <code>--reset-contextvars</code> flag to isolate ASGI request context by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2912">Kludex/uvicorn#2912</a></li> <li>Revert "Emit <code>http.disconnect</code> on server shutdown for streaming responses" (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2829">#2829</a>) by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2913">Kludex/uvicorn#2913</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Krishnachaitanyakc"><code>@Krishnachaitanyakc</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2870">Kludex/uvicorn#2870</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.44.0...0.45.0">https://github.com/Kludex/uvicorn/compare/0.44.0...0.45.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.46.0 (April 23, 2026)</h2> <h3>Added</h3> <ul> <li>Support <code>ws_max_size</code> in <code>wsproto</code> implementation (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2915">#2915</a>)</li> <li>Support <code>ws_ping_interval</code> and <code>ws_ping_timeout</code> in <code>wsproto</code> implementation (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2916">#2916</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Use <code>bytearray</code> for incoming WebSocket message buffer in <code>websockets-sansio</code> (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2917">#2917</a>)</li> </ul> <h2>0.45.0 (April 21, 2026)</h2> <h3>Added</h3> <ul> <li>Add <code>--reset-contextvars</code> flag to isolate ASGI request context (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2912">#2912</a>)</li> <li>Accept <code>os.PathLike</code> for <code>log_config</code> (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2905">#2905</a>)</li> <li>Accept <code>log_level</code> strings case-insensitively (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2907">#2907</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Revert "Emit <code>http.disconnect</code> on server shutdown for streaming responses" (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2913">#2913</a>)</li> <li>Revert "Explicitly start ASGI run with empty context" (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2911">#2911</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Preserve forwarded client ports in proxy headers middleware (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2903">#2903</a>)</li> <li>Raise helpful <code>ImportError</code> when PyYAML is missing for YAML log config (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2906">#2906</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
38efd1e2b9 |
Bump pydantic-settings from 2.13.0 to 2.14.0 in /backend (#1697)
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.13.0 to 2.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's releases</a>.</em></p> <blockquote> <h2>v2.14.0</h2> <h2>What's Changed</h2> <ul> <li>Fix parsing env vars into Optional Strict types by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/792">pydantic/pydantic-settings#792</a></li> <li>Fix RecursionError with mutually recursive models in CLI by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/794">pydantic/pydantic-settings#794</a></li> <li>Fix env_file from model_config ignored in CliApp.run() (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/795">#795</a>) by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/796">pydantic/pydantic-settings#796</a></li> <li>Update dependencies by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/798">pydantic/pydantic-settings#798</a></li> <li>Add Dependabot configuration by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/801">pydantic/pydantic-settings#801</a></li> <li>Bump samuelcolvin/check-python-version from 4.1 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/802">pydantic/pydantic-settings#802</a></li> <li>Bump actions/upload-artifact from 4 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/803">pydantic/pydantic-settings#803</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/804">pydantic/pydantic-settings#804</a></li> <li>Bump astral-sh/setup-uv from 5 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/805">pydantic/pydantic-settings#805</a></li> <li>Bump actions/setup-python from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/806">pydantic/pydantic-settings#806</a></li> <li>Ignore chardet and group GitHub Actions in Dependabot by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/808">pydantic/pydantic-settings#808</a></li> <li>Bump actions/download-artifact from 4 to 8 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/809">pydantic/pydantic-settings#809</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/810">pydantic/pydantic-settings#810</a></li> <li>Support reading .env files from FIFOs (e.g. 1Password Environments) by <a href="https://github.com/JacobHayes"><code>@JacobHayes</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/776">pydantic/pydantic-settings#776</a></li> <li>Fix AliasChoices ignored when changing provider priority by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/813">pydantic/pydantic-settings#813</a></li> <li>fix: resolve KeyError in run_subcommand for underscore field names by <a href="https://github.com/bradykieffer"><code>@bradykieffer</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/799">pydantic/pydantic-settings#799</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/814">pydantic/pydantic-settings#814</a></li> <li>Fix <code>Literal[numeric Enum]</code> coercion for CLI and env vars by <a href="https://github.com/m9810223"><code>@m9810223</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/811">pydantic/pydantic-settings#811</a></li> <li>Fix nested discriminated unions not discovered by env/CLI providers by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/816">pydantic/pydantic-settings#816</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/820">pydantic/pydantic-settings#820</a></li> <li>CLI ensure env nested max split internally. by <a href="https://github.com/kschwab"><code>@kschwab</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/821">pydantic/pydantic-settings#821</a></li> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/824">pydantic/pydantic-settings#824</a></li> <li>Migrate <code>boto3-stubs</code> to <code>types-boto3</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/831">pydantic/pydantic-settings#831</a></li> <li>Fix CLI not recognizing field name with validate_by_name and AliasChoices by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/826">pydantic/pydantic-settings#826</a></li> <li>Allow customisation of the dotevn setting source to filter variables by <a href="https://github.com/CaselIT"><code>@CaselIT</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/832">pydantic/pydantic-settings#832</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/833">pydantic/pydantic-settings#833</a></li> <li>Introduce yamlfmt by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/836">pydantic/pydantic-settings#836</a></li> <li>Bump boto3 from 1.42.82 to 1.42.83 in the python-packages group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/837">pydantic/pydantic-settings#837</a></li> <li>Introduce zizmor by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/838">pydantic/pydantic-settings#838</a></li> <li>Fix CliPositionalArg[list[CustomType]] crash for custom types by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/839">pydantic/pydantic-settings#839</a></li> <li>Add note about Mypy plugin for <code>BaseSettings.__init__()</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/842">pydantic/pydantic-settings#842</a></li> <li>Fix <code>cli_ignore_unknown_args=True</code> not working on subcommands by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/844">pydantic/pydantic-settings#844</a></li> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/847">pydantic/pydantic-settings#847</a></li> <li>Fix CLI descriptions lost under <code>python -OO</code> by falling back to <code>json_schema_extra</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/843">pydantic/pydantic-settings#843</a></li> <li>Prepare release 2.14.0 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/848">pydantic/pydantic-settings#848</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/802">pydantic/pydantic-settings#802</a></li> <li><a href="https://github.com/JacobHayes"><code>@JacobHayes</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/776">pydantic/pydantic-settings#776</a></li> <li><a href="https://github.com/bradykieffer"><code>@bradykieffer</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/799">pydantic/pydantic-settings#799</a></li> <li><a href="https://github.com/CaselIT"><code>@CaselIT</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/832">pydantic/pydantic-settings#832</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0">https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0</a></p> <h2>v2.13.1</h2> <h2>What's Changed</h2> <ul> <li>Fix regression for bool fields since 2.13.0 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/784">pydantic/pydantic-settings#784</a></li> <li>Fix RecursionError with self-referential models in CliApp by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/783">pydantic/pydantic-settings#783</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4fb0d150f5 |
Bump pyrefly from 0.61.1 to 0.62.0 in /backend (#1696)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.61.1 to 0.62.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.62.0</h2> <p><strong>Status : BETA</strong> <em>Release date: April 20, 2026</em></p> <p>Pyrefly v0.62.0 bundles <strong>87 commits</strong> from <strong>23 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- <code>TypeVarTuple</code> inference has been changed to be consistent with <code>TypeVar</code>, per a recent change to the typing spec. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Errors logged during speculative union checks and overload calls are now reverted, eliminating a source of confusing false positives. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Union-typed decorators that return fully unknown types (either <code>Unknown</code> or callables with all-unknown signatures) preserve the original function signature instead of replacing it with <code>Unknown</code>, reducing false positives by ~23% on TensorFlow.</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- Semantic tokens and completions work for <code>inmemory://</code> documents on Windows. <!-- raw HTML omitted --><!-- raw HTML omitted -->- LSP server crashes from out-of-range line numbers in client requests are prevented by clamping positions to the buffer's valid range.</td> </tr> <tr> <td><strong>Error Reporting</strong></td> <td>- Error kinds can now have sub-kinds that can be disabled using their shared prefix. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Invariance checks for mutable attributes (corresponding to mypy's <code>mutable-override</code> opt-in behavior) have been moved to a new <code>bad-override-mutable-attribute</code> error code that is a sub-kind of <code>bad-override</code>. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>bad-param-name-override</code> error has been renamed to <code>bad-override-param-name</code> and made a sub-kind of <code>bad-override</code>. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Sub-configs that define <code>[errors]</code> inherit the root config's error severity overrides for any codes they don't explicitly set.</td> </tr> <tr> <td><strong>Configuration</strong></td> <td>- When migrating from mypy via <code>pyrefly init</code>, <code>bad-override-mutable-attribute</code> is disabled by default to match mypy's behavior. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Project excludes (e.g., <code>project-excludes = ["**/*.ipynb"]</code>) no longer block discovery of <code>.py</code> files when the default <code>project-includes</code> contains both <code>**/*.py*</code> and <code>**/*.ipynb</code>.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed 12 bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3118">#3118</a>: Fixed incorrect stub package recommendations for typeshed third-party libraries. Pyrefly now suggests the correct package name (e.g., <code>types-python-dateutil</code> for the <code>dateutil</code> module, not <code>types-dateutil</code>) by extracting the module→package mapping from the bundled typeshed archive, preventing potential typosquatting.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3081">#3081</a>: Fixed NewType wrappers with NoneType bases being incorrectly rejected or treated inconsistently. <code>NewType("NewNoneType", NoneType)</code> is now accepted as a valid nominal type declaration, and plain <code>None</code> is correctly rejected where <code>NewNoneType</code> is required.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3052">#3052</a>: Fixed false positive <code>unexpected-keyword</code> errors for named parameters before <code>*args: P.args</code>. Functions like <code>call_with_retry(f, max_attempts=10, *args: P.args, **kwargs: P.kwargs)</code> now correctly allow <code>max_attempts</code> to be passed as a keyword argument, matching mypy and pyright behavior.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3110">#3110</a>: Fixed LSP server crashes when the client sends a position with a line number beyond the end of the buffer (e.g., after a <code>DidChangeTextDocument</code> race where the file was truncated). Out-of-range positions now map to EOF instead of panicking.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2912">#2912</a>: Fixed false positive <code>bad-argument-type</code> for <code>list(null_values.items())</code> when the return type hint is a union like <code>Sequence[str] | list[tuple[str, str]]</code>. Pyrefly now tries constructing the class with each union member independently and unions the results, ensuring the inferred type is assignable to the hint.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2644">#2644</a>: Fixed false positive <code>bad-argument-type</code> when calling a method with <code>AnyStr</code>. Placeholder variables used during overload resolution are now saved and restored around overload calls, preventing <code>AnyStr</code> from being incorrectly specialized to <code>str</code> and polluting subsequent checks.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2872">#2872</a>: Fixed false positive <code>invalid-type-var</code> for generic functions captured as closure default arguments. The <code>Visit</code> implementation for <code>DefaultValue</code> now calls <code>visit</code> instead of <code>recurse</code>, ensuring type-level visitors see the <code>Type</code> node stored in the default value.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3159">#3159</a>: Fixed incorrect type inference for <code>.value</code> on enum members with non-data-type mixins. Mixins that don't define <code>__new__</code> (e.g., <code>class Meta: pass</code>) are no longer treated as data type mixins, so <code>Foo.bar.value</code> correctly returns <code>Literal[1]</code> instead of <code>Meta</code>.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3161">#3161</a>: Fixed false positive <code>bad-argument-type</code> for overloaded functions with vararg unpacking (e.g., <code>*args: *tuple[int, str]</code>). Type check errors for unpacked varargs are now sent to <code>call_errors</code> instead of <code>arg_errors</code>, so they don't cause the overload to be incorrectly rejected.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3047">#3047</a>: Fixed false positive <code>bad-specialization</code> when matching a type variable against a union like <code>N | Iterable[N]</code>. Pyrefly now uses snapshot-based rollback when trying each union member, ensuring specialization errors from one branch don't leak into the final result if another branch succeeds without errors.</li> <li>And more! <a href="https://redirect.github.com/facebook/pyrefly/issues/3122">#3122</a>, <a href="https://redirect.github.com/facebook/pyrefly/issues/3080">#3080</a>, <a href="https://redirect.github.com/facebook/pyrefly/issues/3074">#3074</a></li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==0.62.0 </code></pre> <h3>How to safely upgrade your codebase</h3> <p>Upgrading the version of Pyrefly you're using or a third-party library you depend on can reveal new type errors in your code. Fixing them all at once is often unrealistic. We've written scripts to help you temporarily silence them. After upgrading, follow these steps:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
a6eba4cbe4 |
Bump idna from 3.11 to 3.15 in /backend (#1692)
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
a4ebc13c6b |
Bump pydantic from 2.12.4 to 2.13.2 in /backend (#1691)
Bumps [pydantic](https://github.com/pydantic/pydantic) from 2.12.4 to 2.13.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.13.2 2026-04-17</h2> <h2>v2.13.2 (2026-04-17)</h2> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Fix <code>ValidationInfo.field_name</code> missing with <code>model_validate_json()</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13084">#13084</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic/compare/v2.13.1...v2.13.2">https://github.com/pydantic/pydantic/compare/v2.13.1...v2.13.2</a></p> <h2>v2.13.1 2026-04-15</h2> <h2>v2.13.1 (2026-04-15)</h2> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Fix <code>ValidationInfo.data</code> missing with <code>model_validate_json()</code> by <a href="https://github.com/davidhewitt"><code>@davidhewitt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13079">#13079</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic/compare/v2.13.0...v2.13.1">https://github.com/pydantic/pydantic/compare/v2.13.0...v2.13.1</a></p> <h2>v2.13.0 2026-04-13</h2> <h2>v2.13.0 (2026-04-13)</h2> <p>The highlights of the v2.13 release are available in the <a href="https://pydantic.dev/articles/pydantic-v2-13-release">blog post</a>. Several minor changes (considered non-breaking changes according to our <a href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p>This release contains the updated <code>pydantic.v1</code> namespace, matching version 1.10.26 which includes support for Python 3.14.</p> <h3>What's Changed</h3> <p>See the beta releases for all changes sinces 2.12.</p> <h4>Packaging</h4> <ul> <li>Add zizmor for GitHub Actions workflow linting by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li> <li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li> </ul> <h4>New Features</h4> <ul> <li>Allow default factories of private attributes to take validated model data by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li> </ul> <h4>Changes</h4> <ul> <li>Warn when serializing fixed length tuples with too few items by <a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h4>Fixes</h4> <ul> <li>Change type of <code>Any</code> when synthesizing <code>_build_sources</code> for <code>BaseSettings.__init__()</code> signature in the mypy plugin by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/main/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.13.2 (2026-04-17)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.2">GitHub release</a></p> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Fix <code>ValidationInfo.field_name</code> missing with <code>model_validate_json()</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13084">#13084</a></li> </ul> <h2>v2.13.1 (2026-04-15)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.1">GitHub release</a></p> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Fix <code>ValidationInfo.data</code> missing with <code>model_validate_json()</code> by <a href="https://github.com/davidhewitt"><code>@davidhewitt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13079">#13079</a></li> </ul> <h2>v2.13.0 (2026-04-13)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0">GitHub release</a></p> <p>The highlights of the v2.13 release are available in the <a href="https://pydantic.dev/articles/pydantic-v2-13-release">blog post</a>. Several minor changes (considered non-breaking changes according to our <a href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p>This release contains the updated <code>pydantic.v1</code> namespace, matching version 1.10.26 which includes support for Python 3.14.</p> <h3>What's Changed</h3> <p>See the beta releases for all changes sinces 2.12.</p> <h4>New Features</h4> <ul> <li>Allow default factories of private attributes to take validated model data by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li> </ul> <h4>Changes</h4> <ul> <li>Warn when serializing fixed length tuples with too few items by <a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h4>Fixes</h4> <ul> <li>Change type of <code>Any</code> when synthesizing <code>_build_sources</code> for <code>BaseSettings.__init__()</code> signature in the mypy plugin by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li> <li>Fix model equality when using runtime <code>extra</code> configuration by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li> </ul> <h4>Packaging</h4> <ul> <li>Add zizmor for GitHub Actions workflow linting by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
c5be5378bf |
Bump pyrefly from 0.60.0 to 0.61.1 in /backend (#1690)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.60.0 to 0.61.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.61.1</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/facebook/pyrefly/compare/0.61.0...0.61.1">https://github.com/facebook/pyrefly/compare/0.61.0...0.61.1</a></p> <h2>Pyrefly v0.61.0</h2> <p><strong>Status : BETA</strong> <em>Release date: April 13, 2026</em></p> <p>Pyrefly v0.61.0 bundles <strong>85 commits</strong> from <strong>21 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- Division, floor division, and modulo operations with a literal zero divisor (e.g., <code>x / 0</code>, <code>y // 0</code>, <code>z % 0</code>) are flagged as errors, catching runtime <code>ZeroDivisionError</code> before execution. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Multiple inheritance with conflicting <code>__slots__</code> definitions is detected and reported as an error, matching CPython's runtime behavior and preventing layout conflicts. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Protocol members assigned a value without an explicit type annotation (e.g., <code>x = None</code> in a <code>Protocol</code> class body) are flagged as errors, ensuring protocol members have declared types as required by the typing specification.</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- Variables used exclusively within f-string format specifiers (e.g., <code>f"{key:<{max_len}}"</code>) are correctly recognized as used, eliminating false positive unused-variable warnings. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The VS Code extension explicitly declares workspace trust capabilities, requiring trusted workspaces to run and allowing machine-overridable scope for <code>lspPath</code> and <code>lspArguments</code> settings for improved security.</td> </tr> <tr> <td><strong>Coverage Reporting</strong></td> <td>- The <code>pyrefly report</code> command now excludes some dunder methods and typing-only constructs from coverage metrics. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Per-module JSON output includes entity counts (n_functions, n_methods, n_function_params, n_method_params, n_classes, n_attrs, n_properties, n_type_ignores) for downstream consumers. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code>--module <name></code> CLI flag allows overriding the module name in JSON output, supporting callers that need canonical package names instead of filesystem-derived names.</td> </tr> <tr> <td><strong>Pydantic</strong></td> <td>- Pydantic lax conversion special-cases regex patterns, fixing false positives when passing compiled patterns to Pydantic models.</td> </tr> <tr> <td><strong>Performance</strong></td> <td>- Fixed a bug in overload evaluation that caused exponential memory consumption and indefinite hangs on code with many overloaded calls.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed <strong>9</strong> bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3031">#3031</a>: Fixed a crash in mypy_primer caused by a variable leak in <code>LitEnum</code> — types are now deep-forced before storage to prevent leaking vars into the solver.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2915">#2915</a>: Division, floor division, and modulo by literal <code>0</code> are now flagged as errors, catching <code>ZeroDivisionError</code> at static analysis time instead of runtime.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3009">#3009</a>: Fixed false positive unused-variable warnings for variables used exclusively within f-string format specifiers (e.g., <code>f"{key:<{max_len}}"</code>). The AST visitor now correctly descends into <code>format_spec</code> nodes.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2799">#2799</a>: Fixed false positive <code>[missing-attribute]</code> errors for <code>dict.setdefault(key, []).append(val)</code> on unannotated dicts. Overload resolution now creates fresh partial variables for each overload, preventing incorrect pinning.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2991">#2991</a>: Fixed Pydantic lax-mode rewriting <code>re.Pattern[str]</code> to <code>Pattern[LaxStr]</code> and rejecting <code>re.Pattern[str]</code>. Regex patterns now expand to <code>re.Pattern[T] | T</code> instead of recursively widening the inner type.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2916">#2916</a>: Fixed runtime <code>TypeError</code> from multiple inheritance with conflicting <code>__slots__</code> (same slot names). Pyrefly now detects and reports this layout conflict during class metadata computation.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2917">#2917</a>: Fixed runtime <code>TypeError</code> from multiple inheritance with conflicting <code>__slots__</code> (different slot names). Pyrefly now detects non-empty <code>__slots__</code> in multiple bases and reports the conflict.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3064">#3064</a>: Fixed false positive when using <code>issubclass()</code> after <code>isinstance()</code> narrowing with custom metaclasses (e.g., Django's <code>ModelBase</code>). Metaclass instances are now correctly accepted as valid class objects.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3030">#3030</a>: Fixed false positive <code>LiteralString</code> type error in <code>map(str.strip, ...)</code>. Overloads with narrower <code>self</code>-type annotations are now filtered out during unbound method resolution.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==0.61.0 </code></pre> <h3>How to safely upgrade your codebase</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
2146f245a0 |
Bump sentry-sdk from 2.57.0 to 2.58.0 in /backend (#1689)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.57.0 to 2.58.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.58.0</h2> <h3>New Features ✨</h3> <ul> <li>(ai) Redact base64 data URLs in image_url content blocks by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5953">#5953</a></li> <li>(integrations) Instrument pyreqwest tracing by <a href="https://github.com/servusdei2018"><code>@servusdei2018</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5682">#5682</a></li> <li>(litellm) Add async callbacks by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5969">#5969</a></li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Anthropic</h4> <ul> <li>Capture exceptions for <code>stream()</code> calls by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5950">#5950</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5717">#5717</a></li> <li>Only finish relevant spans in .create() patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5716">#5716</a></li> </ul> <h4>Pydantic Ai</h4> <ul> <li>Adapt import for new library versions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5984">#5984</a></li> <li>Use first-class hooks when available by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5947">#5947</a></li> </ul> <h4>Other</h4> <ul> <li>(huggingface_hub) Stop setting transaction status when a child span fails by <a href="https://github.com/Zenithatic"><code>@Zenithatic</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5952">#5952</a></li> <li>(litellm) Avoid double span exits when streaming by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5933">#5933</a></li> <li>(wsgi) Respect HTTP_X_FORWARDED_PROTO in request.url construction by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5963">#5963</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Litellm</h4> <ul> <li>Replace mocks with <code>httpx</code> types in rate-limit test by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5975">#5975</a></li> <li>Replace mocks with <code>httpx</code> types in embedding tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5970">#5970</a></li> <li>Replace mocks with <code>httpx</code> types in nonstreaming <code>completion()</code> tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5937">#5937</a></li> <li>Remove dead attributes by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5985">#5985</a></li> </ul> <h4>Other</h4> <ul> <li>(ai) Remove <code>gen_ai.tool.type</code> span attribute by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5964">#5964</a></li> <li>(anthropic) Separate sync and async .create() patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5715">#5715</a></li> <li>(openai) Split token counting by API for easier deprecation by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5930">#5930</a></li> <li>(openai-agents) Remove error attributes by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5986">#5986</a></li> <li>(opentelemetry) Ignore mypy error by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5927">#5927</a></li> <li>🤖 Update test matrix with new releases (04/13) by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5983">#5983</a></li> <li>Fix license metadata in setup.py by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5934">#5934</a></li> <li>Update validate-pr workflow by <a href="https://github.com/stephanie-anderson"><code>@stephanie-anderson</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5931">#5931</a></li> </ul> <h3>Other</h3> <ul> <li>Handle <code>None</code> span context in the span processor and pin tokenizers version for anthropic tests on Python 3.8 by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5967">#5967</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.58.0</h2> <h3>New Features ✨</h3> <ul> <li>(ai) Redact base64 data URLs in image_url content blocks by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5953">#5953</a></li> <li>(integrations) Instrument pyreqwest tracing by <a href="https://github.com/servusdei2018"><code>@servusdei2018</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5682">#5682</a></li> <li>(litellm) Add async callbacks by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5969">#5969</a></li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Anthropic</h4> <ul> <li>Capture exceptions for <code>stream()</code> calls by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5950">#5950</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5717">#5717</a></li> <li>Only finish relevant spans in .create() patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5716">#5716</a></li> </ul> <h4>Pydantic Ai</h4> <ul> <li>Adapt import for new library versions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5984">#5984</a></li> <li>Use first-class hooks when available by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5947">#5947</a></li> </ul> <h4>Other</h4> <ul> <li>(huggingface_hub) Stop setting transaction status when a child span fails by <a href="https://github.com/Zenithatic"><code>@Zenithatic</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5952">#5952</a></li> <li>(litellm) Avoid double span exits when streaming by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5933">#5933</a></li> <li>(wsgi) Respect HTTP_X_FORWARDED_PROTO in request.url construction by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5963">#5963</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Litellm</h4> <ul> <li>Replace mocks with <code>httpx</code> types in rate-limit test by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5975">#5975</a></li> <li>Replace mocks with <code>httpx</code> types in embedding tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5970">#5970</a></li> <li>Replace mocks with <code>httpx</code> types in nonstreaming <code>completion()</code> tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5937">#5937</a></li> <li>Remove dead attributes by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5985">#5985</a></li> </ul> <h4>Other</h4> <ul> <li>(ai) Remove <code>gen_ai.tool.type</code> span attribute by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5964">#5964</a></li> <li>(anthropic) Separate sync and async .create() patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5715">#5715</a></li> <li>(openai) Split token counting by API for easier deprecation by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5930">#5930</a></li> <li>(openai-agents) Remove error attributes by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5986">#5986</a></li> <li>(opentelemetry) Ignore mypy error by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5927">#5927</a></li> <li>🤖 Update test matrix with new releases (04/13) by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5983">#5983</a></li> <li>Fix license metadata in setup.py by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5934">#5934</a></li> <li>Update validate-pr workflow by <a href="https://github.com/stephanie-anderson"><code>@stephanie-anderson</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5931">#5931</a></li> </ul> <h3>Other</h3> <ul> <li>Handle <code>None</code> span context in the span processor and pin tokenizers version for anthropic tests on Python 3.8 by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5967">#5967</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
48551b09f7 |
Bump fastapi from 0.135.3 to 0.136.0 in /backend (#1688)
Bumps [fastapi](https://github.com/fastapi/fastapi) from 0.135.3 to 0.136.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastapi/fastapi/releases">fastapi's releases</a>.</em></p> <blockquote> <h2>0.136.0</h2> <h3>Upgrades</h3> <ul> <li>⬆️ Support free-threaded Python 3.14t. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15149">#15149</a> by <a href="https://github.com/svlandeg"><code>@svlandeg</code></a>.</li> </ul> <h2>0.135.4</h2> <h3>Refactors</h3> <ul> <li>🔥 Remove April Fool's <code>@app.vibe()</code> 🤪. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15363">#15363</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <h3>Internal</h3> <ul> <li>⬆ Bump cryptography from 46.0.5 to 46.0.7. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15314">#15314</a> by <a href="https://github.com/apps/dependabot"><code>@dependabot[bot]</code></a>.</li> <li>⬆ Bump strawberry-graphql from 0.307.1 to 0.312.3. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15309">#15309</a> by <a href="https://github.com/apps/dependabot"><code>@dependabot[bot]</code></a>.</li> <li>🔨 Add pre-commit hook to ensure latest release header has date. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15293">#15293</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
e6abd7d282 |
Bump urllib3 from 2.6.3 to 2.7.0 in /backend (#1681)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.7.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially. (Reported by <a href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>)</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <a href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by <a href="https://github.com/kimkou2024"><code>@kimkou2024</code></a>)</li> </ol> <p>See GHSA-mf9v-mfxr-j63j for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a href="https://github.com/christos-spearbit"><code>@christos-spearbit</code></a>)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li> <li>Removed support for end-of-life Python 3.9. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li> <li>Removed support for end-of-life PyPy3.10. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li> <li>Fixed <code>HTTPResponse.stream()</code> and <code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li> <li>Updated <code>_TYPE_BODY</code> type alias to include missing <code>Iterable[str]</code>, matching the documented and runtime behavior of chunked request bodies. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li> <li>Fixed <code>LocationParseError</code> when paths resembling schemeless URIs were passed to <code>HTTPConnectionPool.urlopen()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li> <li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to accept <code>memoryview</code> in addition to <code>bytearray</code>, matching the <code>io.RawIOBase.readinto</code> contract and enabling use with <code>io.BufferedReader</code> without type errors. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.7.0 (2026-05-07)</h1> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially.</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <code>Brotli <https://pypi.org/project/brotli/></code>__ library.</li> </ol> <p>See <code>GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j></code>__ for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (<code>GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc></code>__)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<code>[#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763></code>__)</li> <li>Removed support for end-of-life Python 3.9. (<code>[#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720></code>__)</li> <li>Removed support for end-of-life PyPy3.10. (<code>[#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979></code>__)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<code>[#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777></code>__)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<code>[#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636></code>__)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
7a1c2b0c4e |
Bump python-multipart from 0.0.26 to 0.0.27 in /backend (#1680)
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.26 to 0.0.27. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>0.0.27</h2> <h2>What's Changed</h2> <ul> <li>Pass parse offsets via constructors by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/268">Kludex/python-multipart#268</a></li> <li>Add multipart header limits by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/267">Kludex/python-multipart#267</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.26...0.0.27">https://github.com/Kludex/python-multipart/compare/0.0.26...0.0.27</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.27 (2026-04-27)</h2> <ul> <li>Add multipart header limits <a href="https://redirect.github.com/Kludex/python-multipart/pull/267">#267</a>.</li> <li>Pass parse offsets via constructors <a href="https://redirect.github.com/Kludex/python-multipart/pull/268">#268</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
0f626c344b |
Bump mako from 1.3.11 to 1.3.12 in /backend (#1679)
Bumps [mako](https://github.com/sqlalchemy/mako) from 1.3.11 to 1.3.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/mako/releases">mako's releases</a>.</em></p> <blockquote> <h1>1.3.12</h1> <p>Released: Tue Apr 28 2026</p> <h2>bug</h2> <ul> <li> <p><strong>[bug] [template]</strong> Fixed issue in <code>TemplateLookup</code> where a URI with backslash path separators (e.g. <code>\..\secret.txt</code>) could bypass the directory traversal check on Windows, allowing reads of arbitrary files outside of the template directory. Backslash characters in URIs are now normalized to forward slashes before path resolution.</p> <p>References: <a href="https://redirect.github.com/sqlalchemy/mako/issues/435">#435</a></p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/mako/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/evroon/bracket/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
110833b014 |
Bump starlette from 0.52.1 to 1.0.0 in /backend (#1675)
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.0.0</h2> <p>Starlette 1.0 is here! 🎉</p> <p>After nearly eight years since its creation, Starlette has reached its first stable release.</p> <p>A special thank you to <a href="https://github.com/lovelydinosaur"><code>@lovelydinosaur</code></a>, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏</p> <p>Thank you to <a href="https://github.com/adriangb"><code>@adriangb</code></a>, <a href="https://github.com/graingert"><code>@graingert</code></a>, <a href="https://github.com/agronholm"><code>@agronholm</code></a>, <a href="https://github.com/florimondmanca"><code>@florimondmanca</code></a>, <a href="https://github.com/aminalaee"><code>@aminalaee</code></a>, <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>, <a href="https://github.com/alex-oleshkevich"><code>@alex-oleshkevich</code></a>, <a href="https://github.com/abersheeran"><code>@abersheeran</code></a>, and <a href="https://github.com/uSpike"><code>@uSpike</code></a> for helping make Starlette what it is today. And to all my sponsors - especially <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>, <a href="https://github.com/huggingface"><code>@huggingface</code></a>, and <a href="https://github.com/elevenlabs"><code>@elevenlabs</code></a> - thank you for your support!</p> <p>Thank you to all <a href="https://github.com/encode/starlette/graphs/contributors">290+ contributors</a> who have shaped Starlette over the years! ❤️</p> <p>Read more on the <a href="https://marcelotryle.com/blog/2026/03/22/starlette-10-is-here/">blog post</a>.</p> <p>Check out the full release notes at <a href="https://www.starlette.io/release-notes/#100-march-22-2026">https://www.starlette.io/release-notes/#100-march-22-2026</a></p> <hr /> <p><strong>Full Changelog</strong>: <a href="https://github.com/encode/starlette/compare/1.0.0rc1...1.0.0">https://github.com/encode/starlette/compare/1.0.0rc1...1.0.0</a></p> <h2>Version 1.0.0rc1</h2> <p>We're ready! 🚀</p> <p>The first release candidate for Starlette 1.0 is here! After years on ZeroVer, we're finally making the jump.</p> <p>This release removes all deprecated features marked for 1.0.0, along with some last-minute bug fixes.</p> <p>A special thank you to <a href="https://github.com/lovelydinosaur"><code>@lovelydinosaur</code></a>, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏</p> <p>Thank you to <a href="https://github.com/adriangb"><code>@adriangb</code></a>, <a href="https://github.com/graingert"><code>@graingert</code></a>, <a href="https://github.com/agronholm"><code>@agronholm</code></a>, <a href="https://github.com/florimondmanca"><code>@florimondmanca</code></a>, <a href="https://github.com/aminalaee"><code>@aminalaee</code></a>, <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>, <a href="https://github.com/alex-oleshkevich"><code>@alex-oleshkevich</code></a>, and <a href="https://github.com/abersheeran"><code>@abersheeran</code></a> for helping make Starlette what it is today. And to all my sponsors - especially <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>, <a href="https://github.com/huggingface"><code>@huggingface</code></a>, and <a href="https://github.com/elevenlabs"><code>@elevenlabs</code></a> - thank you for your support!</p> <p>Thank you to all <a href="https://github.com/encode/starlette/graphs/contributors">290+ contributors</a> who have shaped Starlette over the years!</p> <p>Check out the full release notes at <a href="https://www.starlette.io/release-notes/#100rc1-february-23-2026">https://www.starlette.io/release-notes/#100rc1-february-23-2026</a></p> <hr /> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1">https://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.0.0 (March 22, 2026)</h2> <p>Starlette 1.0 is here!</p> <p>After nearly eight years since its creation, Starlette has reached its first stable release. Thank you to everyone who tested the release candidate and reported issues.</p> <p>You can read more on the <a href="https://marcelotryle.com/blog/2026/03/22/starlette-10-is-here/">blog post</a>.</p> <h4>Added</h4> <ul> <li>Track session access and modification in <code>SessionMiddleware</code> <a href="https://redirect.github.com/encode/starlette/pull/3166">#3166</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Handle websocket denial responses in <code>StreamingResponse</code> and <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3189">#3189</a>.</li> <li>Use <code>bytearray</code> for field accumulation in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3179">#3179</a>.</li> <li>Move <code>parser.finalize()</code> inside try/except in <code>MultiPartParser.parse()</code> <a href="https://redirect.github.com/encode/starlette/pull/3153">#3153</a>.</li> </ul> <h2>1.0.0rc1 (February 23, 2026)</h2> <p>We're ready! I'm thrilled to announce the first release candidate for Starlette 1.0.</p> <p>Starlette was created in June 2018 by Tom Christie, and has been on ZeroVer for years. Today, it's downloaded almost <a href="https://pypistats.org/packages/starlette">10 million times a day</a>, serves as the foundation for FastAPI, and has inspired many other frameworks. In the age of AI, Starlette continues to play an important role as a dependency of the Python MCP SDK.</p> <p>This release focuses on removing deprecated features that were marked for removal in 1.0.0, along with some last minute bug fixes. It's a release candidate, so we can gather feedback from the community before the final 1.0.0 release soon.</p> <p>A huge thank you to all the contributors who have helped make Starlette what it is today. In particular, I'd like to recognize:</p> <ul> <li><a href="https://github.com/lovelydinosaur">Kim Christie</a> - The original creator of Starlette, Uvicorn, and MkDocs, and the current maintainer of HTTPX. Kim's work helped lay the foundation for the modern async Python ecosystem.</li> <li><a href="https://github.com/adriangb">Adrian Garcia Badaracco</a> - One of the smartest people I know, whom I have the pleasure of working with at Pydantic.</li> <li><a href="https://github.com/graingert">Thomas Grainger</a> - My async teacher, always ready to help with questions.</li> <li><a href="https://github.com/agronholm">Alex Grönholm</a> - Another async mentor, always prompt to help with questions.</li> <li><a href="https://github.com/florimondmanca">Florimond Manca</a> - Always present in the early days of both Starlette and Uvicorn, and helped a lot in the ecosystem.</li> <li><a href="https://github.com/aminalaee">Amin Alaee</a> - Contributed a lot with file-related PRs.</li> <li><a href="https://github.com/tiangolo">Sebastián Ramírez</a> - Maintains FastAPI upstream, and always in contact to help with upstream issues.</li> <li><a href="https://github.com/alex-oleshkevich">Alex Oleshkevich</a> - Helped a lot on templates and many discussions.</li> <li><a href="https://github.com/abersheeran">abersheeran</a> - My go-to person when I need help on many subjects.</li> </ul> <p>I'd also like to thank my sponsors for their support. A special thanks to <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>, <a href="https://github.com/huggingface"><code>@huggingface</code></a>, and <a href="https://github.com/elevenlabs"><code>@elevenlabs</code></a> for their generous sponsorship, and to all my other sponsors:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
454bdf4538 |
Bump python-dotenv from 1.2.1 to 1.2.2 in /backend (#1668)
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from 1.2.1 to 1.2.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/theskumar/python-dotenv/releases">python-dotenv's releases</a>.</em></p> <blockquote> <h2>v1.2.2</h2> <h3>Added</h3> <ul> <li>Support for Python 3.14, including the free-threaded (3.14t) build. (#)</li> </ul> <h3>Changed</h3> <ul> <li>The <code>dotenv run</code> command now forwards flags directly to the specified command by <a href="https://github.com/bbc2"><code>@bbc2</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/607">theskumar/python-dotenv#607</a></li> <li>Improved documentation clarity regarding override behavior and the reference page.</li> <li>Updated PyPy support to version 3.11.</li> <li>Documentation for FIFO file support.</li> <li>Support for Python 3.9.</li> </ul> <h3>Fixed</h3> <ul> <li>Improved <code>set_key</code> and <code>unset_key</code> behavior when interacting with symlinks by <a href="https://github.com/bbc2"><code>@bbc2</code></a> in <a href=" |
||
|
dependabot[bot]
|
3b61f5c979 |
Bump mako from 1.3.10 to 1.3.11 in /backend (#1665)
Bumps [mako](https://github.com/sqlalchemy/mako) from 1.3.10 to 1.3.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/mako/releases">mako's releases</a>.</em></p> <blockquote> <h1>1.3.11</h1> <p>Released: Tue Apr 14 2026</p> <h2>bug</h2> <ul> <li> <p><strong>[bug] [template]</strong> Fixed issue in <code>TemplateLookup</code> where a URI with a double-slash prefix (e.g. <code>//../../</code>) could bypass the directory traversal check in <code>Template</code>, allowing reads of arbitrary files outside of the template directory. The issue was caused by an inconsistency in how leading slashes were stripped between <code>TemplateLookup.get_template()</code> and <code>Template</code> initialization.</p> <p>References: <a href="https://redirect.github.com/sqlalchemy/mako/issues/434">#434</a></p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/mako/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/evroon/bracket/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c4b05352a3 |
Bump python-multipart from 0.0.22 to 0.0.26 in /backend (#1662)
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.22 to 0.0.26. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>Version 0.0.26</h2> <h2>What's Changed</h2> <ul> <li>Skip preamble before first multipart boundary by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/262">Kludex/python-multipart#262</a></li> <li>Silently discard epilogue data after the closing boundary by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/259">Kludex/python-multipart#259</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26">https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26</a></p> <h2>Version 0.0.25</h2> <h2>What's Changed</h2> <ul> <li>Apply Apache-2.0 properly by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/247">Kludex/python-multipart#247</a></li> <li>Handle multipart headers case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/252">Kludex/python-multipart#252</a></li> <li>Emit <code>field_end</code> for trailing bare field names on finalize by <a href="https://github.com/bysiber"><code>@bysiber</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/230">Kludex/python-multipart#230</a></li> <li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/254">Kludex/python-multipart#254</a></li> <li>Remove custom FormParser classes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/257">Kludex/python-multipart#257</a></li> <li>Handle CTE values case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/258">Kludex/python-multipart#258</a></li> <li>Add MIME content type info to File by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/143">Kludex/python-multipart#143</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25">https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25</a></p> <h2>Version 0.0.24</h2> <h2>What's Changed</h2> <ul> <li>Validate <code>chunk_size</code> in <code>parse_form()</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/244">Kludex/python-multipart#244</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24">https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24</a></p> <h2>Version 0.0.23</h2> <h2>What's Changed</h2> <ul> <li>Remove unused <code>trust_x_headers</code> parameter and <code>X-File-Name</code> fallback by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/196">Kludex/python-multipart#196</a></li> <li>Return processed length from <code>QuerystringParser._internal_write</code> by <a href="https://github.com/bysiber"><code>@bysiber</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li> <li>Cleanup metadata dunders from <code>__init__.py</code> by <a href="https://github.com/Chesars"><code>@Chesars</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Chesars"><code>@Chesars</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li> <li><a href="https://github.com/bysiber"><code>@bysiber</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23">https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.26 (2026-04-10)</h2> <ul> <li>Skip preamble before the first multipart boundary more efficiently <a href="https://redirect.github.com/Kludex/python-multipart/pull/262">#262</a>.</li> <li>Silently discard epilogue data after the closing multipart boundary <a href="https://redirect.github.com/Kludex/python-multipart/pull/259">#259</a>.</li> </ul> <h2>0.0.25 (2026-04-10)</h2> <ul> <li>Add MIME content type info to <code>File</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/143">#143</a>.</li> <li>Handle CTE values case-insensitively <a href="https://redirect.github.com/Kludex/python-multipart/pull/258">#258</a>.</li> <li>Remove custom <code>FormParser</code> classes <a href="https://redirect.github.com/Kludex/python-multipart/pull/257">#257</a>.</li> <li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config <a href="https://redirect.github.com/Kludex/python-multipart/pull/254">#254</a>.</li> <li>Emit <code>field_end</code> for trailing bare field names on finalize <a href="https://redirect.github.com/Kludex/python-multipart/pull/230">#230</a>.</li> <li>Handle multipart headers case-insensitively <a href="https://redirect.github.com/Kludex/python-multipart/pull/252">#252</a>.</li> <li>Apply Apache-2.0 properly <a href="https://redirect.github.com/Kludex/python-multipart/pull/247">#247</a>.</li> </ul> <h2>0.0.24 (2026-04-05)</h2> <ul> <li>Validate <code>chunk_size</code> in <code>parse_form()</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/244">#244</a>.</li> </ul> <h2>0.0.23 (2026-04-05)</h2> <ul> <li>Remove unused <code>trust_x_headers</code> parameter and <code>X-File-Name</code> fallback <a href="https://redirect.github.com/Kludex/python-multipart/pull/196">#196</a>.</li> <li>Return processed length from <code>QuerystringParser._internal_write</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">#229</a>.</li> <li>Cleanup metadata dunders from <code>__init__.py</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">#227</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |