mirror/bracket
1
0 Fork 0
mirror of https://github.com/evroon/bracket.git synced 2026-09-15 07:29:41 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,394 Commits 10 Branches 41 Tags
63ceea6c25cce56a906c1068bf0b41c19fec0d45
Commit Graph
1394 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 63ceea6c25 Bump @radix-ui/react-slot from 1.2.4 to 1.3.0 in /docs (#1759) 
Bumps
[@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot)
from 1.2.4 to 1.3.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md">@​radix-ui/react-slot's
changelog</a>.</em></p>
<blockquote>
<h2>1.3.0</h2>
<h3>Added generic type arguments for <code>SlotProps</code> and
<code>createSlot</code></h3>
<p><code>SlotProps</code> and <code>createSlot</code> now accept generic
type arguments to specify the type of element a slot should render, as
well as its props.</p>
<pre lang="tsx"><code>const Slot = createSlot&lt;HTMLButtonElement,
MyCustomButtonProps&gt;('Slot');
</code></pre>
<h2>1.2.5</h2>
<ul>
<li>Fixed infinite re-render loop in React 19 caused by
<code>Slot</code> creating a new ref callback on every render</li>
<li>Added support for nested <code>Slottable</code> via a render prop,
so a slotted element can be wrapped while still merging Slot props and
refs onto it</li>
<li>Added repository.directory to all package.json files</li>
<li>Improved error messages for invalid slot children</li>
<li>Updated dependencies:
<code>@radix-ui/react-compose-refs@1.1.3</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​radix-ui/react-slot</code> since your current
version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@radix-ui/react-slot&package-manager=npm_and_yarn&previous-version=1.2.4&new-version=1.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 04:09:29 +00:00
dependabot[bot] 382c646d92 Bump @types/node from 26.0.1 to 26.1.0 in /docs (#1758) 
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 26.0.1 to 26.1.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=npm_and_yarn&previous-version=26.0.1&new-version=26.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 04:08:58 +00:00
dependabot[bot] 2b2bd85b0e Bump aiohttp from 3.14.1 to 3.14.3 in /backend in the uv group across 1 directory (#1757) 
Bumps the uv group with 1 update in the /backend directory:
[aiohttp](https://github.com/aio-libs/aiohttp).

Updates `aiohttp` from 3.14.1 to 3.14.3

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiohttp&package-manager=uv&previous-version=3.14.1&new-version=3.14.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 04:07:49 +00:00
dependabot[bot] 8aff0d4b5a Bump actions/cache from 5 to 6 (#1754) 
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/v5...v6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 04:05:23 +00:00
dependabot[bot] ad74716b79 Bump docker/login-action from 4.2.0 to 4.4.0 (#1753) 
Bumps [docker/login-action](https://github.com/docker/login-action) from
4.2.0 to 4.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<ul>
<li>Skip empty <code>registry-auth</code> secret mask by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1077.0 <a
href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p>
<h2>v4.3.0</h2>
<ul>
<li>Preserve names in esbuild bundle by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1076.0 <a
href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li>
<li>Bump <code>@​sigstore/core</code> from 3.1.0 to 3.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li>
<li>Bump <code>@​sigstore/verify</code> from 3.1.0 to 3.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li>
<li>Bump js-yaml from 4.1.1 to 5.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li>
<li>Bump sigstore from 4.1.0 to 4.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li>
<li>Bump tmp from 0.2.5 to 0.2.7 in <a
href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li>
<li>Bump undici from 6.24.1 to 6.27.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li>
<li>Bump vite from 7.3.3 to 7.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a>
from crazy-max/fix-registry-auth-empty-mask</li>
<li><a
href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a>
skip empty registry-auth secret mask</li>
<li><a
href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0"><code>b249b43</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1032">#1032</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520"><code>1b67977</code></a>
build(deps): bump docker/bake-action from 7.2.0 to 7.3.0</li>
<li><a
href="https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e"><code>9d49d6a</code></a>
build(deps): bump docker/bake-action/subaction/matrix</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.2.0&new-version=4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 04:05:04 +00:00
Copilot 8fb557aa81 Fix SQLAlchemy and operator misuse causing broken query predicates and cross-tournament access (#1721) 
Python's `and` operator is unsafe with SQLAlchemy clause elements: in
SQLAlchemy 2.0 it raises `TypeError` (routes return 500); in older
versions it short-circuits to the right-hand operand, silently dropping
the `id = X` filter and enabling cross-tournament entity access.

## Changes

**`routes/util.py`**
- `team_dependency`: replace `and` with `&`
- `round_dependency` / `match_dependency`: `rounds` and `matches` have
no direct `tournament_id`; replace the broken `and` chain with proper
JOINs through `stage_items → stages` to enforce tournament scoping

**`routes/courts.py`**
- `create_court` post-insert fetch: replace `and` with `&`

**`tests/.../teams_test.py`**
- Add `test_cross_tournament_team_access_denied`: asserts that a `PUT`
on tournament A's URL using a `team_id` belonging to tournament B
returns 404

```python
# Before (BROKEN — evaluates to just the right-hand side)
teams.select().where(teams.c.id == team_id and teams.c.tournament_id == tournament_id)

# After (CORRECT)
teams.select().where((teams.c.id == team_id) & (teams.c.tournament_id == tournament_id))

# round_dependency — no tournament_id on rounds table, use JOIN
rounds.select()
    .join(stage_items, rounds.c.stage_item_id == stage_items.c.id)
    .join(stages, stage_items.c.stage_id == stages.c.id)
    .where((rounds.c.id == round_id) & (stages.c.tournament_id == tournament_id))
```

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-07-28 18:59:46 +00:00
CopilotErik VroonCopilot Autofix powered by AI
 		3606868b98 frontend: replace Prettier stack with oxfmt (#1750) 
This PR migrates formatting in `frontend/` from Prettier to `oxfmt`,
including script wiring and dependency cleanup. It removes the Prettier
plugin/config path so formatting is handled by a single tool.

- **Script migration**
  - Renamed/rewired formatting scripts in `frontend/package.json`:
    - `prettier:check` → `format:check` (`oxfmt --check .`)
    - `prettier:write` → `format:write` (`oxfmt .`)
  - Updated dependent scripts:
    - `test` now runs `pnpm run format:write`
    - `openapi-ts` now runs `pnpm run format:write` after generation

- **Dependency cleanup**
  - Removed `prettier-plugin-organize-imports` from `dependencies`
  - Removed `prettier` from `devDependencies`
  - Added `oxfmt` (latest stable at update time)

- **Config removal**
  - Deleted `frontend/.prettierrc.js` (no longer used after migration)

- **Lockfile alignment**
- Updated `frontend/pnpm-lock.yaml` to reflect the dependency and script
ecosystem change

```json
{
  "scripts": {
    "format:check": "oxfmt --check .",
    "format:write": "oxfmt .",
    "openapi-ts": "openapi-ts && pnpm run format:write",
    "test": "tsc && pnpm run format:write"
  }
}
```

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Erik Vroon <11857441+evroon@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-28 18:38:17 +00:00
dependabot[bot] 986d1ff836 Bump postcss from 8.5.10 to 8.5.18 in /frontend (#1746) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to
8.5.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/4c0d194c136fd374495d0993c890d794cab65b81"><code>4c0d194</code></a>
Release 8.5.18 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/92b4e7891ec7b811821d01acc8aa0f010caf41e2"><code>92b4e78</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"><code>95663d3</code></a>
Limit where source map can be loaded for security reasons</li>
<li><a
href="https://github.com/postcss/postcss/commit/74e25ae9f4efaa56a41a449064a655d7da78072c"><code>74e25ae</code></a>
Release 8.5.17 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/d1518afd5a88f42728b30b87f8917210f363f9f1"><code>d1518af</code></a>
Fix Maximum call stack size exceeded error</li>
<li><a
href="https://github.com/postcss/postcss/commit/2421312ffea96ba77b35ce24a1b2d9c2e22b5e83"><code>2421312</code></a>
Fix linter</li>
<li><a
href="https://github.com/postcss/postcss/commit/a50352c583df991710f92ccac25b36304695161a"><code>a50352c</code></a>
Fix CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/33948f0969bb858acdd52c9692e3a785a3ed0a73"><code>33948f0</code></a>
Prevent prototype hijacking in fromJSON</li>
<li><a
href="https://github.com/postcss/postcss/commit/2131909351161cd2c5fc2be58b14919a873ea824"><code>2131909</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/93440abcca92793b31c5d1fdf5f2da7b58b27599"><code>93440ab</code></a>
Fix non-closed <code>\&lt;div align=&quot;center&quot;&gt;</code> in
README (<a
href="https://redirect.github.com/postcss/postcss/issues/2110">#2110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.10...8.5.18">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for postcss since your current version.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 15:52:07 +00:00
dependabot[bot] cfdc741478 Bump axios from 1.15.2 to 1.18.0 in /frontend (#1738) 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.18.0 — June 13, 2026</h2>
<p>This release hardens redirect and URL handling, improves the
validateStatus configuration semantics, and includes updates to
documentation, dependencies, and release metadata.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter
support for stripping caller-specified sensitive headers on cross-origin
redirects, helping prevent custom auth headers such as API keys from
leaking to another origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p>
</li>
<li>
<p><strong>URL And Request Hardening:</strong> Rejects malformed
<code>http:</code> and <code>https:</code> URLs that omit
<code>//</code> with <code>ERR_INVALID_URL</code>, while tightening
prototype-pollution-safe config reads, stream size limits, FormData
depth handling, data URL sizing, and local <code>NO_PROXY</code>
matching. (<strong><a
href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Status Validation:</strong> Added
<code>transitional.validateStatusUndefinedResolves</code> so
applications can opt in to treating <code>validateStatus:
undefined</code> like the option was omitted, while
<code>validateStatus: null</code> remains the explicit way to accept
every status. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p><strong>Documentation:</strong> Published the v1.17.0 release notes,
fixed a changelog typo, clarified the package update PR policy, and
marked the <code>proxy</code> request config as Node.js-only in the
advanced docs. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>,
<code>@babel/preset-env</code>, <code>@commitlint/cli</code>,
<code>@commitlint/config-conventional</code>,
<code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>,
<code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>,
<code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>,
<code>vitest</code>, and <code>actions/checkout</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p>
</li>
<li>
<p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by
updating package metadata and the runtime <code>VERSION</code> value.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/drori12"><code>@​drori12</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li>
<li><strong><a
href="https://github.com/eyupcanakman"><code>@​eyupcanakman</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
<li><strong><a
href="https://github.com/Adi-Beker"><code>@​Adi-Beker</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full
Changelog</a></p>
<h2>v1.17.0 — June 1, 2026</h2>
<p>This release adds Node HTTP zstd decompression, hardens config and
release workflows, and fixes authentication, header, proxy, and
type-handling regressions.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>,
<code>params</code>, and <code>paramsSerializer</code> reads with
own-property checks to prevent inherited prototype values from affecting
request behavior, including SSRF-sensitive paths. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li>
<li><strong>Release Publishing:</strong> Switched the publish workflow
to npm staged publishing for safer, auditable package releases with
provenance. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>HTTP Compression:</strong> Added Node HTTP adapter support
for zstd response decompression, with
<code>transitional.advertiseZstdAcceptEncoding</code> controlling
whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Authentication Handling:</strong> Restored Basic auth on
same-origin Node redirects while continuing to strip credentials
cross-origin, and aligned the fetch adapter with HTTP adapter behavior
for URL-embedded Basic auth. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li>
<li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code>
TLS options when tunneling HTTPS requests through HTTP CONNECT proxies.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li>
<li><strong>React Native FormData:</strong> Cleared default
<code>Content-Type</code> for React Native <code>FormData</code> so
multipart boundaries can be generated correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.18.0 — June 13, 2026</h2>
<p>This release hardens redirect and URL handling, improves the
validateStatus configuration semantics, and includes updates to
documentation, dependencies, and release metadata.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter
support for stripping caller-specified sensitive headers on cross-origin
redirects, helping prevent custom auth headers such as API keys from
leaking to another origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p>
</li>
<li>
<p><strong>URL And Request Hardening:</strong> Rejects malformed
<code>http:</code> and <code>https:</code> URLs that omit
<code>//</code> with <code>ERR_INVALID_URL</code>, while tightening
prototype-pollution-safe config reads, stream size limits, FormData
depth handling, data URL sizing, and local <code>NO_PROXY</code>
matching. (<strong><a
href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Status Validation:</strong> Added
<code>transitional.validateStatusUndefinedResolves</code> so
applications can opt in to treating <code>validateStatus:
undefined</code> like the option was omitted, while
<code>validateStatus: null</code> remains the explicit way to accept
every status. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p><strong>Documentation:</strong> Published the v1.17.0 release notes,
fixed a changelog typo, clarified the package update PR policy, and
marked the <code>proxy</code> request config as Node.js-only in the
advanced docs. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>,
<code>@babel/preset-env</code>, <code>@commitlint/cli</code>,
<code>@commitlint/config-conventional</code>,
<code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>,
<code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>,
<code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>,
<code>vitest</code>, and <code>actions/checkout</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p>
</li>
<li>
<p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by
updating package metadata and the runtime <code>VERSION</code> value.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/drori12"><code>@​drori12</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li>
<li><strong><a
href="https://github.com/eyupcanakman"><code>@​eyupcanakman</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
<li><strong><a
href="https://github.com/Adi-Beker"><code>@​Adi-Beker</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full
Changelog</a></p>
<h2>v1.17.0 — June 1, 2026</h2>
<p>This release adds Node HTTP zstd decompression, hardens config and
release workflows, and fixes authentication, header, proxy, and
type-handling regressions.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>,
<code>params</code>, and <code>paramsSerializer</code> reads with
own-property checks to prevent inherited prototype values from affecting
request behavior, including SSRF-sensitive paths. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li>
<li><strong>Release Publishing:</strong> Switched the publish workflow
to npm staged publishing for safer, auditable package releases with
provenance. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>HTTP Compression:</strong> Added Node HTTP adapter support
for zstd response decompression, with
<code>transitional.advertiseZstdAcceptEncoding</code> controlling
whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Authentication Handling:</strong> Restored Basic auth on
same-origin Node redirects while continuing to strip credentials
cross-origin, and aligned the fetch adapter with HTTP adapter behavior
for URL-embedded Basic auth. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li>
<li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code>
TLS options when tunneling HTTPS requests through HTTP CONNECT proxies.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li>
<li><strong>React Native FormData:</strong> Cleared default
<code>Content-Type</code> for React Native <code>FormData</code> so
multipart boundaries can be generated correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/2d06f96e8602c2db13b65a26340ee4a1bbc0b61f"><code>2d06f96</code></a>
chore(release): prepare release 1.18.0 (<a
href="https://redirect.github.com/axios/axios/issues/11003">#11003</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"><code>32fc489</code></a>
fix: malformed http urls (<a
href="https://redirect.github.com/axios/axios/issues/11000">#11000</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/b40ce498abfa10d90b873b4fd08f520afa5d2545"><code>b40ce49</code></a>
chore(deps-dev): bump the development_dependencies group with 10 updates
(<a
href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li>
<li><a
href="https://github.com/axios/axios/commit/fe964f960ecb52c3e1155b0daf7be77541956b01"><code>fe964f9</code></a>
docs: mark proxy config as Node.js only (<a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/5f229d2d1f018d1db3dab6bbe034dbf3f9041b99"><code>5f229d2</code></a>
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the
github-actions ...</li>
<li><a
href="https://github.com/axios/axios/commit/fae9d4e7db6a858c407c75e607a071c533c5c4f6"><code>fae9d4e</code></a>
docs: clarify package update PR policy (<a
href="https://redirect.github.com/axios/axios/issues/10992">#10992</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/28ab2ced820e55192806c53472ab3eb0cbb68dc2"><code>28ab2ce</code></a>
chore(deps-dev): bump the development_dependencies group with 2 updates
(<a
href="https://redirect.github.com/axios/axios/issues/10989">#10989</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b"><code>a8e4f13</code></a>
fix(core): keep default validateStatus when request passes undefined (<a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/614f4552a17de757d4171ad7c3bd38c9c1025fd8"><code>614f455</code></a>
docs: publish v1.17.0 release notes (<a
href="https://redirect.github.com/axios/axios/issues/10988">#10988</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/6bb12c191f5380fad321322fb90216ae0dc36985"><code>6bb12c1</code></a>
fix: custom auth headers not stripped on cross-origin redirects (<a
href="https://redirect.github.com/axios/axios/issues/10892">#10892</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.15.2...v1.18.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 15:51:51 +00:00
dependabot[bot]andcopilot-swe-agent[bot] 79120544ab Bump vite from 8.0.8 to 8.0.16 in /frontend (#1711) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 8.0.8 to 8.0.16.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.16</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.15</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.14</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.13</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.12</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.10</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.9</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16">8.0.16</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> reject UNC paths for launch-editor-middleware
(<a
href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>)
(<a
href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9">50b9512</a>)</li>
<li>reject windows alternate paths (<a
href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a>)
(<a
href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546">dc245c7</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.14...v8.0.15">8.0.15</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>send 408 on request timeout (<a
href="https://redirect.github.com/vitejs/vite/issues/22476">#22476</a>)
(<a
href="https://github.com/vitejs/vite/commit/c85c9eeb9aaf41f477b48b057146887bd5620797">c85c9ee</a>)</li>
<li>update rolldown to 1.0.3 (<a
href="https://redirect.github.com/vitejs/vite/issues/22538">#22538</a>)
(<a
href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575">646dbed</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>capitalize error messages and remove spurious space in parse error
(<a
href="https://redirect.github.com/vitejs/vite/issues/22488">#22488</a>)
(<a
href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3">85a0eff</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22511">#22511</a>)
(<a
href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa">2686d7d</a>)</li>
<li><strong>dev:</strong> fix html-proxy cache key mismatch for /@fs/
HTML paths (<a
href="https://redirect.github.com/vitejs/vite/issues/21762">#21762</a>)
(<a
href="https://github.com/vitejs/vite/commit/47c4213f134f562c41ed7c031e4788510cf7e31e">47c4213</a>)</li>
<li><strong>glob:</strong> error on relative glob in virtual module when
no files match (<a
href="https://redirect.github.com/vitejs/vite/issues/22497">#22497</a>)
(<a
href="https://github.com/vitejs/vite/commit/5c8e98f8b584ac5d42f0f9b8580c49792213b13c">5c8e98f</a>)</li>
<li><strong>optimizer:</strong> close the rolldown bundle when write()
rejects (<a
href="https://redirect.github.com/vitejs/vite/issues/22528">#22528</a>)
(<a
href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815">e3cfb9d</a>)</li>
<li><strong>resolve:</strong> provide onWarn for viteResolvePlugin in JS
plugin containers (<a
href="https://redirect.github.com/vitejs/vite/issues/22509">#22509</a>)
(<a
href="https://github.com/vitejs/vite/commit/40985f1c09b7696e594e6c5695fbc315d2da2c83">40985f1</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22566">#22566</a>)
(<a
href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd">3052a67</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>correct logic in <code>collectAllModules</code> function (<a
href="https://redirect.github.com/vitejs/vite/issues/22562">#22562</a>)
(<a
href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c">6978a9c</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.13...v8.0.14">8.0.14</a>
(2026-05-21)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/22484">#22484</a>)
(<a
href="https://github.com/vitejs/vite/commit/96efc88570b6a6ddf1a910f106920cbac07b3cf0">96efc88</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22471">#22471</a>)
(<a
href="https://github.com/vitejs/vite/commit/98b81632139d51820f82036e58d6fbbf122b77b3">98b8163</a>)</li>
<li><strong>dev:</strong> handle errors when sending messages to vite
server (<a
href="https://redirect.github.com/vitejs/vite/issues/22450">#22450</a>)
(<a
href="https://github.com/vitejs/vite/commit/e8e9a34dcf2540139de558a10187630884d10217">e8e9a34</a>)</li>
<li><strong>html:</strong> handle trailing slash paths in
transformIndexHtml (<a
href="https://redirect.github.com/vitejs/vite/issues/22480">#22480</a>)
(<a
href="https://github.com/vitejs/vite/commit/5d94d1bffdb2a15de9341194d89baec86ce1f693">5d94d1b</a>)</li>
<li><strong>optimizer:</strong> pass oxc jsx options to transformSync in
dependency scan (<a
href="https://redirect.github.com/vitejs/vite/issues/22342">#22342</a>)
(<a
href="https://github.com/vitejs/vite/commit/b3132dacea9c6e0cf526cd9f0f09d850f577c262">b3132da</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22470">#22470</a>)
(<a
href="https://github.com/vitejs/vite/commit/7cb728eb629cc677661f1bc52a044ffc0b87fc7f">7cb728e</a>)</li>
<li>remove irrelevant commits from changelog (<a
href="https://github.com/vitejs/vite/commit/2c69495f250edf01132d4a20128de19dbe836086">2c69495</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>glob:</strong> do not rewrite import path for absolute base
(<a
href="https://redirect.github.com/vitejs/vite/issues/22310">#22310</a>)
(<a
href="https://github.com/vitejs/vite/commit/0ae2844ab6d6d1ccf78a2975b8132769fc35b302">0ae2844</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/f94df87ff03b40b65e29bacdc04cc18c7bccaa4a"><code>f94df87</code></a>
release: v8.0.16</li>
<li><a
href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546"><code>dc245c7</code></a>
fix: reject windows alternate paths (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9"><code>50b9512</code></a>
fix(deps): reject UNC paths for launch-editor-middleware (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/8d1b0195fd186d0b3297d7cd17acff6c96797420"><code>8d1b019</code></a>
release: v8.0.15</li>
<li><a
href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa"><code>2686d7d</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22511">#22511</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd"><code>3052a67</code></a>
chore(deps): update rolldown-related dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22566">#22566</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815"><code>e3cfb9d</code></a>
fix(optimizer): close the rolldown bundle when write() rejects (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22528">#22528</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c"><code>6978a9c</code></a>
refactor: correct logic in <code>collectAllModules</code> function (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22562">#22562</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575"><code>646dbed</code></a>
feat: update rolldown to 1.0.3 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22538">#22538</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3"><code>85a0eff</code></a>
fix: capitalize error messages and remove spurious space in parse error
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22488">#22488</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.16/packages/vite">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-07-28 15:48:14 +00:00
dependabot[bot] 5d66ee82df Bump @types/node from 25.5.0 to 26.0.1 in /docs (#1684) 
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 25.5.0 to 26.0.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 15:28:47 +00:00
dependabot[bot] 842e2a3201 Bump actions/setup-node from 6.3.0 to 6.4.0 (#1687) 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from
6.3.0 to 6.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Dependency updates:</h3>
<ul>
<li>Upgrade <a
href="https://github.com/actions"><code>@​actions</code></a>
dependencies by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
<li>Update Node.js versions in versions.yml and bump package to v6.4.0
by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"><code>48b55a0</code></a>
Update Node.js versions in versions.yml and bump package to v6.4.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1533">#1533</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9"><code>ab72c7e</code></a>
Upgrade <a href="https://github.com/actions"><code>@​actions</code></a>
dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1525">#1525</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-node/compare/v6.3.0...v6.4.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 15:28:11 +00:00
Erik Vroon 3fd89048b1 Always run frontend workflow (#1749) 2026-07-28 15:00:17 +00:00
dependabot[bot]andcopilot-swe-agent[bot] 6b397d0016 Bump @types/node from 25.5.0 to 26.0.1 in /frontend (#1685) 
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 25.5.0 to 26.0.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-07-28 14:58:49 +00:00
dependabot[bot] 3f88a98afa Bump lucide-react from 1.7.0 to 1.21.0 in /docs (#1683) 
Bumps
[lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)
from 1.7.0 to 1.21.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lucide-icons/lucide/releases">lucide-react's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci(release.yml): Remove new-version in release flow by <a
href="https://github.com/ericfennis"><code>@​ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4478">lucide-icons/lucide#4478</a></li>
<li>ci(release.yml): Fix workflow and remove <code>version</code>
scripts in package scripts by <a
href="https://github.com/ericfennis"><code>@​ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4479">lucide-icons/lucide#4479</a></li>
<li>fix(docs): rename navigation category label by <a
href="https://github.com/Hsiii"><code>@​Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4483">lucide-icons/lucide#4483</a></li>
<li>feat(icons): added <code>broken-bone</code> icon by <a
href="https://github.com/Patolord"><code>@​Patolord</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4131">lucide-icons/lucide#4131</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Hsiii"><code>@​Hsiii</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4483">lucide-icons/lucide#4483</a></li>
<li><a href="https://github.com/Patolord"><code>@​Patolord</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4131">lucide-icons/lucide#4131</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0">https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0</a></p>
<h2>Version 1.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(icons): decreased size of arrows inside
<code>square-arrow-*</code> icons by <a
href="https://github.com/jguddas"><code>@​jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3926">lucide-icons/lucide#3926</a></li>
<li>chore(tags): Add tags to <code>search-</code> icons by <a
href="https://github.com/jamiemlaw"><code>@​jamiemlaw</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4099">lucide-icons/lucide#4099</a></li>
<li>feat(icons): added <code>save-check</code> icon by <a
href="https://github.com/Konixy"><code>@​Konixy</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3120">lucide-icons/lucide#3120</a></li>
<li>feat(icons): added <code>tag-plus</code> and <code>tag-x</code>
icons by <a
href="https://github.com/adam-kov"><code>@​adam-kov</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3980">lucide-icons/lucide#3980</a></li>
<li>feat(icons): added <code>banknote-check</code> icon by <a
href="https://github.com/mfjramirezf"><code>@​mfjramirezf</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/3956">lucide-icons/lucide#3956</a></li>
<li>feat(icons): added <code>clock-arrow-in</code> icon by <a
href="https://github.com/jguddas"><code>@​jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/2403">lucide-icons/lucide#2403</a></li>
<li>feat(icons): added <code>summary</code> icon by <a
href="https://github.com/jpjacobpadilla"><code>@​jpjacobpadilla</code></a>
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3114">lucide-icons/lucide#3114</a></li>
<li>feat(icons): added <code>user-round-arrow-in</code> icon by <a
href="https://github.com/jguddas"><code>@​jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/2283">lucide-icons/lucide#2283</a></li>
<li>feat(icons): added <code>clock-arrow-out</code> icon by <a
href="https://github.com/jguddas"><code>@​jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/2404">lucide-icons/lucide#2404</a></li>
<li>docs(docs): fix broken Svelte package source link in README by <a
href="https://github.com/SRKrukowski"><code>@​SRKrukowski</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4468">lucide-icons/lucide#4468</a></li>
<li>chore(deps-dev): bump <code>@​angular/compiler</code> from 21.2.5 to
21.2.17 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4474">lucide-icons/lucide#4474</a></li>
<li>chore(deps-dev): bump <code>@​angular/core</code> from 21.2.5 to
21.2.17 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4470">lucide-icons/lucide#4470</a></li>
<li>chore(deps-dev): bump vitest from 4.0.12 to 4.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4429">lucide-icons/lucide#4429</a></li>
<li>chore(deps-dev): bump markdown-it from 14.1.1 to 14.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4475">lucide-icons/lucide#4475</a></li>
<li>chore(deps-dev): bump <code>@​angular/common</code> from 21.2.5 to
21.2.17 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4471">lucide-icons/lucide#4471</a></li>
<li>feat(icons): added <code>pencil-sparkles</code> icon by <a
href="https://github.com/jennieboops"><code>@​jennieboops</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4445">lucide-icons/lucide#4445</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Konixy"><code>@​Konixy</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3120">lucide-icons/lucide#3120</a></li>
<li><a href="https://github.com/adam-kov"><code>@​adam-kov</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3980">lucide-icons/lucide#3980</a></li>
<li><a
href="https://github.com/mfjramirezf"><code>@​mfjramirezf</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3956">lucide-icons/lucide#3956</a></li>
<li><a
href="https://github.com/SRKrukowski"><code>@​SRKrukowski</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4468">lucide-icons/lucide#4468</a></li>
<li><a
href="https://github.com/jennieboops"><code>@​jennieboops</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4445">lucide-icons/lucide#4445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0">https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0</a></p>
<h2>Version 1.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): upgrade pnpm to version 11.6.0 by <a
href="https://github.com/ericfennis"><code>@​ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4458">lucide-icons/lucide#4458</a></li>
<li>feat(icons): added <code>star-*</code> icons by <a
href="https://github.com/RajnishKMehta"><code>@​RajnishKMehta</code></a>
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3918">lucide-icons/lucide#3918</a></li>
<li>chore(suggest-tags): Update metadata suggestion script by <a
href="https://github.com/ericfennis"><code>@​ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4462">lucide-icons/lucide#4462</a></li>
<li>feat(icons): added <code>save-pen</code> icon by <a
href="https://github.com/vaporvee"><code>@​vaporvee</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4179">lucide-icons/lucide#4179</a></li>
<li>feat(icons): added <code>wrench-off</code> icon by <a
href="https://github.com/nilsjonsson"><code>@​nilsjonsson</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4434">lucide-icons/lucide#4434</a></li>
<li>feat(icons): added <code>ad</code> icon by <a
href="https://github.com/jamiemlaw"><code>@​jamiemlaw</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4323">lucide-icons/lucide#4323</a></li>
<li>feat(icons): added <code>eye-dashed</code> icon by <a
href="https://github.com/karsa-mistmere"><code>@​karsa-mistmere</code></a>
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4415">lucide-icons/lucide#4415</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lucide-icons/lucide/commit/5ff536e1391335e4f7dc38d244c1bc458b9443e2"><code>5ff536e</code></a>
ci(release.yml): Fix workflow and remove <code>version</code> scripts in
package scripts...</li>
<li><a
href="https://github.com/lucide-icons/lucide/commit/07c885e6c1f9952965ba388b7fd2bb7c4d416a67"><code>07c885e</code></a>
fix(docs): fix zephyr-cloud URL in readmes</li>
<li><a
href="https://github.com/lucide-icons/lucide/commit/50d8af5a1012e188f3d71ac8f1fc0fba1aab5357"><code>50d8af5</code></a>
docs(readme): Update readme files (<a
href="https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react/issues/4320">#4320</a>)</li>
<li><a
href="https://github.com/lucide-icons/lucide/commit/653e44b83293567ff24dcb90ca1094a9cf0a042a"><code>653e44b</code></a>
feat(packages): use .mjs for ESM bundles (<a
href="https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react/issues/4285">#4285</a>)</li>
<li><a
href="https://github.com/lucide-icons/lucide/commit/7623e23f787fe78e5075a613fd22da2cecbb9b1b"><code>7623e23</code></a>
feat(docs): add Zephyr Cloud to Hero Backers tier &amp; rework
updateSponsors scr...</li>
<li>See full diff in <a
href="https://github.com/lucide-icons/lucide/commits/1.21.0/packages/lucide-react">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:15:25 +00:00
dependabot[bot] 7f972399a8 Bump postcss from 8.5.10 to 8.5.18 in /docs (#1744) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to
8.5.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/4c0d194c136fd374495d0993c890d794cab65b81"><code>4c0d194</code></a>
Release 8.5.18 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/92b4e7891ec7b811821d01acc8aa0f010caf41e2"><code>92b4e78</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"><code>95663d3</code></a>
Limit where source map can be loaded for security reasons</li>
<li><a
href="https://github.com/postcss/postcss/commit/74e25ae9f4efaa56a41a449064a655d7da78072c"><code>74e25ae</code></a>
Release 8.5.17 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/d1518afd5a88f42728b30b87f8917210f363f9f1"><code>d1518af</code></a>
Fix Maximum call stack size exceeded error</li>
<li><a
href="https://github.com/postcss/postcss/commit/2421312ffea96ba77b35ce24a1b2d9c2e22b5e83"><code>2421312</code></a>
Fix linter</li>
<li><a
href="https://github.com/postcss/postcss/commit/a50352c583df991710f92ccac25b36304695161a"><code>a50352c</code></a>
Fix CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/33948f0969bb858acdd52c9692e3a785a3ed0a73"><code>33948f0</code></a>
Prevent prototype hijacking in fromJSON</li>
<li><a
href="https://github.com/postcss/postcss/commit/2131909351161cd2c5fc2be58b14919a873ea824"><code>2131909</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/93440abcca92793b31c5d1fdf5f2da7b58b27599"><code>93440ab</code></a>
Fix non-closed <code>\&lt;div align=&quot;center&quot;&gt;</code> in
README (<a
href="https://redirect.github.com/postcss/postcss/issues/2110">#2110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.10...8.5.18">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for postcss since your current version.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:14:46 +00:00
dependabot[bot] 2663a70283 Bump actions/setup-python from 6 to 6.3.0 (#1722) 
Bumps [actions/setup-python](https://github.com/actions/setup-python)
from 6 to 6.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add RHEL support and include Linux distro in cache keys by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li>
<li>Fix pip cache error handling on Windows by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li>
<li>Upgrade actions dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li>Upgrade dependency versions and test workflow configuration by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update advanced-usage.md by <a
href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li><a href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade dependencies to Node 24 compatible versions by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li>
<li>Upgrade urllib3 from 2.5.0 to 2.6.3 in <code>/__tests__/data</code>
by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1253">actions/setup-python#1253</a>
and <a
href="https://redirect.github.com/actions/setup-python/pull/1264">actions/setup-python#1264</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v6.2.0">https://github.com/actions/setup-python/compare/v6...v6.2.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Add support for <code>pip-install</code> input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1201">actions/setup-python#1201</a></li>
<li>Add graalpy early-access and windows builds by <a
href="https://github.com/timfel"><code>@​timfel</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/880">actions/setup-python#880</a></li>
</ul>
<h3>Dependency and Documentation updates:</h3>
<ul>
<li>Enhanced wording and updated example usage for
<code>allow-prereleases</code> by <a
href="https://github.com/yarikoptic"><code>@​yarikoptic</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/979">actions/setup-python#979</a></li>
<li>Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes
in v6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1139">actions/setup-python#1139</a></li>
<li>Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by
<a href="https://github.com/dependabot"><code>@​dependabot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1094">actions/setup-python#1094</a></li>
<li>Upgrade actions/publish-action from 0.3.0 to 0.4.0 &amp;
Documentation update for pip-install input by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1199">actions/setup-python#1199</a></li>
<li>Upgrade requests from 2.32.2 to 2.32.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1130">actions/setup-python#1130</a></li>
<li>Upgrade prettier from 3.5.3 to 3.6.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1234">actions/setup-python#1234</a></li>
<li>Upgrade <code>@​types/node</code> from 24.1.0 to 24.9.1 and update
macos-13 to macos-15-intel by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1235">actions/setup-python#1235</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/yarikoptic"><code>@​yarikoptic</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/979">actions/setup-python#979</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v6.1.0">https://github.com/actions/setup-python/compare/v6...v6.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/setup-python/compare/v6...v6.3.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:14:28 +00:00
dependabot[bot] c41a400619 Bump docker/login-action from 4 to 4.2.0 (#1730) 
Bumps [docker/login-action](https://github.com/docker/login-action) from
4 to 4.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0</h2>
<ul>
<li>Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in <a
href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1050.0 in <a
href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li>
<li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a
href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li>
<li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li>
<li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a
href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li>
<li>Bump postcss from 8.5.6 to 8.5.10 in <a
href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li>
<li>Bump tar from 6.2.1 to 7.5.15 in <a
href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li>
<li>Bump vite from 7.3.1 to 7.3.3 in <a
href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p>
<h2>v4.1.0</h2>
<ul>
<li>Fix scoped Docker Hub cleanup path when registry is omitted by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1020.0 in <a
href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a>
<a
href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li>
<li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li>
<li>Bump minimatch from 3.1.2 to 3.1.5 in <a
href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee"><code>650006c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/960">#960</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63"><code>99df1a3</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2"><code>3ab375f</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4"><code>39d8580</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/970">#970</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6"><code>4eefcd3</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56"><code>56d092c</code></a>
build(deps): bump <code>@​docker/actions-toolkit</code> from 0.86.0 to
0.90.0</li>
<li><a
href="https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff"><code>e2e31ca</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/976">#976</a>
from docker/dependabot/npm_and_yarn/actions/core-3.0.1</li>
<li><a
href="https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9"><code>0bced94</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c"><code>3e75a0f</code></a>
build(deps): bump <code>@​actions/core</code> from 3.0.0 to 3.0.1</li>
<li><a
href="https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970"><code>365bebd</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/984">#984</a>
from docker/dependabot/github_actions/aws-actions/con...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/v4...v4.2.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:14:10 +00:00
dependabot[bot]andcopilot-swe-agent[bot] 29fa324c7e Bump next from 16.2.3 to 16.2.11 in /docs (#1745) 
Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.2.11</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v16.2.10</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 16.2.4.</p>
<h2>v16.2.9</h2>
<p>Empty release to ensure <code>next@latest</code> points at a stable
release. Next.js only allows publishing with Trusted Publishing enabled.
In order to fix NPM dist-tags, we have to release a new version.
Updating dist-tags is not possible with Trusted Publishing.</p>
<h2>v16.2.8</h2>
<p>Release with no changes in an attempt to fix <code>next@latest</code>
pointing at a prerelease version.</p>
<h2>v16.2.7</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Backport documentation fixes for v16.2 (<a
href="https://redirect.github.com/vercel/next.js/issues/93804">#93804</a>)</li>
<li>[backport] Patch <code>playwright-core</code> to resolve
<code>_finishedPromise</code> on <code>requestFailed</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93920">#93920</a>)</li>
<li>[backport] Fix dev mode hydration failure when page is served from
HTTP cache (<a
href="https://redirect.github.com/vercel/next.js/issues/93492">#93492</a>)</li>
<li>[backport] Fix catch-all <code>router.query</code> corruption with
<code>basePath</code> + <code>rewrites</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93917">#93917</a>)</li>
<li>[backport] Encode non-ASCII characters in cache tags at construction
(<a
href="https://redirect.github.com/vercel/next.js/issues/93918">#93918</a>)</li>
<li>[backport] Fix server action forwarding loop with middleware
rewrites (<a
href="https://redirect.github.com/vercel/next.js/issues/93919">#93919</a>)</li>
<li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a
href="https://redirect.github.com/vercel/next.js/issues/93932">#93932</a>)</li>
<li>[ci] Disable hanging node 24 typescript tests on 16.2 backport
branch (<a
href="https://redirect.github.com/vercel/next.js/issues/94164">#94164</a>)</li>
<li>[backport] Fix &quot;type: module&quot; in project dir when using
standalone or adapters (<a
href="https://redirect.github.com/vercel/next.js/issues/94050">#94050</a>)</li>
<li>[backport] Propagate adapter preferred regions (<a
href="https://redirect.github.com/vercel/next.js/issues/94200">#94200</a>)</li>
<li>[16.2.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94240">#94240</a>)</li>
<li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS
config resolution (<a
href="https://redirect.github.com/vercel/next.js/issues/94284">#94284</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a
href="https://github.com/icyJoseph"><code>@​icyJoseph</code></a>, <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a>, <a
href="https://github.com/mischnic"><code>@​mischnic</code></a>, <a
href="https://github.com/bgw"><code>@​bgw</code></a>, <a
href="https://github.com/timneutkens"><code>@​timneutkens</code></a>,
and <a
href="https://github.com/lukesandberg"><code>@​lukesandberg</code></a>
for helping!</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/9beca0821cf4606ae33466ed6f4fc75f2887a4da"><code>9beca08</code></a>
v16.2.11</li>
<li><a
href="https://github.com/vercel/next.js/commit/3c48c7af78f2c01691065cb303da1b107a2c8617"><code>3c48c7a</code></a>
[16.x] Fix Turbopack middleware matcher with i18n single locale</li>
<li><a
href="https://github.com/vercel/next.js/commit/ac1eff3f7a7285176396ecc69c3b160a3d6ad1a2"><code>ac1eff3</code></a>
[16.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17"><code>9a4651e</code></a>
[16.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b"><code>b512063</code></a>
[16.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599"><code>d303326</code></a>
[16.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a"><code>73b9487</code></a>
[16.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/bf9d17fb30501829f6fd7c0ee8e44e2794565742"><code>bf9d17f</code></a>
[16.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/fe28768f533582ea8f6ee7d7a7498715927d45f5"><code>fe28768</code></a>
[16.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/d8afb8d550ac4ac5c106ea1410c3af43eaf1d469"><code>d8afb8d</code></a>
[16.x] Performance improvements when decoding React Server function
payloads</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.11">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-07-28 13:35:59 +00:00
dependabot[bot]andcopilot-swe-agent[bot] b012edc365 Bump @hey-api/openapi-ts from 0.95.0 to 0.97.3 in /frontend (#1727) 
Bumps
[@hey-api/openapi-ts](https://github.com/hey-api/hey-api/tree/HEAD/packages/openapi-ts)
from 0.95.0 to 0.97.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hey-api/hey-api/blob/main/packages/openapi-ts/CHANGELOG.md">@​hey-api/openapi-ts's
changelog</a>.</em></p>
<blockquote>
<h2>0.97.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><strong>plugin(<code>@​hey-api/client-axios</code>)</strong>: fix:
correct return type in SSE (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/a19b3a472f2480592f3cbe518ea5e7f02fe4a550"><code>a19b3a4</code></a>)
by <a
href="https://github.com/kitlangton"><code>@​kitlangton</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/preact-query</code>)</strong>: add
<code>getQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/client-ofetch</code>)</strong>: fix:
correct return type in SSE (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/a19b3a472f2480592f3cbe518ea5e7f02fe4a550"><code>a19b3a4</code></a>)
by <a
href="https://github.com/kitlangton"><code>@​kitlangton</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/svelte-query</code>)</strong>: add
<code>getQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>

<p><strong>plugin(<code>@​tanstack/angular-query-experimental</code>)</strong>:
add <code>getQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/react-query</code>)</strong>: add
<code>getQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/client-fetch</code>)</strong>: fix:
correct return type in SSE (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/a19b3a472f2480592f3cbe518ea5e7f02fe4a550"><code>a19b3a4</code></a>)
by <a
href="https://github.com/kitlangton"><code>@​kitlangton</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/react-query</code>)</strong>: add
<code>useGetQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/client-ky</code>)</strong>: fix:
correct return type in SSE (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/a19b3a472f2480592f3cbe518ea5e7f02fe4a550"><code>a19b3a4</code></a>)
by <a
href="https://github.com/kitlangton"><code>@​kitlangton</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/solid-query</code>)</strong>: add
<code>getQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/client-next</code>)</strong>: fix:
correct return type in SSE (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/a19b3a472f2480592f3cbe518ea5e7f02fe4a550"><code>a19b3a4</code></a>)
by <a
href="https://github.com/kitlangton"><code>@​kitlangton</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/preact-query</code>)</strong>: add
<code>useGetQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/client-angular</code>)</strong>: fix:
correct return type in SSE (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/58962a055b19c61ea5721d01f7ba2589bbbcb1ad"><code>58962a0</code></a>)
by <a
href="https://github.com/kitlangton"><code>@​kitlangton</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/transformers</code>)</strong>: add
support for Temporal API via <a
href="https://github.com/fullcalendar/temporal-polyfill">temporal-polyfill</a>
in <code>dates</code> (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3916">#3916</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/bfa457a3da2bebad46f6c621cfd8a0f22aa6b9d8"><code>bfa457a</code></a>)
by <a
href="https://github.com/OptoCloud"><code>@​OptoCloud</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​tanstack/vue-query</code>)</strong>: add
<code>getQueryData</code> option (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3827">#3827</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/1aa47851422dece48d103ad018759fea8151cb38"><code>1aa4785</code></a>)
by <a
href="https://github.com/inas-sirhan"><code>@​inas-sirhan</code></a></p>
</li>
<li>
<p><strong>plugin(zod)</strong>: fix: avoid invalid
<code>.extend()</code> on <code>z.record()</code> when a discriminated
union member is an empty object (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3915">#3915</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/8fa9f3ae0932401c097ccdd542d08b092f13873c"><code>8fa9f3a</code></a>)
by <a
href="https://github.com/apps/pullfrog"><code>@​pullfrog</code></a></p>
</li>
</ul>
<h3>Updated Dependencies:</h3>
<ul>
<li><code>@​hey-api/shared</code><a
href="https://github.com/0"><code>@​0</code></a>.4.5</li>
<li><code>@​hey-api/codegen-core</code><a
href="https://github.com/0"><code>@​0</code></a>.8.2</li>
</ul>
<h2>0.97.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><strong>plugin(zod)</strong>: use enums from TypeScript if available
(<a
href="https://redirect.github.com/hey-api/hey-api/pull/3884">#3884</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/abc8ceb43f37e7c9739fe010d3fcdb3be0bb5290"><code>abc8ceb</code></a>)
by <a href="https://github.com/mrlubos"><code>@​mrlubos</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/client-next</code>)</strong>: fix:
preserve query auth when when there are no other query parameters (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3853">#3853</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/a6ee7eb11cc6e8f1d5093d2c211d77874f337bbe"><code>a6ee7eb</code></a>)
by <a
href="https://github.com/apps/copilot-swe-agent"><code>@​copilot-swe-agent</code></a></p>
</li>
<li>
<p><strong>plugin(<code>@​hey-api/sdk</code>)</strong>: support
<code>valibot</code> as response transformer (<a
href="https://redirect.github.com/hey-api/hey-api/pull/3847">#3847</a>)
(<a
href="https://github.com/hey-api/hey-api/commit/6770f78dec53b1bf8f37c361c7b9c2e2eb4157fa"><code>6770f78</code></a>)
by <a href="https://github.com/SukkaW"><code>@​SukkaW</code></a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hey-api/hey-api/commit/d833f735fdb3c850800b7668ddb058f17aa62ab9"><code>d833f73</code></a>
ci: release</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/4987bc3c32ea2c585f4f2400b7d22154dceccfb8"><code>4987bc3</code></a>
docs: add changesets</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/30498ceff194c855cb81cca652739cbe3d924c28"><code>30498ce</code></a>
Merge branch 'main' of <a
href="https://github.com/hey-api/openapi-ts">https://github.com/hey-api/openapi-ts</a>
into feat/tansta...</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/9be7e7f181995158e9c41ab70ca62c47c35f62f6"><code>9be7e7f</code></a>
chore: one more try</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/4c5916d59384a5e9075463808fca1047856757a4"><code>4c5916d</code></a>
chore: one more try</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/83b4464cd8535a779aab1743fa1f16aa68f1a0e4"><code>83b4464</code></a>
chore: one more try</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/597e151a282b4ca7fa41f162c35f94e8728df8c7"><code>597e151</code></a>
Merge branch 'main' into
pullfrog/3914-zod-discriminated-union-empty-object</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/462c2e9432bc42d1c75267130472de89a3219634"><code>462c2e9</code></a>
Merge branch 'main' into feat/transformers-temporal</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/3367e64f071df30e4824e7c8b1e21040cae6f2d7"><code>3367e64</code></a>
Merge branch 'main' into fix/sse-iterator-treturn-miswiring</li>
<li><a
href="https://github.com/hey-api/hey-api/commit/e6d4416ff6f0a5f28009a7181001c2fc31bfd3b0"><code>e6d4416</code></a>
refactor: valibot plugin</li>
<li>Additional commits viewable in <a
href="https://github.com/hey-api/hey-api/commits/@hey-api/openapi-ts@0.97.3/packages/openapi-ts">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-07-28 12:20:09 +00:00
dependabot[bot] 05811b8c14 Bump aiohttp from 3.14.0 to 3.14.1 in /backend (#1748) 
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to
3.14.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's
changelog</a>.</em></p>
<blockquote>
<h1>3.14.1 (2026-06-07)</h1>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Fixed a race condition in
:py:class:<code>~aiohttp.TCPConnector</code> where closing the connector
while a DNS resolution was in-flight could raise
:py:exc:<code>AttributeError</code> instead of
:py:exc:<code>~aiohttp.ClientConnectionError</code> -- by
:user:<code>goingforstudying-ctrl</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12497</code>.</p>
</li>
<li>
<p>Fixed <code>CancelledError</code> not closing a connection -- by
:user:<code>aiolibsbot</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12795</code>.</p>
</li>
<li>
<p>Tightened up some websocket parser checks -- by
:user:<code>Dreamsorcerer</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12817</code>.</p>
</li>
<li>
<p>Fixed :class:<code>~aiohttp.CookieJar</code> dropping the host-only
flag of cookies when persisted with
:meth:<code>~aiohttp.CookieJar.save</code> and reloaded with
:meth:<code>~aiohttp.CookieJar.load</code>, so a cookie set without a
<code>Domain</code> attribute is again scoped to the exact host that set
it after a reload; the absolute expiration deadline is now persisted as
well, so a reloaded cookie keeps its original lifetime instead of being
rescheduled from the load time.
:meth:<code>~aiohttp.CookieJar.load</code> now replaces the jar contents
rather than merging onto prior state, and loaded cookies pass through
the same acceptance rules as
:meth:<code>~aiohttp.CookieJar.update_cookies</code>, so a cookie for an
IP-address host is dropped when loaded into a jar created without
<code>unsafe=True</code> -- by :user:<code>bdraco</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12824</code>.</p>
</li>
<li>
<p>Scoped :class:<code>~aiohttp.DigestAuthMiddleware</code> credentials
to the origin of the first request it handles, so a redirect to a
different origin no longer triggers a digest response computed from the
configured credentials; a challenge from another origin is only answered
when that origin falls within a protection space advertised by the
anchor origin through the RFC 7616 <code>domain</code> directive -- by
:user:<code>bdraco</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12825</code>.</p>
</li>
<li>
<p>Fixed the C HTTP parser not enforcing <code>max_line_size</code> on a
request target or response reason phrase that is split across multiple
reads; each fragment was checked on its own, so an accumulated line
could exceed the limit without raising <code>LineTooLong</code>. The
accumulated length is now checked, matching the pure-Python parser -- by
:user:<code>bdraco</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/9c35d03aa5fecd294510196e07f176f1a2e7fa33"><code>9c35d03</code></a>
Release v3.14.1 (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12864">#12864</a>)</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/38b956c617c8529f7e97e55e0390a474c6cb5f8a"><code>38b956c</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12861">#12861</a>/59684b5c
backport][3.14] Revert &quot;Drop list compression (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12857">#12857</a>)&quot;
(...</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/8f3100960faba4fea56afa1646aa072c128cc9db"><code>8f31009</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12857">#12857</a>/69dff14d
backport][3.14] Drop list compression (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12858">#12858</a>)</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"><code>dfdfa9d</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12830">#12830</a>/93a2b1c3
backport][3.14] Bound pipelined request queue per connect...</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/0e9cedd995c6ebaa84ae1a9148212599e0e888f4"><code>0e9cedd</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12827">#12827</a>/ccf218ab
backport][3.14] Numeric ipv4 resolver bypass (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12849">#12849</a>)</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"><code>a762eda</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12831">#12831</a>/1ac92dae
backport][3.14] Payload close on disconnect (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12843">#12843</a>)</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2"><code>a329a7a</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12824">#12824</a>/60b85e98
backport][3.14] Preserve host-only cookie scope across Co...</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232"><code>4f7480e</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12828">#12828</a>/13b635d7
backport][3.14] Bounded unread compressed drain (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12845">#12845</a>)</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"><code>5ab61bb</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12826">#12826</a>/36df6c13
backport][3.14] Enforce max_line_size on fragmented reque...</li>
<li><a
href="https://github.com/aio-libs/aiohttp/commit/3912667ae5281b5a14c58e04e02a3834534ff0d5"><code>3912667</code></a>
[3.14] Add test that env proxy auth is scoped to the redirect-selected
proxy ...</li>
<li>Additional commits viewable in <a
href="https://github.com/aio-libs/aiohttp/compare/v3.14.0...v3.14.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiohttp&package-manager=uv&previous-version=3.14.0&new-version=3.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 12:04:35 +00:00
dependabot[bot] 23ebf88d8a Bump python-multipart from 0.0.27 to 0.0.31 in /backend (#1747) 
Bumps [python-multipart](https://github.com/Kludex/python-multipart)
from 0.0.27 to 0.0.31.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/releases">python-multipart's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.0.31</h2>
<h2>What's Changed</h2>
<ul>
<li>Speed up multipart header parsing and callback dispatch by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/295">Kludex/python-multipart#295</a></li>
<li>Bound header field name size before validating by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/296">Kludex/python-multipart#296</a></li>
<li>Validate Content-Length is non-negative in parse_form by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/297">Kludex/python-multipart#297</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31">https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31</a></p>
<h2>Version 0.0.30</h2>
<h2>What's Changed</h2>
<ul>
<li>Treat only <code>&amp;</code> as the urlencoded field separator by
<a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/290">Kludex/python-multipart#290</a></li>
<li>Ignore RFC 2231 extended parameters in
<code>parse_options_header</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/291">Kludex/python-multipart#291</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30">https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30</a></p>
<h2>Version 0.0.29</h2>
<h2>What's Changed</h2>
<ul>
<li>Handle malformed RFC 2231 continuations in
<code>parse_options_header</code> by <a
href="https://github.com/manunio"><code>@​manunio</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/270">Kludex/python-multipart#270</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29">https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29</a></p>
<h2>Version 0.0.28</h2>
<h2>What's Changed</h2>
<ul>
<li>Speed up partial-boundary tail scan via <code>bytes.find</code> by
<a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/281">Kludex/python-multipart#281</a></li>
<li>Cap multipart boundary length at 256 bytes by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/282">Kludex/python-multipart#282</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28">https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md">python-multipart's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.31 (2026-06-04)</h2>
<ul>
<li>Speed up multipart header parsing and callback dispatch <a
href="https://redirect.github.com/Kludex/python-multipart/pull/295">#295</a>.</li>
<li>Bound header field name size before validating <a
href="https://redirect.github.com/Kludex/python-multipart/pull/296">#296</a>.</li>
<li>Validate <code>Content-Length</code> is non-negative in
<code>parse_form</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/297">#297</a>.</li>
</ul>
<h2>0.0.30 (2026-05-31)</h2>
<ul>
<li>Parse <code>application/x-www-form-urlencoded</code> bodies per the
WHATWG URL standard, treating only <code>&amp;</code> as a field
separator <a
href="https://redirect.github.com/Kludex/python-multipart/pull/290">#290</a>.</li>
<li>Ignore RFC 2231/5987 extended parameters (<code>name*</code>,
<code>filename*</code>) in <code>parse_options_header</code>, keeping
the plain parameter authoritative per <a
href="https://datatracker.ietf.org/doc/html/rfc7578#section-4.2">RFC
7578 §4.2</a> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/291">#291</a>.</li>
</ul>
<h2>0.0.29 (2026-05-17)</h2>
<ul>
<li>Handle malformed RFC 2231 continuations in
<code>parse_options_header</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/270">#270</a>.</li>
</ul>
<h2>0.0.28 (2026-05-10)</h2>
<ul>
<li>Speed up partial-boundary tail scan via <code>bytes.find</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/281">#281</a>.</li>
<li>Cap multipart boundary length at 256 bytes <a
href="https://redirect.github.com/Kludex/python-multipart/pull/282">#282</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/python-multipart/commit/4cffc68a165f7a6f6b7756ce006fabf07a05b7a4"><code>4cffc68</code></a>
Version 0.0.31 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/298">#298</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/c814948acf509cef7881fa75c969969b19239bbf"><code>c814948</code></a>
Reject negative <code>Content-Length</code> in <code>parse_form</code>
(<a
href="https://redirect.github.com/Kludex/python-multipart/issues/297">#297</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/6b837d47bc68826ed5cbbcb50c6c6a6093444494"><code>6b837d4</code></a>
Bound header field name size before validating (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/296">#296</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/e0c4f9df2e737d1663fbbdd6563f80613a2089f9"><code>e0c4f9d</code></a>
Bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/294">#294</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/b8a01bb683e8e8675fdb5d831b206a478c8215aa"><code>b8a01bb</code></a>
Bump the python-packages group with 3 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/293">#293</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/6732164f30c58e28589a1e22213d2f6b8c6bad9f"><code>6732164</code></a>
Speed up multipart header parsing and callback dispatch (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/295">#295</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/9d3ead568a259f222cff6425262ff63e88d930d4"><code>9d3ead5</code></a>
Version 0.0.30 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/292">#292</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/3506c15ce99cb62faf2d5ceb3c4c1e5800cb843d"><code>3506c15</code></a>
Ignore RFC 2231 extended parameters in <code>parse_options_header</code>
(<a
href="https://redirect.github.com/Kludex/python-multipart/issues/291">#291</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/d69df35cd2cad9c72794c2c340db646afae957d8"><code>d69df35</code></a>
Treat only <code>&amp;</code> as the urlencoded field separator (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/290">#290</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/1e6ff9740b09fb439755f30e2b0e2ada1d297325"><code>1e6ff97</code></a>
Bump idna from 3.11 to 3.15 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/289">#289</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.31">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-multipart&package-manager=uv&previous-version=0.0.27&new-version=0.0.31)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 12:03:58 +00:00
dependabot[bot] 6f8997bc26 Bump codecov/codecov-action from 6 to 7 (#1729) 
Bumps
[codecov/codecov-action](https://github.com/codecov/codecov-action) from
6 to 7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<p>⚠️ Due to migration issues with keybase, we are unable to update our
keys under the <code>codecovsecurity</code> account. We have deleted the
account and are using <code>codecovsecops</code> with the original gpg
key</p>
<h2>What's Changed</h2>
<ul>
<li>ci: remove Enforce License Compliance workflow by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1950">codecov/codecov-action#1950</a></li>
<li>chore(release): 7.0.0 by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1957">codecov/codecov-action#1957</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0">https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0</a></p>
<h2>v6.0.2</h2>
<p>This is a copy of the <code>v7.0.0</code> release to make updates
easier</p>
<h2>What's Changed</h2>
<ul>
<li>ci: remove Enforce License Compliance workflow by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1950">codecov/codecov-action#1950</a></li>
<li>chore(release): 7.0.0 by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1957">codecov/codecov-action#1957</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2">https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2</a></p>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: prevent template injection in run: steps (VULN-1652) by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1947">codecov/codecov-action#1947</a></li>
<li>chore(release): 6.0.1 by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1949">codecov/codecov-action#1949</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1">https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's
changelog</a>.</em></p>
<blockquote>
<h2>v5.5.2</h2>
<h3>What's Changed</h3>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p>
<h2>v5.5.1</h2>
<h3>What's Changed</h3>
<ul>
<li>fix: overwrite pr number on fork by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li>
<li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by
<code>@​app/dependabot</code> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li>
<li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by
<code>@​app/dependabot</code> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li>
<li>fix: update to use local app/ dir by <a
href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li>
<li>docs: fix typo in README by <a
href="https://github.com/datalater"><code>@​datalater</code></a> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li>
<li>Document a <code>codecov-cli</code> version reference example by <a
href="https://github.com/webknjaz"><code>@​webknjaz</code></a> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li>
<li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by
<code>@​app/dependabot</code> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by
<code>@​app/dependabot</code> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p>
<h2>v5.5.0</h2>
<h3>What's Changed</h3>
<ul>
<li>feat: upgrade wrapper to 0.2.4 by <a
href="https://github.com/jviall"><code>@​jviall</code></a> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li>
<li>Pin actions/github-script by Git SHA by <a
href="https://github.com/martincostello"><code>@​martincostello</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li>
<li>fix: check reqs exist by <a
href="https://github.com/joseph-sentry"><code>@​joseph-sentry</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li>
<li>fix: Typo in README by <a
href="https://github.com/spalmurray"><code>@​spalmurray</code></a> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li>
<li>docs: Refine OIDC docs by <a
href="https://github.com/spalmurray"><code>@​spalmurray</code></a> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li>
<li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by
<code>@​app/dependabot</code> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p>
<h2>v5.4.3</h2>
<h3>What's Changed</h3>
<ul>
<li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by
<code>@​app/dependabot</code> in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li>
<li>fix: OIDC on forks by <a
href="https://github.com/joseph-sentry"><code>@​joseph-sentry</code></a>
in <a
href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p>
<h2>v5.4.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/codecov/codecov-action/compare/v6...v7">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 12:01:22 +00:00
dependabot[bot] 8a2d2f70b6 Bump docker/build-push-action from 7 to 7.2.0 (#1731) 
Bumps
[docker/build-push-action](https://github.com/docker/build-push-action)
from 7 to 7.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/build-push-action/releases">docker/build-push-action's
releases</a>.</em></p>
<blockquote>
<h2>v7.2.0</h2>
<ul>
<li>Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1525">docker/build-push-action#1525</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.87.0 to 0.90.0 in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1517">docker/build-push-action#1517</a></li>
<li>Bump brace-expansion from 2.0.2 to 5.0.6 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1534">docker/build-push-action#1534</a></li>
<li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1529">docker/build-push-action#1529</a></li>
<li>Bump fast-xml-parser from 5.5.7 to 5.8.0 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1521">docker/build-push-action#1521</a></li>
<li>Bump postcss from 8.5.6 to 8.5.10 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1526">docker/build-push-action#1526</a></li>
<li>Bump tar from 6.2.1 to 7.5.15 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1533">docker/build-push-action#1533</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0">https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0</a></p>
<h2>v7.1.0</h2>
<ul>
<li>Git context <a
href="https://docs.docker.com/build/concepts/context/#url-queries">query
format</a> support by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.79.0 to 0.87.0 by
<a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1500">docker/build-push-action#1500</a></li>
<li>Bump fast-xml-parser from 5.4.2 to 5.5.7 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1489">docker/build-push-action#1489</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1491">docker/build-push-action#1491</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1490">docker/build-push-action#1490</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1497">docker/build-push-action#1497</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1510">docker/build-push-action#1510</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1496">docker/build-push-action#1496</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1486">docker/build-push-action#1486</a></li>
<li>Bump vite from 7.3.1 to 7.3.2 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1509">docker/build-push-action#1509</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0">https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/build-push-action/commit/f9f3042f7e2789586610d6e8b85c8f03e5195baf"><code>f9f3042</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1517">#1517</a>
from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a
href="https://github.com/docker/build-push-action/commit/812d5fd9212a4c5d419e5be02fd8e9bb435c5d76"><code>812d5fd</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/b6f66930769f2917a3275dc4d81f15583ac7e105"><code>b6f6693</code></a>
chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.87.0 to
0.90.0</li>
<li><a
href="https://github.com/docker/build-push-action/commit/c1c626eced73a500ec65c4256c620b3b9e8278c0"><code>c1c626e</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1525">#1525</a>
from docker/dependabot/npm_and_yarn/actions/core-3.0.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/51bb284cd4d05650aa6f5e4e22cb96d2cbfe62b7"><code>51bb284</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/5f7884def8f133e8ef40c53d003d1471c05621c6"><code>5f7884d</code></a>
chore(deps): Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/e01deff7d956c756a20f3e19ff7ddc0e4a50fc1d"><code>e01deff</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1521">#1521</a>
from docker/dependabot/npm_and_yarn/fast-xml-parser-...</li>
<li><a
href="https://github.com/docker/build-push-action/commit/3804d497934b39bd591ee9d1c6c9e593b4488a67"><code>3804d49</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/71e8947aac5dad23ce83a43e9c98f750e02de2f3"><code>71e8947</code></a>
chore(deps): Bump fast-xml-parser from 5.5.7 to 5.8.0</li>
<li><a
href="https://github.com/docker/build-push-action/commit/4925ad24cdbc42ff492d76cf9fe7a30b79976b60"><code>4925ad2</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1526">#1526</a>
from docker/dependabot/npm_and_yarn/postcss-8.5.10</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/build-push-action/compare/v7...v7.2.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 12:00:51 +00:00
dependabot[bot]andcopilot-swe-agent[bot] c9733d2ecc Bump react-router from 7.14.0 to 8.3.0 in /frontend (#1743) 
Bumps
[react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router)
from 7.14.0 to 8.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/remix-run/react-router/releases">react-router's
releases</a>.</em></p>
<blockquote>
<h2>v8.3.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830</a></p>
<h2>v8.2.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820</a></p>
<h2>v8.1.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810</a></p>
<h2>v8.0.1</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801</a></p>
<h2>v8.0.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800</a></p>
<h2>v7.18.1</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181">https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181</a></p>
<h2>v7.18.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180</a></p>
<h2>v7.17.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170</a></p>
<h2>v7.16.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160</a></p>
<h2>v7.15.1</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151</a></p>
<h2>v7.15.0</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150</a></p>
<h2>v7.14.2</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142</a></p>
<h2>v7.14.1</h2>
<p>See the changelog for release notes: <a
href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md">react-router's
changelog</a>.</em></p>
<blockquote>
<h2>v8.3.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Encode path params in <code>href</code>/<code>generatePath</code>
per RFC 3986 path-segment rules instead of
<code>encodeURIComponent</code> (<a
href="https://redirect.github.com/remix-run/react-router/pull/15310">#15310</a>)
<ul>
<li>Characters that are valid literally in a path segment (<code>$ &amp;
+ , ; = : @</code> — RFC 3986 <code>pchar</code>) are no longer
percent-encoded, so values like a semver build <code>1.0.0+1</code>
interpolate unchanged instead of becoming <code>1.0.0%2B1</code></li>
<li>Structural/unsafe characters (<code>/ ? # %</code>, whitespace,
non-ASCII) are still escaped exactly as before</li>
</ul>
</li>
<li>Use <code>crypto.randomUUID()</code> for
<code>createMemorySessionStorage</code> session ids (<a
href="https://redirect.github.com/remix-run/react-router/pull/15302">#15302</a>)
<ul>
<li><code>createMemorySessionStorage</code> is only intended for local
development and testing - sessions are lost when the server
restarts</li>
</ul>
</li>
<li>Fix <code>NavLink</code> not applying its <code>pending</code> state
when <code>to</code> has a trailing slash (<a
href="https://redirect.github.com/remix-run/react-router/pull/15300">#15300</a>)</li>
<li>Preserve RSC route component metadata so routes with a
<code>clientLoader</code> can skip unnecessary server requests once
their components have rendered while still fetching missing
server-rendered elements (<a
href="https://redirect.github.com/remix-run/react-router/pull/15323">#15323</a>)</li>
<li>Harden RSC CSRF code paths (<a
href="https://redirect.github.com/remix-run/react-router/pull/15311">#15311</a>)</li>
<li>Fix server crash (<code>TypeError: Invalid state: Unable to
enqueue</code>) when a request is aborted while the RSC HTML stream has
a pending flush (<a
href="https://redirect.github.com/remix-run/react-router/pull/15286">#15286</a>)
<ul>
<li>Handle cancellation of the <code>injectRSCPayload</code> readable
side, clear the pending flush, and cancel the underlying RSC payload
stream</li>
</ul>
</li>
</ul>
<h3>Unstable Changes</h3>
<p>⚠️ <em><a
href="https://reactrouter.com/community/api-development-strategy#unstable-flags">Unstable
features</a> are not recommended for production use</em></p>
<ul>
<li>
<p>Detect stale RSC clients during lazy route discovery and reload the
destination document (<a
href="https://redirect.github.com/remix-run/react-router/pull/15318">#15318</a>)</p>
<h4>Migration</h4>
<p>Apps using the default RSC Framework entry do not need to make any
changes. Apps with a custom <code>entry.rsc.tsx</code> should import the
generated client version and pass it to
<code>unstable_matchRSCServerRequest</code>:</p>
<pre lang="tsx"><code>import clientVersion from
&quot;virtual:react-router/unstable_rsc/client-version&quot;;
<p>return unstable_matchRSCServerRequest({<br />
// ...<br />
clientVersion,<br />
});<br />
</code></pre></p>
</li>
<li>
<p>Add CSP nonce support to RSC document rendering (<a
href="https://redirect.github.com/remix-run/react-router/pull/15320">#15320</a>)</p>
<ul>
<li>Add <code>nonce</code> options to
<code>unstable_routeRSCServerRequest</code> and
<code>unstable_RSCStaticRouter</code></li>
<li>Forward the nonce to the HTML renderer and apply it to injected RSC
payload scripts and nonce-aware framework components</li>
</ul>
<p>To adopt nonce-based CSP, update your <code>entry.ssr.tsx</code> (run
<code>react-router reveal entry.ssr</code> first in RSC Framework Mode)
to generate a fresh nonce for each request. Pass it to
<code>routeRSCServerRequest</code>, spread the <code>renderHTML</code>
options into React's HTML renderer, pass <code>options.nonce</code> to
<code>RSCStaticRouter</code>, and use the same nonce in the
<code>Content-Security-Policy</code> response header:</p>
<pre lang="tsx"><code>const nonce = crypto.randomUUID();
const response = await routeRSCServerRequest({
  request,
  serverResponse,
  createFromReadableStream,
  nonce,
  async renderHTML(getPayload, options) {
    const payload = getPayload();
    return renderHTMLToReadableStream(
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/remix-run/react-router/commit/2edaca7a4f12a50cad002d55d84f73b0cdd462b6"><code>2edaca7</code></a>
Release v8.3.0 (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15294">#15294</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/687ab72dddcc19d2fc749f992fe29789ba13daad"><code>687ab72</code></a>
Prep release notes</li>
<li><a
href="https://github.com/remix-run/react-router/commit/d2f1f1baa5f7f75def8e07bac3c37fb185c04e1f"><code>d2f1f1b</code></a>
update changes files to use h4 instead of h3 (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15334">#15334</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/8186207e4773958a3e124a76de5565256b248134"><code>8186207</code></a>
fix(rsc): preserve component metadata for client loader revalidation (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15323">#15323</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/c26e431c608c68580841e7c156ed986919c60630"><code>c26e431</code></a>
feat(rsc): support CSP nonces in document rendering (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15320">#15320</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/6286f904855afc245513a47ba5e4e4ffa3d63a15"><code>6286f90</code></a>
feat(rsc): reload stale clients after new deployments (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15318">#15318</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/3d83ad4ac2d19768bf7b9f80962b76c52c1f777a"><code>3d83ad4</code></a>
docs: fix useLinkClickHandler defaultShouldRevalidate default
description (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/1">#1</a>...</li>
<li><a
href="https://github.com/remix-run/react-router/commit/f75c89fd9cf76177c22d008265d78ee9184c483e"><code>f75c89f</code></a>
Update docs links to v8 API reference (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15316">#15316</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/baa9ba617b9df1114359439013462cc3486d5b72"><code>baa9ba6</code></a>
fix: encode path params per RFC 3986 path-segment rules in
href/generatePath ...</li>
<li><a
href="https://github.com/remix-run/react-router/commit/69debd1a33aa87924740ec199c4a598d4d1ebcae"><code>69debd1</code></a>
fix: apply NavLink pending state when the to prop has a trailing slash
(<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15300">#15300</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/remix-run/react-router/commits/react-router@8.3.0/packages/react-router">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-router&package-manager=npm_and_yarn&previous-version=7.14.0&new-version=8.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-07-28 11:56:16 +00:00
dependabot[bot] 5bd2a5bd24 Bump pyrefly from 1.0.0 to 1.1.1 in /backend (#1741) 
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 1.0.0 to
1.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/pyrefly/releases">pyrefly's
releases</a>.</em></p>
<blockquote>
<h2>Pyrefly v1.1.1</h2>
<p><em>Release date: June 18, 2026</em></p>
<p>Pyrefly v1.1.1 is a patch release with a single bug fix.</p>
<hr />
<h2>🐛 Bug fixes</h2>
<ul>
<li><strong><a
href="https://redirect.github.com/facebook/pyrefly/issues/3867">#3867</a>:</strong>
Fixed a regression introduced in 1.1.0 where <code>isinstance()</code>
narrowing of a union variable silently stopped working when an earlier
sibling branch in the same
<code>if</code>/<code>elif</code>/<code>else</code> chain narrowed a
different variable with <code>isinstance()</code> and returned. The
later narrowing left the union untouched, producing false
<code>missing-attribute</code> errors on code that checked correctly in
1.0.0.</li>
</ul>
<p>Thank-you to all our contributors who found these bugs and reported
them! Did you know this is one of the most helpful contributions you can
make to an open-source project? If you find any bugs in Pyrefly we want
to know about them! Please open a bug report issue <a
href="https://github.com/facebook/pyrefly/issues">here</a>.</p>
<hr />
<h2>📦 Upgrade</h2>
<pre lang="bash"><code>pip install --upgrade pyrefly==1.1.1
</code></pre>
<h3>How to safely upgrade your codebase</h3>
<p>Upgrading the version of Pyrefly you're using or a third-party
library you depend on can reveal new type errors in your code. Fixing
them all at once is often unrealistic. We've written scripts to help you
temporarily silence them. After upgrading, follow these steps:</p>
<ol>
<li><code>pyrefly check --suppress-errors</code></li>
<li>Run your code formatter of choice</li>
<li><code>pyrefly check --remove-unused-ignores</code></li>
<li>Repeat until you achieve a clean formatting run and a clean type
check.</li>
</ol>
<p>This will add <code># pyrefly: ignore</code> comments to your code,
enabling you to silence errors and return to fix them later. This can
make the process of upgrading a large codebase much more manageable.</p>
<p>Read more about error suppressions in the <a
href="https://pyrefly.org/en/docs/error-suppressions/">Pyrefly
documentation</a>.</p>
<h2>Pyrefly v1.1.0</h2>
<p><em>Release date: June 17, 2026</em></p>
<p>Pyrefly v1.1.0 bundles <strong>250 commits</strong> from <strong>25
contributors</strong>.</p>
<hr />
<h2>✨ New &amp; Improved</h2>
<h3>Type Checking</h3>
<ul>
<li>Pyrefly now correctly narrows <code>TypedDict</code> types after
<code>isinstance(x, dict)</code> checks, treating them as runtime
<code>dict</code> instances while preserving field information in the
positive branch.</li>
<li>Type narrowing for bounded and constrained <code>TypeVar</code>s has
been significantly improved. <code>isinstance</code> checks now
correctly narrow <code>Self</code> and bounded type variables via their
disjoint-base representatives, and negative narrowing on bounded
TypeVars no longer produces false positives.</li>
<li>Constrained <code>TypeVar</code>s are now preserved through method
calls and binary operations, so <code>T &amp; int</code> where <code>T:
(int, str)</code> correctly returns <code>T &amp; int</code> instead of
losing the TypeVar.</li>
<li>Classes decorated with <code>@dataclass(slots=True)</code> are now
recognized as PEP 800 disjoint bases when they synthesize non-empty
<code>__slots__</code>, enabling proper multiple-inheritance conflict
detection and type narrowing.</li>
<li>Pyrefly now detects when methods override parent class methods
without using the <code>@override</code> decorator, and a new quick fix
can automatically add the decorator for you.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/pyrefly/commit/b87de05834c401898c79fd9686b806c051dd3667"><code>b87de05</code></a>
cut 1.1.1</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/a297847fa0cee3a34b1dd2a055a70c1ebf3c0237"><code>a297847</code></a>
release notes for v1.1.1</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/4be867378805aa33bfe87d12e589561964a61b4f"><code>4be8673</code></a>
Fix isinstance narrowing silently breaking after a sibling branch
narrows ano...</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/67a11d42e5b1f141e3aa5340387da4f94292926d"><code>67a11d4</code></a>
cut 1.1.0</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/6eb38a7c373e760612524ef1803b8029714e08ae"><code>6eb38a7</code></a>
Handle empty name invalid syntax</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/54f61bc1042f368c9ed7b3cab4996a43bae51ec5"><code>54f61bc</code></a>
Resolve type-alias refs against their own module, not typing</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/fc495dc8a74201bcbcb464f092dd3ec5e963c906"><code>fc495dc</code></a>
add test for resolving type alias references</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/33de466bda7bb20fccfb45c3063ae543aa957164"><code>33de466</code></a>
Resolve real source locations by reusing the query transaction (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3829">#3829</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/3fd550de5b5e01fb42e542e80eba18af7a51de9a"><code>3fd550d</code></a>
Teach the type converter to resolve export locations</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/86f0da71bd5300188f1f3698720616d41d5bf64e"><code>86f0da7</code></a>
Lazy materialize implicit builtins</li>
<li>Additional commits viewable in <a
href="https://github.com/facebook/pyrefly/compare/1.0.0...1.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyrefly&package-manager=uv&previous-version=1.0.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 04:13:15 +00:00
dependabot[bot] 878d0b4ce2 Bump fastapi from 0.136.0 to 0.138.0 in /backend (#1740) 
Bumps [fastapi](https://github.com/fastapi/fastapi) from 0.136.0 to
0.138.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fastapi/fastapi/releases">fastapi's
releases</a>.</em></p>
<blockquote>
<h2>0.138.0</h2>
<h3>Features</h3>
<ul>
<li>✨ Add support for <code>app.frontend(&quot;/&quot;,
directory=&quot;dist&quot;)</code> and
<code>router.frontend(&quot;/&quot;, directory=&quot;dist&quot;)</code>.
PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15800">#15800</a>
by <a href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.
<ul>
<li>Read the docs: <a
href="https://fastapi.tiangolo.com/tutorial/frontend/">Frontend</a>.</li>
</ul>
</li>
</ul>
<h3>Docs</h3>
<ul>
<li>📝 Fix typo in release notes. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15807">#15807</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>📝 Add <code>app.frontend()</code> instructions to Agent Library
Skill. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15805">#15805</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>📝 Update release notes link. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15802">#15802</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>✏️ Update white space characters in bigger apps. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15801">#15801</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>✏️ Fix grammar, typos, and broken links in docs. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15694">#15694</a>
by <a
href="https://github.com/YuriiMotov"><code>@​YuriiMotov</code></a>.</li>
</ul>
<h3>Translations</h3>
<ul>
<li>🌐 Enable Hindi docs translations. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15554">#15554</a>
by <a
href="https://github.com/YuriiMotov"><code>@​YuriiMotov</code></a>.</li>
</ul>
<h3>Internal</h3>
<ul>
<li>🐛 Fix failing test, update format for raised errors. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15804">#15804</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>👷 Fix test-alls-green. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15803">#15803</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🔧 Enable checking <code>release-notes.md</code> for typos. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15796">#15796</a>
by <a
href="https://github.com/YuriiMotov"><code>@​YuriiMotov</code></a>.</li>
<li>📝 Tweak wording about deploying to FastAPI Cloud. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15793">#15793</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🔨 Use <code>gpt-5.5</code> model in <code>translate.py</code>,
specify <code>-chat</code> to avoid warnings. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15792">#15792</a>
by <a
href="https://github.com/YuriiMotov"><code>@​YuriiMotov</code></a>.</li>
</ul>
<h2>0.137.2</h2>
<h3>Features</h3>
<ul>
<li>✨ Add <code>iter_route_contexts()</code> for advanced use cases that
used to use <code>router.routes</code> (e.g. Jupyverse). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15785">#15785</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
</ul>
<h3>Translations</h3>
<ul>
<li>🌐 Fix broken Markdown in Korean custom response docs. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15774">#15774</a>
by <a href="https://github.com/kooqooo"><code>@​kooqooo</code></a>.</li>
<li>🌐 Update translations for fr (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15761">#15761</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for zh-hant (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15760">#15760</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for de (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15759">#15759</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for ko (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15757">#15757</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for uk (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15756">#15756</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for zh (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15755">#15755</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for tr (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15754">#15754</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for pt (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15753">#15753</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for es (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15752">#15752</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for ja (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15751">#15751</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🌐 Update translations for ru (update-outdated). PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15758">#15758</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
</ul>
<h3>Internal</h3>
<ul>
<li>🔧 Update sponsors: add BairesDev. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15787">#15787</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
<li>🔨 Update sponsors script to simplify previews. PR <a
href="https://redirect.github.com/fastapi/fastapi/pull/15786">#15786</a>
by <a
href="https://github.com/tiangolo"><code>@​tiangolo</code></a>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fastapi/fastapi/commit/4b83b0d409009c8de9df4070fe163838b1a700c7"><code>4b83b0d</code></a>
🔖 Release version 0.138.0 (<a
href="https://redirect.github.com/fastapi/fastapi/issues/15808">#15808</a>)</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/041cb0cdfa2d0f705d14ed07c2c2e0f92ef5f32c"><code>041cb0c</code></a>
📝 Update release notes</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/10393846ede7a2947cec594d15a43f813001cab4"><code>1039384</code></a>
📝 Fix typo in release notes (<a
href="https://redirect.github.com/fastapi/fastapi/issues/15807">#15807</a>)</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/0303491b69ff84a4632c0314e6db4df74f2f93f9"><code>0303491</code></a>
📝 Update release notes</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/190f6e2033c8b886b25027be284d8c8c1893f28c"><code>190f6e2</code></a>
📝 Add Frontend instructions to Agent Library Skill (<a
href="https://redirect.github.com/fastapi/fastapi/issues/15805">#15805</a>)</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/17945e5ab7f25234340c152a40d232a98857e079"><code>17945e5</code></a>
📝 Update release notes</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/2260afaf433103c8104b34d256cf0b96b058823b"><code>2260afa</code></a>
🐛 Fix failing test, update format for raised errors (<a
href="https://redirect.github.com/fastapi/fastapi/issues/15804">#15804</a>)</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/0cd5001d0ef80a07e2d775c5c75522391a3e06d7"><code>0cd5001</code></a>
📝 Update release notes</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/7cb1ab6264bc03319832f553730b511192a0c0d3"><code>7cb1ab6</code></a>
👷 Fix test-alls-green (<a
href="https://redirect.github.com/fastapi/fastapi/issues/15803">#15803</a>)</li>
<li><a
href="https://github.com/fastapi/fastapi/commit/9c7eceb00ff6e1d37980954418f7c9dab30a4cd5"><code>9c7eceb</code></a>
📝 Update release notes</li>
<li>Additional commits viewable in <a
href="https://github.com/fastapi/fastapi/compare/0.136.0...0.138.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fastapi&package-manager=uv&previous-version=0.136.0&new-version=0.138.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 04:12:52 +00:00
dependabot[bot] 4ad9494c7e Bump sentry-sdk from 2.62.0 to 2.63.0 in /backend (#1739) 
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from
2.62.0 to 2.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's
releases</a>.</em></p>
<blockquote>
<h2>2.63.0</h2>
<h3>Bug Fixes 🐛</h3>
<h4>Fastapi</h4>
<ul>
<li>Prevent double wrapping of sync handlers on FastAPI &gt;= 0.137 by
<a href="https://github.com/jhonny-on"><code>@​jhonny-on</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6569">#6569</a></li>
<li>Use effective_route_context path for prefixed routers by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6572">#6572</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(asgi) Gate query string and client IP behind send_default_pii by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6501">#6501</a></li>
<li>(serializer) Avoid creating reference cycles on every call by <a
href="https://github.com/Malkiz223"><code>@​Malkiz223</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6563">#6563</a></li>
<li>(user) Set <code>user.ip_address</code> on telemetry if present by
<a href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6555">#6555</a></li>
<li>Remove 0000 trace_id fallbacks by <a
href="https://github.com/sl0thentr0py"><code>@​sl0thentr0py</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6570">#6570</a></li>
<li>MANIFEST.in: Graft tests directory. by <a
href="https://github.com/charlesroelli"><code>@​charlesroelli</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6237">#6237</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<ul>
<li>(fastapi) Verify request info capture with POST endpoints by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6287">#6287</a></li>
<li>(starlette) Verify request info capture with POST endpoints by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6269">#6269</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>2.63.0</h2>
<h3>Bug Fixes 🐛</h3>
<h4>Fastapi</h4>
<ul>
<li>Prevent double wrapping of sync handlers on FastAPI &gt;= 0.137 by
<a href="https://github.com/jhonny-on"><code>@​jhonny-on</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6569">#6569</a></li>
<li>Use effective_route_context path for prefixed routers by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6572">#6572</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(asgi) Gate query string and client IP behind send_default_pii by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6501">#6501</a></li>
<li>(serializer) Avoid creating reference cycles on every call by <a
href="https://github.com/Malkiz223"><code>@​Malkiz223</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6563">#6563</a></li>
<li>(user) Set <code>user.ip_address</code> on telemetry if present by
<a href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6555">#6555</a></li>
<li>Remove 0000 trace_id fallbacks by <a
href="https://github.com/sl0thentr0py"><code>@​sl0thentr0py</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6570">#6570</a></li>
<li>MANIFEST.in: Graft tests directory. by <a
href="https://github.com/charlesroelli"><code>@​charlesroelli</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6237">#6237</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<ul>
<li>(fastapi) Verify request info capture with POST endpoints by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6287">#6287</a></li>
<li>(starlette) Verify request info capture with POST endpoints by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6269">#6269</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-python/commit/44b008a336bd9c64bf54ab8318bffbf9cc015bd1"><code>44b008a</code></a>
update changelog</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/0b2af511fd1b28208b8f8860c68efcab85e81970"><code>0b2af51</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/250caadc80033e975e7b4746ee1411bcf7fa98f3"><code>250caad</code></a>
release: 2.63.0</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/72a57de789777a7b0b836ef1225463478cb7df6a"><code>72a57de</code></a>
fix(flask): Set user data on scope at request start (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6566">#6566</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/6a4c3a1cb84a94b30ff1c0648e127dcf80bd83f8"><code>6a4c3a1</code></a>
fix: Remove 0000 trace_id fallbacks (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6570">#6570</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/1df9835e485a346f670ca5615106536a20212795"><code>1df9835</code></a>
feat(falcon): Set name and source on request span when streaming (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6562">#6562</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/77874bdb80039de5521830a88b133015e3c0b7a0"><code>77874bd</code></a>
test(falcon): Support span streaming (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6561">#6561</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/6bcfb9cf7e8e00a009bcd5ba4e1cb00f3fffe2d9"><code>6bcfb9c</code></a>
fix(fastapi): Prevent double wrapping of sync handlers on FastAPI &gt;=
0.137 (#...</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/72d972c176a1d41a8179b6666ca723de665399b5"><code>72d972c</code></a>
fix(fastapi): use effective_route_context path for prefixed routers (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6572">#6572</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/cc802f6fcedcbd50f76afe2fc902d4d21b6691d6"><code>cc802f6</code></a>
feat(chalice): Add span streaming support to Chalice integration (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6503">#6503</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-python/compare/2.62.0...2.63.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sentry-sdk&package-manager=uv&previous-version=2.62.0&new-version=2.63.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 04:12:34 +00:00
dependabot[bot] edce9f8b43 Bump starlette from 1.2.1 to 1.3.1 in /backend (#1737) 
Bumps [starlette](https://github.com/Kludex/starlette) from 1.2.1 to
1.3.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Use <code>StarletteDeprecationWarning</code> instead of
<code>DeprecationWarning</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li>
<li>Enforce <code>max_fields</code> and <code>max_part_size</code> in
<code>FormParser</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li>
<li>Enforce <code>FormParser</code> limits in parser callbacks by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p>
<h2>Version 1.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a
href="https://github.com/jiyujie2006"><code>@​jiyujie2006</code></a> in
<a
href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li>
<li>Catch <code>OSError</code> alongside <code>MultiPartException</code>
when closing temp files by <a
href="https://github.com/N3XT3R1337"><code>@​N3XT3R1337</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li>
<li>Add <code>httpx2</code> to the <code>full</code> extra by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li>
<li>Adjust testclient typing and warnings by <a
href="https://github.com/waketzheng"><code>@​waketzheng</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li>
<li>Fix IndexError in URL.replace() on a URL with no authority by <a
href="https://github.com/LeSingh1"><code>@​LeSingh1</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li>
<li>Annotate URLPath protocol parameter with Literal by <a
href="https://github.com/Chang-LeHung"><code>@​Chang-LeHung</code></a>
in <a
href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li>
<li>avoid collapsing exception groups from user code by <a
href="https://github.com/graingert"><code>@​graingert</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li>
<li>Use <code>removeprefix</code> to strip weak ETag indicator in
<code>is_not_modified</code> by <a
href="https://github.com/gnosyslambda"><code>@​gnosyslambda</code></a>
in <a
href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li>
<li>Build <code>request.url</code> from structured components by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jiyujie2006"><code>@​jiyujie2006</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li>
<li><a
href="https://github.com/N3XT3R1337"><code>@​N3XT3R1337</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li>
<li><a
href="https://github.com/leestana01"><code>@​leestana01</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li>
<li><a href="https://github.com/LeSingh1"><code>@​LeSingh1</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li>
<li><a
href="https://github.com/EmmanuelNiyonshuti"><code>@​EmmanuelNiyonshuti</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li>
<li><a
href="https://github.com/Chang-LeHung"><code>@​Chang-LeHung</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li>
<li><a
href="https://github.com/gnosyslambda"><code>@​gnosyslambda</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>1.3.1 (June 12, 2026)</h2>
<h4>Fixed</h4>
<ul>
<li>Enforce <code>max_fields</code> and <code>max_part_size</code> in
<code>FormParser</code> <a
href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li>
<li>Enforce <code>FormParser</code> limits in parser callbacks <a
href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li>
</ul>
<h2>1.3.0 (June 11, 2026)</h2>
<h4>Added</h4>
<ul>
<li>Add <code>httpx2</code> to the <code>full</code> extra <a
href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li>
<li>Annotate the <code>URLPath</code> <code>protocol</code> parameter
with <code>Literal</code> <a
href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li>
</ul>
<h4>Fixed</h4>
<ul>
<li>Build <code>request.url</code> from structured components <a
href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li>
<li>Clamp oversized suffix ranges in <code>FileResponse</code> <a
href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li>
<li>Catch <code>OSError</code> alongside <code>MultiPartException</code>
when closing temp files <a
href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li>
<li>Avoid collapsing exception groups raised from user code <a
href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li>
<li>Use <code>removeprefix</code> to strip the weak <code>ETag</code>
indicator in <code>is_not_modified</code> <a
href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li>
<li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL
with no authority <a
href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li>
<li>Adjust <code>testclient</code> typing and warnings <a
href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a>
Version 1.3.1 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a>
Enforce <code>FormParser</code> limits in parser callbacks (<a
href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a>
Enforce <code>max_fields</code> and <code>max_part_size</code> in
<code>FormParser</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a>
Use <code>StarletteDeprecationWarning</code> instead of
<code>DeprecationWarning</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a>
Version 1.3.0 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a>
Build <code>request.url</code> from structured components (<a
href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a>
Use <code>removeprefix</code> to strip weak ETag indicator in
<code>is_not_modified</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a>
avoid collapsing exception groups from user code (<a
href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a>
Annotate URLPath protocol parameter with Literal (<a
href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a>
docs: replace inline ASGI server list with link to canonical implemen…
(<a
href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=starlette&package-manager=uv&previous-version=1.2.1&new-version=1.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 04:12:53 +00:00
dependabot[bot] 9ee493a8b2 Bump sentry-sdk from 2.61.0 to 2.62.0 in /backend (#1736) 
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from
2.61.0 to 2.62.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's
releases</a>.</em></p>
<blockquote>
<h2>2.62.0</h2>
<h3>New Features ✨</h3>
<ul>
<li>
<p>Add integration for <code>aiomysql</code> by <a
href="https://github.com/tonal"><code>@​tonal</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/4703">#4703</a></p>
<p>We're adding support for the <code>aiomysql</code> package. To enable
the integration, add it to your <code>integrations</code> list:</p>
<pre lang="python"><code>import sentry_sdk
from sentry_sdk.integrations.aiomysql import AioMySQLIntegration
<p>sentry_sdk.init(
traces_sample_rate=1.0,
integrations=[AioMySQLIntegration()],
)
</code></pre></p>
</li>
<li>
<p>Support HTTPX2 by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6463">#6463</a></p>
<p>We're adding out-of-the-box support for HTTPX2. As long as use the
package, the Sentry integration
will be enabled automatically and you should see your requests
instrumented in Sentry.</p>
<pre lang="python"><code>import httpx2
import sentry_sdk
<p>sentry_sdk.init(...)</p>
<p>with sentry_sdk.start_transaction(name=&quot;testing_sentry&quot;):
httpx2.get(&quot;<a
href="https://sentry.io/">https://sentry.io/</a>&quot;)
</code></pre></p>
</li>
</ul>
<h3>Bug Fixes 🐛</h3>
<ul>
<li>(arq) Never capture control flow exceptions by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6507">#6507</a></li>
<li>(client) Guard against dotless qualified_name in
_setup_instrumentation by <a
href="https://github.com/devteamaegis"><code>@​devteamaegis</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6452">#6452</a></li>
<li>(pydantic-ai) Only use hooks when
<code>ModelRequestContext.model</code> exists by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6480">#6480</a></li>
<li>(rq) Restore <code>functools.wraps()</code> for patched functions by
<a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6532">#6532</a></li>
<li>(tracing_utils) Handle baggage values containing '=' in
from_incoming_header by <a
href="https://github.com/devteamaegis"><code>@​devteamaegis</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6450">#6450</a></li>
<li>(utils) Handle image_url string shorthand in
_is_image_type_with_blob_content by <a
href="https://github.com/devteamaegis"><code>@​devteamaegis</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6478">#6478</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<ul>
<li>(arq) Only pin <code>fakeredis&lt;2.36.0</code> in tests by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6444">#6444</a></li>
<li>(flaky) Change env for flaky test detector by <a
href="https://github.com/sl0thentr0py"><code>@​sl0thentr0py</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6492">#6492</a></li>
<li>(pydantic-ai) Create event loop before invoking sync methods by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6475">#6475</a></li>
<li>Use <code>package-ecosystem: uv</code> in dependabot by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6522">#6522</a></li>
<li>🤖 Update test matrix with new releases (06/08) by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6519">#6519</a></li>
<li>Raise minimum supported <code>aiomysql</code> version and update
text matrix by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6496">#6496</a></li>
<li>Deprecate OpenTelemetryIntegration in favor of OTLPIntegration and
no-op for span first by <a
href="https://github.com/sl0thentr0py"><code>@​sl0thentr0py</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6494">#6494</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>2.62.0</h2>
<h3>New Features ✨</h3>
<ul>
<li>
<p>Add integration for <code>aiomysql</code> by <a
href="https://github.com/tonal"><code>@​tonal</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/4703">#4703</a></p>
<p>We're adding support for the <code>aiomysql</code> package. To enable
the integration, add it to your <code>integrations</code> list:</p>
<pre lang="python"><code>import sentry_sdk
from sentry_sdk.integrations.aiomysql import AioMySQLIntegration
<p>sentry_sdk.init(
traces_sample_rate=1.0,
integrations=[AioMySQLIntegration()],
)
</code></pre></p>
</li>
<li>
<p>Support HTTPX2 by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6463">#6463</a></p>
<p>We're adding out-of-the-box support for HTTPX2. As long as use the
package, the Sentry integration
will be enabled automatically and you should see your requests
instrumented in Sentry.</p>
<pre lang="python"><code>import httpx2
import sentry_sdk
<p>sentry_sdk.init(...)</p>
<p>with sentry_sdk.start_transaction(name=&quot;testing_sentry&quot;):
httpx2.get(&quot;<a
href="https://sentry.io/">https://sentry.io/</a>&quot;)
</code></pre></p>
</li>
</ul>
<h3>Bug Fixes 🐛</h3>
<ul>
<li>(arq) Never capture control flow exceptions by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6507">#6507</a></li>
<li>(client) Guard against dotless qualified_name in
_setup_instrumentation by <a
href="https://github.com/devteamaegis"><code>@​devteamaegis</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6452">#6452</a></li>
<li>(pydantic-ai) Only use hooks when
<code>ModelRequestContext.model</code> exists by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6480">#6480</a></li>
<li>(rq) Restore <code>functools.wraps()</code> for patched functions by
<a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6532">#6532</a></li>
<li>(tracing_utils) Handle baggage values containing '=' in
from_incoming_header by <a
href="https://github.com/devteamaegis"><code>@​devteamaegis</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6450">#6450</a></li>
<li>(utils) Handle image_url string shorthand in
_is_image_type_with_blob_content by <a
href="https://github.com/devteamaegis"><code>@​devteamaegis</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6478">#6478</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<ul>
<li>(arq) Only pin <code>fakeredis&lt;2.36.0</code> in tests by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6444">#6444</a></li>
<li>(flaky) Change env for flaky test detector by <a
href="https://github.com/sl0thentr0py"><code>@​sl0thentr0py</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6492">#6492</a></li>
<li>(pydantic-ai) Create event loop before invoking sync methods by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6475">#6475</a></li>
<li>Use <code>package-ecosystem: uv</code> in dependabot by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6522">#6522</a></li>
<li>🤖 Update test matrix with new releases (06/08) by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6519">#6519</a></li>
<li>Raise minimum supported <code>aiomysql</code> version and update
text matrix by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6496">#6496</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-python/commit/0bac65a1c046e6eb7125d6413c29a188144e875b"><code>0bac65a</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/4a53c102d7a9dc4144900058ab456bcd82aaf17b"><code>4a53c10</code></a>
release: 2.62.0</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/afff0e23a44e0f264fdd7c50aa0d1af63c1aca41"><code>afff0e2</code></a>
fix(rq): Restore <code>functools.wraps()</code> for patched functions
(<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6532">#6532</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/33ca589e7b36f0bc33ba470506d5668704912d59"><code>33ca589</code></a>
build(deps-dev): bump openfeature-sdk from 0.9.0 to 0.10.0 (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6528">#6528</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/4fdd8e042b0c35cb0193e1aec825d3e5b11c4ce1"><code>4fdd8e0</code></a>
build(deps): bump pip from 26.1.1 to 26.1.2 (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6530">#6530</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/b466c279d7e2416d4374922ece59190de01c0ffb"><code>b466c27</code></a>
build(deps-dev): bump httpx2 from 2.2.0 to 2.3.0 (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6523">#6523</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/0be028f9ac82dbb3f5fdede5c03a8900148fbe7b"><code>0be028f</code></a>
build(deps-dev): bump typer from 0.26.2 to 0.26.7 (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6526">#6526</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/344c013951a5feaf9b07db91ce4d2969b20103a9"><code>344c013</code></a>
build(deps-dev): bump ruff from 0.15.14 to 0.15.16 (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6529">#6529</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/7d38a49af058d46299e1e01ec0086ff05f585866"><code>7d38a49</code></a>
ci: Use package-ecosystem: uv in dependabot (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6522">#6522</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/8c50017e5ad90f413ec7b70a2622ebfc007c9ff4"><code>8c50017</code></a>
build(deps): bump
getsentry/craft/.github/workflows/changelog-preview.yml fro...</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-python/compare/2.61.0...2.62.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sentry-sdk&package-manager=uv&previous-version=2.61.0&new-version=2.62.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 04:12:40 +00:00
dependabot[bot] 279f66be12 Bump pytest from 9.0.3 to 9.1.0 in /backend (#1735) 
Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to
9.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest/releases">pytest's
releases</a>.</em></p>
<blockquote>
<h2>9.1.0</h2>
<h1>pytest 9.1.0 (2026-06-13)</h1>
<h2>Removals and backward incompatible breaking changes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14533">#14533</a>:
When using <code>--doctest-modules</code>, autouse fixtures with
<code>module</code>, <code>package</code> or <code>session</code> scope
that are defined inline in Python test modules (not plugins or
conftests) will now possibly execute twice.</p>
<p>If this is undesirable, move the fixture definition to a
<code>conftest.py</code> file if possible.</p>
<p>Technical explanation for those interested:
When using <!-- raw HTML omitted -->--doctest-modules<!-- raw HTML
omitted -->, pytest possibly collects Python modules twice, once as
<code>pytest.Module</code> and once as a <code>DoctestModule</code>
(depending on the configuration).
Due to improvements in pytest's fixture implementation, if e.g. the
<code>DoctestModule</code> collects a fixture, it is now visible to it
only, and not to the <code>Module</code>.
This means that both need to register the fixtures independently.</p>
</li>
</ul>
<h2>Deprecations (removal in next major release)</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/10819">#10819</a>:
Added a deprecation warning for class-scoped fixtures defined as
instance methods (without <code>@classmethod</code>). Such fixtures set
attributes on a different instance than the test methods use, leading to
unexpected behavior. Use <code>@classmethod</code> decorator instead --
by <code>yastcher</code>.</p>
<p>See <code>10819</code> and <code>14011</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/12882">#12882</a>:
Calling <code>request.getfixturevalue()
&lt;pytest.FixtureRequest.getfixturevalue&gt;</code> during teardown to
request a fixture that was not already requested is now deprecated and
will become an error in pytest 10.</p>
<p>See <code>dynamic-fixture-request-during-teardown</code> for
details.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13409">#13409</a>:
Using non-<code>~collections.abc.Collection</code> iterables (such as
generators, iterators, or custom iterable objects) for the
<code>argvalues</code> parameter in <code>@pytest.mark.parametrize
&lt;pytest.mark.parametrize ref&gt;</code> and
<code>metafunc.parametrize &lt;pytest.Metafunc.parametrize&gt;</code> is
now deprecated.</p>
<p>These iterables get exhausted after the first iteration,
leading to tests getting unexpectedly skipped in cases such as running
<code>pytest.main()</code> multiple times,
using class-level parametrize decorators,
or collecting tests multiple times.</p>
<p>See <code>parametrize-iterators</code> for details and
suggestions.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>:
The private <code>config.inicfg</code> attribute is now deprecated.
Use <code>config.getini() &lt;pytest.Config.getini&gt;</code> to access
configuration values instead.</p>
<p>See <code>config-inicfg</code> for more details.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14004">#14004</a>:
Passing <code>baseid</code> to <code>~pytest.FixtureDef</code> or
<code>nodeid</code> strings to fixture registration APIs is now
deprecated. These are internal pytest APIs that are used by some
plugins.</p>
<p>Use the <code>node</code> parameter instead for fixture scoping. This
enables more robust node-based
matching instead of string prefix matching.
If you've used <code>nodeid=None</code>, pass <code>node=session</code>
instead.</p>
<p>This will be removed in pytest 10.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14335">#14335</a>:
The method of configuring hooks using markers, deprecated since pytest
7.2, is now scheduled to be removed in pytest 10.
See <code>hook-markers</code> for more details.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14434">#14434</a>:
The <code>--pastebin</code> option is now deprecated.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest/commit/b2522cf0b11fb33ecc1f4895fa1dffbb9252a63d"><code>b2522cf</code></a>
Prepare release version 9.1.0</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/368d2fca78e86ac79ec269bb078fcb1259a94fed"><code>368d2fc</code></a>
[refactor] Tighten <code>SetComparisonFunction</code> to
<code>Iterator[str]</code> (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14587">#14587</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ff77cd8b66b43a88c26ca54384bbcab72d079497"><code>ff77cd8</code></a>
[refactor] Make base assertion comparisons return an iterator instead of
a li...</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/0d8491a4ecf971800de0479ef55c7f5292c54937"><code>0d8491a</code></a>
build(deps): Bump actions/stale from 10.2.0 to 10.3.0</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/4a809d9c892f6abb5ba92b77b06f1dd878f4660a"><code>4a809d9</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14568">#14568</a>
from pytest-dev/register-fixture</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/5dfa38541becfb77d0f52cac4cc8cce71849ab61"><code>5dfa385</code></a>
Fix recursion traceback test to cover all styles (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14582">#14582</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/f52ff0c1778c15038cf2bbb00b7668dac674cc26"><code>f52ff0c</code></a>
Add <code>pytest.register_fixture</code></li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/a8ac094e80df788aec844794170b126eab0be7a4"><code>a8ac094</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14567">#14567</a>
from pytest-dev/more-visibility-deprecate</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/e5620cd21ec62f5a5f9a5141a3c76fb3953729b6"><code>e5620cd</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14577">#14577</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/2ce9c6d94eb691ea4da7f91f330602cbb67a6daf"><code>2ce9c6d</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14540">#14540</a>
from minbang930/fix-14533-doctest-module-fixtures</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest/compare/9.0.3...9.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest&package-manager=uv&previous-version=9.0.3&new-version=9.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 04:12:05 +00:00
dependabot[bot] d5f5a40986 Bump aiohttp from 3.13.4 to 3.14.0 in /backend (#1732) 
[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiohttp&package-manager=uv&previous-version=3.13.4&new-version=3.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 04:11:19 +00:00
dependabot[bot] 7cb4638f61 Bump uvicorn from 0.48.0 to 0.49.0 in /backend (#1733) 
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.48.0 to
0.49.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/releases">uvicorn's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.49.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump httptools minimum version to 0.8.0 by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2962">Kludex/uvicorn#2962</a></li>
<li>Consume duplicate forwarding headers in ProxyHeadersMiddleware
(reverses the 0.48.0 behavior of ignoring them) by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2971">Kludex/uvicorn#2971</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0">https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.0 (June 3, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Bump <code>httptools</code> minimum version to 0.8.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2962">#2962</a>)</li>
<li>Consume duplicate forwarding headers in
<code>ProxyHeadersMiddleware</code> (reverses the 0.48.0 behavior of
ignoring them) (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2971">#2971</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/uvicorn/commit/3ef2e3e08e3d9ad9572800f8bc54f3eaed9eab0a"><code>3ef2e3e</code></a>
Version 0.49.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2973">#2973</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/eeb64b1d1c95a14096ed3313377c74b485f558fc"><code>eeb64b1</code></a>
Consume duplicate forwarding headers in ProxyHeadersMiddleware (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2971">#2971</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/630f4aca14e79183617c71be714030842a1041c5"><code>630f4ac</code></a>
Make the watchfiles reload tests deterministic (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2972">#2972</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/9154922e3730f7aba68ecc3ecbf536680ee8fd1c"><code>9154922</code></a>
chore(deps): bump the github-actions group across 1 directory with 6
updates ...</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/739727a1d80e468d1e47e98bbd824ee9e3c9554b"><code>739727a</code></a>
Migrate docs deploy from Cloudflare Pages to Workers (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2967">#2967</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/be4a240488d3fb678a11b8e8f83505266f5f1de7"><code>be4a240</code></a>
Gate docs preview deploy on Cloudflare token presence (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2966">#2966</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/c489d7e10dfe653a2bba914feedf2a632a026e6f"><code>c489d7e</code></a>
Bump httptools minimum version to 0.8.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2962">#2962</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/9f547bd82ef52bcba206e04170b359bd6daa25b3"><code>9f547bd</code></a>
Skip docs preview deploy for Dependabot PRs (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2961">#2961</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/44446b894e37ca76830d6aa83df4349795400ed4"><code>44446b8</code></a>
Migrate documentation from MkDocs Material to Zensical (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2959">#2959</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/cfd659c4f18b526adce9c255c96707bab20af40c"><code>cfd659c</code></a>
Bump pymdown-extensions to 10.21.3 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2958">#2958</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uvicorn&package-manager=uv&previous-version=0.48.0&new-version=0.49.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 04:11:02 +00:00
dependabot[bot] 8a6d86980f Bump uvicorn from 0.47.0 to 0.48.0 in /backend (#1726) 
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.47.0 to
0.48.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/releases">uvicorn's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.48.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Default <code>ssl_ciphers</code> to <code>None</code> and use
OpenSSL defaults by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2940">Kludex/uvicorn#2940</a></li>
<li>Ignore duplicate forwarding headers in
<code>ProxyHeadersMiddleware</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2944">Kludex/uvicorn#2944</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0">https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's
changelog</a>.</em></p>
<blockquote>
<h2>0.48.0 (May 24, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Default <code>ssl_ciphers</code> to <code>None</code> and use
OpenSSL defaults (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2940">#2940</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Ignore duplicate forwarding headers in
<code>ProxyHeadersMiddleware</code> (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2944">#2944</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/uvicorn/commit/73e84e58d7f6b8b3dfd8a9e3e42d716862250f33"><code>73e84e5</code></a>
Version 0.48.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2951">#2951</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/45ea11690b4a62fa6df339d2b6ee3b8545a418e0"><code>45ea116</code></a>
Ignore duplicate forwarding headers in
<code>ProxyHeadersMiddleware</code> (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2944">#2944</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/dd4394c3cbfd9f27a696a7b08047149690058158"><code>dd4394c</code></a>
chore(deps): bump idna from 3.11 to 3.15 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2941">#2941</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/abe07818a191cd036dc3824d802d052207e01c7e"><code>abe0781</code></a>
Default <code>ssl_ciphers</code> to <code>None</code> and use OpenSSL
defaults (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2940">#2940</a>)</li>
<li>See full diff in <a
href="https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uvicorn&package-manager=uv&previous-version=0.47.0&new-version=0.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 04:11:21 +00:00
dependabot[bot] 8376072d5f Bump starlette from 1.1.0 to 1.2.1 in /backend (#1725) 
Bumps [starlette](https://github.com/Kludex/starlette) from 1.1.0 to
1.2.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Use <code>httpx2</code> for type checking in the
<code>testclient</code> module by <a
href="https://github.com/leifwar"><code>@​leifwar</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li>
<li>Add assert error for requires() when request param is not Request
type by <a
href="https://github.com/KeeganOP"><code>@​KeeganOP</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/leifwar"><code>@​leifwar</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li>
<li><a href="https://github.com/diskeu"><code>@​diskeu</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li>
<li><a href="https://github.com/KeeganOP"><code>@​KeeganOP</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p>
<h2>Version 1.2.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Support httpx2 in the test client by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>1.2.1 (May 31, 2026)</h2>
<h4>Fixed</h4>
<ul>
<li>Use <code>httpx2</code> for type checking in the
<code>testclient</code> module <a
href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li>
<li>Add assert error for <code>requires()</code> when the request
parameter is not a <code>Request</code> type <a
href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li>
</ul>
<h2>1.2.0 (May 28, 2026)</h2>
<h4>Added</h4>
<ul>
<li>Support httpx2 in the test client <a
href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/ef773fe9fe86d452ea014a39c6ede1029b341e73"><code>ef773fe</code></a>
Version 1.2.1 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3306">#3306</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/3fc68a7e394cb938bd202774b9d6f5c33a237a66"><code>3fc68a7</code></a>
Add sponsors section to docs sidebar (<a
href="https://redirect.github.com/Kludex/starlette/issues/3305">#3305</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/b053f7bbf194c3fac77d87c6033ec6181eb4cd90"><code>b053f7b</code></a>
chore(deps): bump the python-packages group across 1 directory with 6
updates...</li>
<li><a
href="https://github.com/Kludex/starlette/commit/14787751400853cc21853983a02d84bbfb4da45d"><code>1478775</code></a>
Add assert error for requires() when request param is not Request type
(<a
href="https://redirect.github.com/Kludex/starlette/issues/3298">#3298</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/65765470827be550cdbc1a2e7165da494da7f6e8"><code>6576547</code></a>
Describe disconnected-after-response behavior in test docstring (<a
href="https://redirect.github.com/Kludex/starlette/issues/3243">#3243</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/9cb1553be6ff3d18a0d30a18e3b623ea86edeef0"><code>9cb1553</code></a>
Use same module (httpx|httpx2) for type checking as for runtime (<a
href="https://redirect.github.com/Kludex/starlette/issues/3304">#3304</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/4060987466412dcdb3e5a0f05973b4208dddb6f0"><code>4060987</code></a>
Version 1.2.0 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3300">#3300</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/1e289ca3f957370122fb3bf7e046db65f6675037"><code>1e289ca</code></a>
Migrate docs deploy from Cloudflare Pages to Workers Static Assets (<a
href="https://redirect.github.com/Kludex/starlette/issues/3282">#3282</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/100f05a66bf3ff5643540164ae95fc3ad9ed3443"><code>100f05a</code></a>
Add <code>httpx2</code> as a dev dependency (<a
href="https://redirect.github.com/Kludex/starlette/issues/3295">#3295</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/508023b488b649d97c091eb60da1d8ef3636ee06"><code>508023b</code></a>
Support httpx2 in the test client (<a
href="https://redirect.github.com/Kludex/starlette/issues/3291">#3291</a>)</li>
<li>See full diff in <a
href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=starlette&package-manager=uv&previous-version=1.1.0&new-version=1.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 04:10:59 +00:00
dependabot[bot] 0c8f1eb2de Bump sentry-sdk from 2.60.0 to 2.61.0 in /backend (#1724) 
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from
2.60.0 to 2.61.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's
releases</a>.</em></p>
<blockquote>
<h2>2.61.0</h2>
<h3>New Features ✨</h3>
<ul>
<li>
<p>Add <code>server.address</code> to transformed spans when
<code>stream_gen_ai_spans=True</code> by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6307">#6307</a></p>
</li>
<li>
<p>Allow integrations to define control flow exceptions by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6425">#6425</a></p>
</li>
<li>
<p>Disable string truncation for events by default by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6290">#6290</a></p>
<p>Following a previous significant increase of the string truncation
limit, we've now completely removed the limit by default.
In case you have large strings in your events, you should now be able to
see them.</p>
<p>In rare cases, if you have really long strings (or a lot of them),
you might see envelopes being dropped because of their size.
If that happens, you can set the <code>max_value_length</code>
<code>init</code> option to the previous value of
<code>100_000</code>:</p>
<pre lang="python"><code>sentry_sdk.init(
    ...,
    max_value_length=100_000,
)
</code></pre>
</li>
</ul>
<h3>Bug Fixes 🐛</h3>
<h4>Langchain</h4>
<ul>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6301">#6301</a></li>
<li>Catch <code>TypeError</code> on <code>langchain.agents</code> import
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6268">#6268</a></li>
</ul>
<h4>Openai Agents</h4>
<ul>
<li>Handle <code>starting_agent</code> keyword argument in runner
patches by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6428">#6428</a></li>
<li>Remove hosted MCP tool spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6391">#6391</a></li>
<li>Use <code>name</code>, not <code>description</code> in
<code>start_span</code> by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6323">#6323</a></li>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6303">#6303</a></li>
</ul>
<h4>Pydantic AI</h4>
<ul>
<li>Stop setting tokens on Invoke Agent spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6320">#6320</a></li>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6302">#6302</a></li>
<li>Remove <code>Agent.run_stream_events()</code> patch by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6281">#6281</a></li>
</ul>
<h4>Strawberry</h4>
<ul>
<li>Wrap yields in try-except to ensure span cleanup by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6381">#6381</a></li>
<li>Fix <code>AttributeError</code> on <code>graphql_span</code> in
<code>resolve</code> by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6289">#6289</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(anthropic) Do not set <code>gen_ai.response.model</code> to
<code>None</code> by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6312">#6312</a></li>
<li>(asyncpg) Use Sentry span attribute name conventions by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6306">#6306</a></li>
<li>(boto3) Guard setting method by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6288">#6288</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>2.61.0</h2>
<h3>New Features ✨</h3>
<ul>
<li>
<p>Add <code>server.address</code> to transformed spans when
<code>stream_gen_ai_spans=True</code> by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6307">#6307</a></p>
</li>
<li>
<p>Allow integrations to define control flow exceptions by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6425">#6425</a></p>
</li>
<li>
<p>Disable string truncation for events by default by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6290">#6290</a></p>
<p>Following a previous significant increase of the string truncation
limit, we've now completely removed the limit by default.
In case you have large strings in your events, you should now be able to
see them.</p>
<p>In rare cases, if you have really long strings (or a lot of them),
you might see envelopes being dropped because of their size.
If that happens, you can set the <code>max_value_length</code>
<code>init</code> option to the previous value of
<code>100_000</code>:</p>
<pre lang="python"><code>sentry_sdk.init(
    ...,
    max_value_length=100_000,
)
</code></pre>
</li>
</ul>
<h3>Bug Fixes 🐛</h3>
<h4>Langchain</h4>
<ul>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6301">#6301</a></li>
<li>Catch <code>TypeError</code> on <code>langchain.agents</code> import
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6268">#6268</a></li>
</ul>
<h4>Openai Agents</h4>
<ul>
<li>Handle <code>starting_agent</code> keyword argument in runner
patches by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6428">#6428</a></li>
<li>Remove hosted MCP tool spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6391">#6391</a></li>
<li>Use <code>name</code>, not <code>description</code> in
<code>start_span</code> by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6323">#6323</a></li>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6303">#6303</a></li>
</ul>
<h4>Pydantic AI</h4>
<ul>
<li>Stop setting tokens on Invoke Agent spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6320">#6320</a></li>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6302">#6302</a></li>
<li>Remove <code>Agent.run_stream_events()</code> patch by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6281">#6281</a></li>
</ul>
<h4>Strawberry</h4>
<ul>
<li>Wrap yields in try-except to ensure span cleanup by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6381">#6381</a></li>
<li>Fix <code>AttributeError</code> on <code>graphql_span</code> in
<code>resolve</code> by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6289">#6289</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(anthropic) Do not set <code>gen_ai.response.model</code> to
<code>None</code> by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6312">#6312</a></li>
<li>(asyncpg) Use Sentry span attribute name conventions by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6306">#6306</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-python/commit/53df8783b8961e2cba32d932b78c79e4408c7ed6"><code>53df878</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/24f6bf7a81aeb554f9ed1459d6a386bec6878ab1"><code>24f6bf7</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/f50bec574650d3c09b14683491219d458f72c13b"><code>f50bec5</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/35469462b9d672ec6be408a3292447252ea23712"><code>3546946</code></a>
release: 2.61.0</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/54f768680cad8a40ab97be4dddd16c12c9cba493"><code>54f7686</code></a>
feat(span-streaming): Add more attrs to segment spans (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6432">#6432</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/7e27e34fd05b337574a93352c773b1d4a2885d13"><code>7e27e34</code></a>
feat(openai): Support span streaming (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6431">#6431</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/139a9a176f732ba7f1456510c2f0f00930e38558"><code>139a9a1</code></a>
feat: Add <code>server.address</code> to transformed spans when
`stream_gen_ai_spans=Tru...</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/7bf1d6ee4ba0069e074c462c256f8a88b8b450a0"><code>7bf1d6e</code></a>
fix(openai_agents): Handle starting_agent keyword argument in runner
patches ...</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/5662d86fd9ac8ddf635c0da489b275093c0feb08"><code>5662d86</code></a>
test(langchain): Deduplicate by removing <code>node.callspec.id</code>
matching (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6426">#6426</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/fb9def2f53ec65bbf70d1d8a63acb1a6a2f4e195"><code>fb9def2</code></a>
feat(huey): Migrate Huey integration to spans-first tracing (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6399">#6399</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-python/compare/2.60.0...2.61.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sentry-sdk&package-manager=uv&previous-version=2.60.0&new-version=2.61.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 04:10:41 +00:00
dependabot[bot] 8aa1bb1c36 Bump pytest-asyncio from 1.3.0 to 1.4.0 in /backend (#1723) 
Bumps [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio)
from 1.3.0 to 1.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-asyncio/releases">pytest-asyncio's
releases</a>.</em></p>
<blockquote>
<h2>pytest-asyncio v1.4.0</h2>
<h1><a
href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.0">1.4.0</a>
- 2026-05-26</h1>
<h2>Deprecated</h2>
<ul>
<li>Overriding the <em>event_loop_policy</em> fixture is deprecated. Use
the <code>pytest_asyncio_loop_factories</code> hook instead. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1419">#1419</a>)</li>
</ul>
<h2>Added</h2>
<ul>
<li>
<p>Added the <code>pytest_asyncio_loop_factories</code> hook to
parametrize asyncio tests with custom event loop factories.</p>
<p>The hook returns a mapping of factory names to loop factories, and
<code>pytest.mark.asyncio(loop_factories=[...])</code> selects a subset
of configured factories per test. When a single factory is configured,
test names are unchanged.</p>
<p>Synchronous <code>@pytest_asyncio.fixture</code> functions now see
the correct event loop when custom loop factories are configured, even
when test code disrupts the current event loop (e.g., via
<code>asyncio.run()</code> or
<code>asyncio.set_event_loop(None)</code>). (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1164">#1164</a>)</p>
</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Improved the readability of the warning message that is displayed
when <code>asyncio_default_fixture_loop_scope</code> is unset (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1298">#1298</a>)</li>
<li>Only import <code>asyncio.AbstractEventLoopPolicy</code> for type
checking to avoid raising
a DeprecationWarning. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1394">#1394</a>)</li>
<li>Updated minimum supported pytest version to v8.4.0. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1397">#1397</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Fixed a <code>ResourceWarning: unclosed event loop</code> warning
that could occur when a synchronous test called
<code>asyncio.run()</code> or otherwise unset the current event loop
after pytest-asyncio had run an async test or fixture. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/724">#724</a>)</li>
</ul>
<h2>Notes for Downstream Packagers</h2>
<ul>
<li>Added dependency on <code>sphinx-tabs &gt;= 3.5</code> to organize
documentation examples into tabs. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1395">#1395</a>)</li>
</ul>
<h2>pytest-asyncio v1.4.0a2</h2>
<h1><a
href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.0a2">1.4.0a2</a>
- 2026-05-02</h1>
<h2>Deprecated</h2>
<ul>
<li>Overriding the <em>event_loop_policy</em> fixture is deprecated. Use
the <code>pytest_asyncio_loop_factories</code> hook instead. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1419">#1419</a>)</li>
</ul>
<h2>Added</h2>
<ul>
<li>
<p>Added the <code>pytest_asyncio_loop_factories</code> hook to
parametrize asyncio tests with custom event loop factories.</p>
<p>The hook returns a mapping of factory names to loop factories, and
<code>pytest.mark.asyncio(loop_factories=[...])</code> selects a subset
of configured factories per test. When a single factory is configured,
test names are unchanged on pytest 8.4+.</p>
<p>Synchronous <code>@pytest_asyncio.fixture</code> functions now see
the correct event loop when custom loop factories are configured, even
when test code disrupts the current event loop (e.g., via
<code>asyncio.run()</code> or
<code>asyncio.set_event_loop(None)</code>). (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1164">#1164</a>)</p>
</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Improved the readability of the warning message that is displayed
when <code>asyncio_default_fixture_loop_scope</code> is unset (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1298">#1298</a>)</li>
<li>Only import <code>asyncio.AbstractEventLoopPolicy</code> for type
checking to avoid raising
a DeprecationWarning. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1394">#1394</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/6e14cd2af9292dca1fa2b027a06bbc40b0e0e425"><code>6e14cd2</code></a>
chore: Prepare release of v1.4.0.</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/4b900fb5d0c30949c574e55dd904ee179f858a5e"><code>4b900fb</code></a>
Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/ab9f63245094865c42c940a34af724b0dec1debf"><code>ab9f632</code></a>
Build(deps): Bump zipp from 3.23.1 to 4.1.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/a56fc77ecd59f781d8471b0f6a82bf58e08c95fa"><code>a56fc77</code></a>
Build(deps): Bump hypothesis from 6.152.6 to 6.152.8</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/e8bae9bc1f197731fc1a210c0da557af7b698e6d"><code>e8bae9b</code></a>
Build(deps): Bump requests from 2.34.0 to 2.34.2</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/fc433402c570fd36a7a227ef4bc3abd4579299de"><code>fc43340</code></a>
Build(deps): Bump idna from 3.14 to 3.15</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/762eaf5033b798b965c92afdbb2cebefa8fc3a8b"><code>762eaf5</code></a>
Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b62e2228c80070977baf6b77ba89d5c148af920f"><code>b62e222</code></a>
Build(deps): Bump click from 8.3.3 to 8.4.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/919044700627889d25ca63b6e7a3bc785f3137eb"><code>9190447</code></a>
Build(deps): Bump pydantic from 2.13.3 to 2.13.4</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/82a393c5e31b6ebbbd8ec2a8dafc5f35b9cf1236"><code>82a393c</code></a>
ci: Remove unnecessary debug output.</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-asyncio/compare/v1.3.0...v1.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest-asyncio&package-manager=uv&previous-version=1.3.0&new-version=1.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 04:10:15 +00:00
dependabot[bot] 1d5e71fc20 Bump starlette from 1.0.1 to 1.1.0 in /backend (#1720) 
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to
1.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Use <code>&quot;application/octet-stream&quot;</code> as the
<code>FileResponse</code> media type fallback by <a
href="https://github.com/ATOM00blue"><code>@​ATOM00blue</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3283">Kludex/starlette#3283</a></li>
<li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3286">Kludex/starlette#3286</a></li>
<li>Reject absolute paths in <code>StaticFiles.lookup_path</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3287">Kludex/starlette#3287</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ATOM00blue"><code>@​ATOM00blue</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3283">Kludex/starlette#3283</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.0.1...1.1.0">https://github.com/Kludex/starlette/compare/1.0.1...1.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>1.1.0 (May 23, 2026)</h2>
<h4>Added</h4>
<ul>
<li>Use <code>&quot;application/octet-stream&quot;</code> as the
<code>FileResponse</code> media type fallback <a
href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li>
</ul>
<h4>Fixed</h4>
<ul>
<li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a
href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li>
<li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a
href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/a4ff83b1aacaf8955e241dd00444c27823be163a"><code>a4ff83b</code></a>
Version 1.1.0 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3289">#3289</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5"><code>fd53168</code></a>
Reject absolute paths in <code>StaticFiles.lookup_path</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3287">#3287</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/e3f972225adb1d84b80dba132f520cc24cb84229"><code>e3f9722</code></a>
Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3286">#3286</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/348f86dc92fed6e3c0314154e38deec90a6bcabd"><code>348f86d</code></a>
Use <code>&quot;application/octet-stream&quot;</code> as the
<code>FileResponse</code> media type fallback (#...</li>
<li>See full diff in <a
href="https://github.com/Kludex/starlette/compare/1.0.1...1.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=starlette&package-manager=uv&previous-version=1.0.1&new-version=1.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 04:10:53 +00:00
dependabot[bot] 611dfdbcfc Bump pydantic-settings from 2.14.0 to 2.14.2 in /backend (#1719) 
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings)
from 2.14.0 to 2.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's
releases</a>.</em></p>
<blockquote>
<h2>v2.14.2</h2>
<h2>What's Changed</h2>
<p>This is a security patch release.</p>
<ul>
<li>Prevent <code>NestedSecretsSettingsSource</code> from following
symlinks outside <code>secrets_dir</code> by <a
href="https://github.com/hramezani"><code>@​hramezani</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/889">pydantic/pydantic-settings#889</a></li>
<li>Prepare release 2.14.2 by <a
href="https://github.com/hramezani"><code>@​hramezani</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/890">pydantic/pydantic-settings#890</a></li>
</ul>
<h3>Security</h3>
<p>Fixes <a
href="https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j">GHSA-4xgf-cpjx-pc3j</a>:
<code>NestedSecretsSettingsSource</code> with
<code>secrets_nested_subdir=True</code> could follow a symbolic link
inside <code>secrets_dir</code> pointing outside it, reading out-of-tree
files into settings values and bypassing the
<code>secrets_dir_max_size</code> cap. Affected versions: <code>&gt;=
2.12.0, &lt; 2.14.2</code>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2">https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2</a></p>
<h2>v2.14.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump the python-packages group with 4 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/850">pydantic/pydantic-settings#850</a></li>
<li>Bump the python-packages group with 5 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/854">pydantic/pydantic-settings#854</a></li>
<li>Bump the github-actions group with 3 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/853">pydantic/pydantic-settings#853</a></li>
<li>Bump the python-packages group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/856">pydantic/pydantic-settings#856</a></li>
<li>Fix field named <code>cls</code> conflicting with classmethod
parameter by <a
href="https://github.com/hramezani"><code>@​hramezani</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/858">pydantic/pydantic-settings#858</a></li>
<li>Prepare release 2.14.1 by <a
href="https://github.com/hramezani"><code>@​hramezani</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic-settings/pull/859">pydantic/pydantic-settings#859</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1">https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/d703bd717e5e07439fa89da2245eee6139413e9e"><code>d703bd7</code></a>
Prepare release 2.14.2 (<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/890">#890</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/e95c30bec8cfaee88ee275138c064aea97a25bdf"><code>e95c30b</code></a>
Prepare release 2.14.1 (<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/859">#859</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/0c8734581b6cf70a995afad603ac456631d00621"><code>0c87345</code></a>
Fix field named <code>cls</code> conflicting with classmethod parameter
(<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/858">#858</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/7bd0072795a800065b42210b6dca90fc9b83daf7"><code>7bd0072</code></a>
Bump the python-packages group with 2 updates (<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/856">#856</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/b03e573d017ed48e1c2774a5e0b715db9766c76b"><code>b03e573</code></a>
Bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/853">#853</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/eaa3b434938411ec8a3717ea646614561e713f51"><code>eaa3b43</code></a>
Bump the python-packages group with 5 updates (<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/854">#854</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic-settings/commit/9f95615c24c6813c1d7d203576581a79cb6d9e8e"><code>9f95615</code></a>
Bump the python-packages group with 4 updates (<a
href="https://redirect.github.com/pydantic/pydantic-settings/issues/850">#850</a>)</li>
<li>See full diff in <a
href="https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pydantic-settings&package-manager=uv&previous-version=2.14.0&new-version=2.14.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-19 23:42:20 +00:00
dependabot[bot] 9077b2d0a0 Bump uvicorn from 0.46.0 to 0.47.0 in /backend (#1718) 
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.46.0 to
0.47.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/releases">uvicorn's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.47.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Eagerly import the ASGI app in the parent process by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2919">Kludex/uvicorn#2919</a></li>
<li>Add <code>ssl_context_factory</code> for custom
<code>SSLContext</code> configuration by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2920">Kludex/uvicorn#2920</a></li>
<li>Treat <code>fd=0</code> as a valid file descriptor with
reload/workers by <a
href="https://github.com/eltoder"><code>@​eltoder</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2927">Kludex/uvicorn#2927</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0">https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's
changelog</a>.</em></p>
<blockquote>
<h2>0.47.0 (May 14, 2026)</h2>
<h3>Added</h3>
<ul>
<li>Add <code>ssl_context_factory</code> for custom
<code>SSLContext</code> configuration (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2920">#2920</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Eagerly import the ASGI app in the parent process (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2919">#2919</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Treat <code>fd=0</code> as a valid file descriptor with
reload/workers (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2927">#2927</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/uvicorn/commit/479a2c0c89186714f1aac52aecdebebf271395ac"><code>479a2c0</code></a>
Version 0.47.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2937">#2937</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/89347fd166ebedf98fb3f806ce8ea44e93b1c2b5"><code>89347fd</code></a>
Add 7-day cooldown for dependency resolution via uv exclude-newer (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2936">#2936</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/767315b38ae509cee9fe8ee9d09f6da920536096"><code>767315b</code></a>
Drop unused contents/actions permissions from zizmor workflow (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2935">#2935</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/f25ee43e68a9678453cbca99ad96f1a447ff34af"><code>f25ee43</code></a>
chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2933">#2933</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/8782666189a3d36c978de5698620db705659bf44"><code>8782666</code></a>
Fix typo in <code>docs/deployment/index.md</code>. (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2932">#2932</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/ad5ff87c869e8a34e9b04fcd5ca38d65c526893c"><code>ad5ff87</code></a>
Treat <code>fd=0</code> as a valid file descriptor with reload/workers
(<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2927">#2927</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/6761b2c8f9272fa0e908d0b9cdcb3cb0aa11382f"><code>6761b2c</code></a>
Remove Hugging Face sponsor block from docs (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2923">#2923</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/438f64834de00708a9bb3548a36090e7a924ad84"><code>438f648</code></a>
Surface sponsors on welcome page and sidebar (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2921">#2921</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/10ddc6dd296cb6e432a00835abe27f1c822373c1"><code>10ddc6d</code></a>
Add <code>ssl_context_factory</code> for custom <code>SSLContext</code>
configuration (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2920">#2920</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/b499bc45101d920e691e384025d728507215d4d1"><code>b499bc4</code></a>
Eagerly import the ASGI app in the parent process (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2919">#2919</a>)</li>
<li>See full diff in <a
href="https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uvicorn&package-manager=uv&previous-version=0.46.0&new-version=0.47.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 04:13:02 +00:00
dependabot[bot] 8c80246c97 Bump mypy from 2.0.0 to 2.1.0 in /backend (#1717) 
Bumps [mypy](https://github.com/python/mypy) from 2.0.0 to 2.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's
changelog</a>.</em></p>
<blockquote>
<h1>Mypy Release Notes</h1>
<h2>Next Release</h2>
<h2>Mypy 2.1</h2>
<p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a
href="https://pypi.org/project/mypy/">PyPI</a>).
Mypy is a static type checker for Python. This release includes new
features, performance
improvements and bug fixes. You can install it as follows:</p>
<pre><code>python3 -m pip install -U mypy
</code></pre>
<p>You can read the full documentation for this release on <a
href="http://mypy.readthedocs.io">Read the Docs</a>.</p>
<h3>librt.vecs: Fast Growable Array Type for Mypyc</h3>
<p>The new <code>librt.vecs</code> module provides an efficient growable
array type <code>vec</code> that is
optimized for mypyc use. It provides fast, packed arrays with integer
and floating point
value types, which can be <strong>several times faster</strong> than
<code>list</code>, and tens of times faster
than <code>array.array</code> in code compiled using mypyc. It also
supports nested <code>vec</code> objects and
non-value-type items, such as <code>vec[vec[str]]</code>.</p>
<p>Refer to the <a
href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a>
for
the details.</p>
<p>Contributed by Jukka Lehtosalo.</p>
<h3>librt.random: Fast Pseudo-Random Number Generation</h3>
<p>The new <code>librt.random</code> module provides fast pseudo-random
number generation that is
optimized for code compiled using mypyc. It can be 3x to 10x faster than
the stdlib
<code>random</code> module in compiled code.</p>
<p>Refer to the <a
href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a>
for
the details.</p>
<p>Contributed by Jukka Lehtosalo (PR <a
href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p>
<h3>Mypyc Improvements</h3>
<ul>
<li>Enable incremental self-compilation (Vaggelis Danias, PR <a
href="https://redirect.github.com/python/mypy/pull/21369">21369</a>)</li>
<li>Make compilation order with multiple files consistent (Piotr
Sawicki, PR <a
href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li>
<li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr
Sawicki, PR <a
href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li>
<li>Fix incremental compilation with <code>separate</code> flag
(Vaggelis Danias, PR <a
href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li>
</ul>
<h3>Fixes to Crashes</h3>
<ul>
<li>Fix crash on partial type with <code>--allow-redefinition</code> and
<code>global</code> declaration (Jukka Lehtosalo, PR <a
href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li>
<li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a
href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/mypy/commit/c1c336d7e34eb313080c79b156518c58d27c7234"><code>c1c336d</code></a>
Remove +dev from version</li>
<li><a
href="https://github.com/python/mypy/commit/74df14b7cbf08140236aa45bbb7f42219b0b1df7"><code>74df14b</code></a>
Add changelog for mypy 2.1 (<a
href="https://redirect.github.com/python/mypy/issues/21464">#21464</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/022d9bc96f86c40f338a5cf150f1806cc8f300ff"><code>022d9bc</code></a>
Revert &quot;TypeForm: Enable by default (<a
href="https://redirect.github.com/python/mypy/issues/21262">#21262</a>)&quot;</li>
<li><a
href="https://github.com/python/mypy/commit/8826288214f1cb31496e610667481221e025359c"><code>8826288</code></a>
[mypyc] Document librt.random (<a
href="https://redirect.github.com/python/mypy/issues/21463">#21463</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/3f4067b699dbe52d08e42ef3b3ebfdebdc06bd96"><code>3f4067b</code></a>
Bump librt version to 0.11.0 (<a
href="https://redirect.github.com/python/mypy/issues/21458">#21458</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/2b1eb58a250c5f1eb4ef5fb1f312ff528c5a1d4e"><code>2b1eb58</code></a>
[mypyc] Enable incremental self-compilation (<a
href="https://redirect.github.com/python/mypy/issues/21369">#21369</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/8152f4af3f6c03beaf2660026240f0fdce7feecc"><code>8152f4a</code></a>
Respect file config comments for stale modules (<a
href="https://redirect.github.com/python/mypy/issues/21444">#21444</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/116d60bdd3fdfe8d97c6afe99370910db56f1b92"><code>116d60b</code></a>
Fix nondeterminism from nonassociativity of overload joins (<a
href="https://redirect.github.com/python/mypy/issues/21455">#21455</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/6c4af8e42110cea3f84bc02add2ca7b89c268210"><code>6c4af8e</code></a>
Fix function call message change for small number of args (<a
href="https://redirect.github.com/python/mypy/issues/21432">#21432</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/4b8fdcaf24032592510e8f15421fb32d82a71800"><code>4b8fdca</code></a>
[mypyc] Add librt.random module (<a
href="https://redirect.github.com/python/mypy/issues/21433">#21433</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/python/mypy/compare/v2.0.0...v2.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=uv&previous-version=2.0.0&new-version=2.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 04:13:00 +00:00
dependabot[bot] 284d2eceb6 Bump pyrefly from 0.64.1 to 1.0.0 in /backend (#1716) 
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.64.1 to
1.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/pyrefly/releases">pyrefly's
releases</a>.</em></p>
<blockquote>
<h2>Pyrefly v1.0.0</h2>
<p><strong>Status: STABLE</strong>
<em>Release date: 12 May 2026</em></p>
<h2>Pyrefly v1.0.0 is here!</h2>
<p>We're thrilled to announce that Pyrefly has reached its stable 1.0.0
release! Since our <a
href="https://github.com/facebook/pyrefly/releases/tag/0.42.0">beta
release</a> in November 2025, we've fixed hundreds of bugs, improved
performance, and added lots of new functionality. Pyrefly is already the
default type checker for Instagram at Meta and has been adopted by other
large production codebases like PyTorch and JAX. Today, we're making it
official: Pyrefly is production ready.</p>
<p>This would not have been possible without our amazing open-source
community. To everyone who filed GitHub issues, submitted pull requests,
gave us feedback at conferences, or joined us on Discord: thank you.
Your contributions shaped this release.</p>
<p>These release notes cover the major highlights since our beta
release. For the full history, see our <a
href="https://github.com/facebook/pyrefly/releases">past weekly release
notes</a>.</p>
<hr />
<h2>Performance Improvements</h2>
<p>We've continued to push Pyrefly's performance since the <a
href="https://pyrefly.org/blog/2026/02/06/performance-improvements/">speed
improvements we shared in February</a>. Since beta:</p>
<ul>
<li><strong>2–125x faster updated diagnostics</strong> after saving a
file (no, that’s not a typo!). Thanks to fine-grained dependency
tracking and streaming diagnostics, updates now consistently arrive in
milliseconds</li>
<li><strong>20–36% faster full type checking</strong> on large projects
like PyTorch and Pandas</li>
<li><strong>2–3x faster initial indexing</strong> when Pyrefly first
scans your project</li>
<li><strong>40–60% less memory usage</strong> during both indexing and
incremental type checking</li>
</ul>
<p>(Tested on an M4 Macbook Pro using open-source benchmarks from <a
href="https://github.com/lolpack/type_coverage_py">type_coverage_py</a>
and <a
href="https://github.com/astral-sh/ruff/tree/e990dfd069fceef96f797b46161ef78862608449/scripts/ty_benchmark">ty_benchmark</a>.)</p>
<p>Compare the performance of Pyrefly and other Python type checkers on
our regularly updated <a
href="https://python-type-checking.com/typecheck_benchmark/">benchmarking
suite</a>, which runs against 53 popular Python packages.</p>
<hr />
<h2>Configuration Presets</h2>
<p>A new <code>preset</code> configuration option provides named bundles
of error severities and behavior settings.</p>
<table>
<thead>
<tr>
<th align="left">Preset</th>
<th align="left">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left"><code>off</code></td>
<td align="left">Silences all diagnostics. Useful for IDE-only users or
if you want total control of which errors are enabled.</td>
</tr>
<tr>
<td align="left"><code>basic</code></td>
<td align="left">Low-noise, high-confidence diagnostics only (syntax
errors, missing imports, unknown names, etc.). Ideal for unconfigured
projects or IDE-first users.</td>
</tr>
<tr>
<td align="left"><code>legacy</code></td>
<td align="left">For codebases migrating from mypy. Disables checks mypy
doesn't have. <code>pyrefly init</code> now emits this preset
automatically when migrating from a mypy config.</td>
</tr>
<tr>
<td align="left"><code>default</code></td>
<td align="left">The standard Pyrefly experience. Equivalent to having
no preset.</td>
</tr>
<tr>
<td align="left"><code>strict</code></td>
<td align="left">Enables additional strict checks on top of the
<code>default</code> preset. For users who want to avoid
<code>Any</code> types in their codebase.</td>
</tr>
</tbody>
</table>
<p>See the <a
href="https://pyrefly.org/en/docs/configuration/#preset">configuration
docs</a> for details.</p>
<hr />
<h2>Onboarding Experience</h2>
<p>We’ve made improvements to the out-of-the-box experience for projects
without a <code>pyrefly.toml</code>.</p>
<ul>
<li><strong>Automatic config synthesis</strong> — if you have a mypy or
pyright config, Pyrefly automatically migrates your settings and
synthesizes an appropriate in-memory Pyrefly config. (This is the same
migration that <code>pyrefly init</code> would commit to disk.)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/pyrefly/commit/2362c071caa576f9112781b5571f9e283cd52920"><code>2362c07</code></a>
Bump to version 1.0.0 with release notes</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/471bb8316cf40e9d29cbc79d5c701a7dec3ab6b5"><code>471bb83</code></a>
Prep README.md and pyproject.toml for V1</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/f2c6df4c66c726af4c7603272da47b65d91d4d4c"><code>f2c6df4</code></a>
Use vanity URLs for unconfigured-config upsell</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/d5bf386fd24f8969506f2edd0e06c3896962dbce"><code>d5bf386</code></a>
Fix TSP extra IPC connection shutdown hang (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3287">#3287</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/e0a91be41640e70e0cd45a57eae98eecf86459a4"><code>e0a91be</code></a>
do not send snapshotchanged to extra connections</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/3df562c8165ea2ac69b389eb1552f9dbf5c18573"><code>3df562c</code></a>
extract TypeErrorDisplayStatus into its own module</li>
<li>See full diff in <a
href="https://github.com/facebook/pyrefly/compare/0.64.1...1.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyrefly&package-manager=uv&previous-version=0.64.1&new-version=1.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 04:12:41 +00:00
dependabot[bot] 0de812c8b9 Bump sentry-sdk from 2.59.0 to 2.60.0 in /backend (#1715) 
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from
2.59.0 to 2.60.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's
releases</a>.</em></p>
<blockquote>
<h2>2.60.0</h2>
<p>Adds a new <code>stream_gen_ai_spans</code> option that controls how
<code>gen_ai</code> spans are
sent to Sentry. When set, the SDK extracts all <code>gen_ai</code> spans
out of a
transaction and sends them as v2 envelope items.</p>
<p>Enable this option if <code>gen_ai</code> spans are being dropped
because the transaction payload exceeds size limits.</p>
<pre lang="python"><code>import sentry_sdk
<p>sentry_sdk.init(<br />
dsn='https://<a
href="mailto:examplePublicKey@o0.ingest.sentry.io">examplePublicKey@o0.ingest.sentry.io</a>/0',<br
/>
stream_gen_ai_spans=True,<br />
)<br />
</code></pre></p>
<h3>New Features ✨</h3>
<ul>
<li>(asyncpg) Add cursor span support via BaseCursor method patching by
<a href="https://github.com/ericapisani"><code>@​ericapisani</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6252">#6252</a></li>
<li>(integrations) Pass along the conversation ID for openai
<code>responses</code> calls by <a
href="https://github.com/constantinius"><code>@​constantinius</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6199">#6199</a></li>
<li>(wsgi,asgi) Introduce substitute values for filtered fields in
span-streaming mode by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6178">#6178</a></li>
<li>Remove truncation when <code>stream_gen_ai_spans</code> is enabled
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6260">#6260</a></li>
<li>Add option to send GenAI spans in the new span format by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6079">#6079</a></li>
</ul>
<h3>Bug Fixes 🐛</h3>
<h4>Openai</h4>
<ul>
<li>Guard against <code>choices=None</code> by <a
href="https://github.com/cla7aye15I4nd"><code>@​cla7aye15I4nd</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6216">#6216</a></li>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6192">#6192</a></li>
<li>Only finish relevant spans in Responses patches by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6191">#6191</a></li>
<li>Only finish relevant spans in Chat Completions patches by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6190">#6190</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(stdlib) Instrument response body read for chunked HTTP responses by
<a href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6202">#6202</a></li>
<li>(typing) Add <code>@sentry_sdk.traces.trace</code> overloads to fix
typing by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6236">#6236</a></li>
<li>Use proto version 2 to fix backfilled user agent and IP by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6256">#6256</a></li>
<li>Make sure <code>http.server</code> spans are segments by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6230">#6230</a></li>
<li>Handle mypy 2.0 related failures by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6218">#6218</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<h4>Django</h4>
<ul>
<li>Check transaction annotations on transaction events by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6251">#6251</a></li>
<li>Reload middleware on test teardown by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6249">#6249</a></li>
</ul>
<h4>Openai</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>2.60.0</h2>
<p>Adds a new <code>stream_gen_ai_spans</code> option that controls how
<code>gen_ai</code> spans are
sent to Sentry. When set, the SDK extracts all <code>gen_ai</code> spans
out of a
transaction and sends them as v2 envelope items.</p>
<p>Enable this option if <code>gen_ai</code> spans are being dropped
because the transaction payload exceeds size limits.</p>
<pre lang="python"><code>import sentry_sdk
<p>sentry_sdk.init(<br />
dsn='https://<a
href="mailto:examplePublicKey@o0.ingest.sentry.io">examplePublicKey@o0.ingest.sentry.io</a>/0',<br
/>
stream_gen_ai_spans=True,<br />
)<br />
</code></pre></p>
<h3>New Features ✨</h3>
<ul>
<li>(asyncpg) Add cursor span support via BaseCursor method patching by
<a href="https://github.com/ericapisani"><code>@​ericapisani</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6252">#6252</a></li>
<li>(integrations) Pass along the conversation ID for openai
<code>responses</code> calls by <a
href="https://github.com/constantinius"><code>@​constantinius</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6199">#6199</a></li>
<li>(wsgi,asgi) Introduce substitute values for filtered fields in
span-streaming mode by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6178">#6178</a></li>
<li>Remove truncation when <code>stream_gen_ai_spans</code> is enabled
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6260">#6260</a></li>
<li>Add option to send GenAI spans in the new span format by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6079">#6079</a></li>
</ul>
<h3>Bug Fixes 🐛</h3>
<h4>Openai</h4>
<ul>
<li>Guard against <code>choices=None</code> by <a
href="https://github.com/cla7aye15I4nd"><code>@​cla7aye15I4nd</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6216">#6216</a></li>
<li>Stop setting transaction status when child span fails by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6192">#6192</a></li>
<li>Only finish relevant spans in Responses patches by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6191">#6191</a></li>
<li>Only finish relevant spans in Chat Completions patches by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6190">#6190</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(stdlib) Instrument response body read for chunked HTTP responses by
<a href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6202">#6202</a></li>
<li>(typing) Add <code>@sentry_sdk.traces.trace</code> overloads to fix
typing by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6236">#6236</a></li>
<li>Use proto version 2 to fix backfilled user agent and IP by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6256">#6256</a></li>
<li>Make sure <code>http.server</code> spans are segments by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6230">#6230</a></li>
<li>Handle mypy 2.0 related failures by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6218">#6218</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<h4>Django</h4>
<ul>
<li>Check transaction annotations on transaction events by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6251">#6251</a></li>
<li>Reload middleware on test teardown by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6249">#6249</a></li>
</ul>
<h4>Openai</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-python/commit/e30caaa97793fd37b782d8c48b7727a43428fafd"><code>e30caaa</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/d31ac85a92def5d6f2395fe2bfa8a9133c581323"><code>d31ac85</code></a>
release: 2.60.0</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/fcb93051c5b85f28ee6dc623dd67736d430ef432"><code>fcb9305</code></a>
feat: Remove truncation when <code>stream_gen_ai_spans</code> is enabled
(<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6260">#6260</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/253a4d42b13bb5b54cb3b623a32d9fc99639b226"><code>253a4d4</code></a>
feat: Add option to send GenAI spans in the new span format (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6079">#6079</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/619d803d82f7bbf2a15a80432334c863e4c206eb"><code>619d803</code></a>
test(langchain): Inline global state (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6261">#6261</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/f92c8036a8ed166ab3be8a48f6344fd98d1761dd"><code>f92c803</code></a>
Revert &quot;fix: Work around compromised transitive dependency (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6257">#6257</a>)&quot;
(<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6262">#6262</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/7a303dcbf0e4bc6aa701446d79e847d56db26137"><code>7a303dc</code></a>
Add option to drop scrubbed user IP addresses (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6241">#6241</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/edaa6d6d142e430e1dd0a1097e0b77506cf159e9"><code>edaa6d6</code></a>
feat(pymongo): Add span streaming support (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6253">#6253</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/0e47eadedea808a4ca7865a480552872208be890"><code>0e47ead</code></a>
feat(asyncpg): Add cursor span support via BaseCursor method patching
(<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6252">#6252</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/17cc8c7b2c31c2df130418bb49137814d4d35f7b"><code>17cc8c7</code></a>
fix: Use proto version 2 to fix backfilled user agent and IP (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6256">#6256</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-python/compare/2.59.0...2.60.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sentry-sdk&package-manager=uv&previous-version=2.59.0&new-version=2.60.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 04:12:38 +00:00
dependabot[bot] d9c06d0d5d Bump click from 8.3.0 to 8.4.0 in /backend (#1714) 
Bumps [click](https://github.com/pallets/click) from 8.3.0 to 8.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/click/releases">click's
releases</a>.</em></p>
<blockquote>
<h2>8.4.0</h2>
<p>This is the Click 8.4.0 feature release. A feature release may
include new features, remove previously deprecated code, add new
deprecation, or introduce potentially breaking changes.</p>
<p>We encourage everyone to upgrade. You can read more about our <a
href="https://palletsprojects.com/versions">Version Support Policy</a>
on our website.</p>
<p>PyPI: <a
href="https://pypi.org/project/click/8.4.0/">https://pypi.org/project/click/8.4.0/</a>
Changes: <a
href="https://click.palletsprojects.com/page/changes/#version-8-4-0">https://click.palletsprojects.com/page/changes/#version-8-4-0</a>
Milestone <a
href="https://github.com/pallets/click/milestone/30">https://github.com/pallets/click/milestone/30</a></p>
<ul>
<li>
<p><code>ParamType</code> typing improvements. <a
href="https://redirect.github.com/pallets/click/issues/3371">#3371</a></p>
<ul>
<li>:class:<code>ParamType</code> is now a generic abstract base class,
parameterized by its converted value type.</li>
<li>:meth:<code>~ParamType.convert</code> return types are narrowed on
all
concrete types (<code>str</code> for :class:<code>STRING</code>,
<code>int</code> for
:class:<code>INT</code>, etc.).</li>
<li>:meth:<code>~ParamType.to_info_dict</code> returns specific
:class:<code>~typing.TypedDict</code> subclasses instead of
<code>dict[str, Any]</code>.</li>
<li>:class:<code>CompositeParamType</code> and the number-range base are
now
generic with abstract methods.</li>
</ul>
</li>
<li>
<p>Refactor <code>convert_type</code> to extract type inference into a
private
<code>_guess_type</code> helper, and add
:func:<code>typing.overload</code> signatures.
<a
href="https://redirect.github.com/pallets/click/issues/3372">#3372</a></p>
</li>
<li>
<p><code>Parameter</code> typing improvements. <a
href="https://redirect.github.com/pallets/click/issues/2805">#2805</a></p>
<ul>
<li>:class:<code>Parameter</code> is now an abstract base class, making
explicit
that it cannot be instantiated directly.</li>
<li>:attr:<code>Parameter.name</code> is now <code>str</code> instead of
<code>str | None</code>.
When <code>expose_value=False</code>, the name is set to
<code>&quot;&quot;</code> instead
of <code>None</code>.</li>
<li>The <code>ctx</code> parameter of
:meth:<code>Parameter.get_error_hint</code> is now
typed as <code>Context | None</code>, matching the runtime
behavior.</li>
</ul>
</li>
<li>
<p>Split string values from <code>default_map</code> for parameters with
<code>nargs &gt; 1</code>
or :class:<code>Tuple</code> type, matching environment variable
behavior.
<a
href="https://redirect.github.com/pallets/click/issues/2745">#2745</a>
<a
href="https://redirect.github.com/pallets/click/issues/3364">#3364</a></p>
</li>
<li>
<p>Auto-detect <code>type=UNPROCESSED</code> for <code>flag_value</code>
of non-basic types
(not <code>str</code>, <code>int</code>, <code>float</code>, or
<code>bool</code>), so programmer-provided
Python objects like classes and enum members are passed through
unchanged
instead of being stringified. Previously
<code>type=click.UNPROCESSED</code> had
to be set explicitly. <a
href="https://redirect.github.com/pallets/click/issues/2012">#2012</a>
<a
href="https://redirect.github.com/pallets/click/issues/3363">#3363</a></p>
</li>
<li>
<p>The error hint now uses <code>Command.get_help_option_names</code> to
pick
non-shadowed help option names, so <code>Try '... -h'</code> no longer
points to a
subcommand option that shadows <code>-h</code>. All surviving names are
shown
(<code>-h/--help</code>). <a
href="https://redirect.github.com/pallets/click/issues/2790">#2790</a>
<a
href="https://redirect.github.com/pallets/click/issues/3208">#3208</a></p>
</li>
<li>
<p>Fix readline functionality on non-Windows platforms. Prompt text is
now
passed directly to readline instead of being printed separately,
allowing
proper backspace, line editing, and line wrapping behavior. <a
href="https://redirect.github.com/pallets/click/issues/2968">#2968</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/click/blob/main/CHANGES.md">click's
changelog</a>.</em></p>
<blockquote>
<h2>Version 8.4.0</h2>
<p>Released 2026-05-17</p>
<ul>
<li>
<p>{class}<code>ParamType</code> typing improvements.
{pr}<code>3371</code></p>
<ul>
<li>{class}<code>ParamType</code> is now a generic abstract base class,
parameterized by its converted value type.</li>
<li>{meth}<code>~ParamType.convert</code> return types are narrowed on
all
concrete types (<code>str</code> for {class}<code>STRING</code>,
<code>int</code> for
{class}<code>INT</code>, etc.).</li>
<li>{meth}<code>~ParamType.to_info_dict</code> returns specific
{class}<code>~typing.TypedDict</code> subclasses instead of
<code>dict[str, Any]</code>.</li>
<li>{class}<code>CompositeParamType</code> and the number-range base are
now
generic with abstract methods.</li>
</ul>
</li>
<li>
<p>Refactor <code>convert_type</code> to extract type inference into a
private
<code>_guess_type</code> helper, and add
{func}<code>typing.overload</code> signatures.
{pr}<code>3372</code></p>
</li>
<li>
<p>{class}<code>Parameter</code> typing improvements.
{pr}<code>2805</code></p>
<ul>
<li>{class}<code>Parameter</code> is now an abstract base class, making
explicit
that it cannot be instantiated directly.</li>
<li>{attr}<code>Parameter.name</code> is now <code>str</code> instead of
<code>str | None</code>.
When <code>expose_value=False</code>, the name is set to
<code>&quot;&quot;</code> instead
of <code>None</code>.</li>
<li>The <code>ctx</code> parameter of
{meth}<code>Parameter.get_error_hint</code> is now
typed as <code>Context | None</code>, matching the runtime
behavior.</li>
</ul>
</li>
<li>
<p>Split string values from <code>default_map</code> for parameters with
<code>nargs &gt; 1</code>
or {class}<code>Tuple</code> type, matching environment variable
behavior.
{issue}<code>2745</code> {pr}<code>3364</code></p>
</li>
<li>
<p>Auto-detect <code>type=UNPROCESSED</code> for <code>flag_value</code>
of non-basic types
(not <code>str</code>, <code>int</code>, <code>float</code>, or
<code>bool</code>), so programmer-provided
Python objects like classes and enum members are passed through
unchanged
instead of being stringified. Previously
<code>type=click.UNPROCESSED</code> had
to be set explicitly. {issue}<code>2012</code> {pr}<code>3363</code></p>
</li>
<li>
<p>The error hint now uses
{meth}<code>Command.get_help_option_names</code> to pick
non-shadowed help option names, so <code>Try '... -h'</code> no longer
points to a
subcommand option that shadows <code>-h</code>. The longest surviving
name is
shown (<code>--help</code> over <code>-h</code>) for readability.
{issue}<code>2790</code> {pr}<code>3208</code></p>
</li>
<li>
<p>Fix readline functionality on non-Windows platforms. Prompt text is
now
passed directly to readline instead of being printed separately,
allowing
proper backspace, line editing, and line wrapping behavior.
{issue}<code>2968</code>
{pr}<code>2969</code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pallets/click/commit/41f410fb7528305d7e87c8cfa704f6c2456f57fc"><code>41f410f</code></a>
Release 8.4.0</li>
<li><a
href="https://github.com/pallets/click/commit/e3e69e3bf8d749ac1a632f2ece4d38ec7f6588f5"><code>e3e69e3</code></a>
Add type annotations for instance attributes in <code>utils</code> (<a
href="https://redirect.github.com/pallets/click/issues/3422">#3422</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/3bb230dcd5d751f8605b46e9df5a541639d5fd4e"><code>3bb230d</code></a>
WIP: Fix <code>HelpFormatter.write_usage</code> producing spurious
characters (<a
href="https://redirect.github.com/pallets/click/issues/3434">#3434</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/63274a79d08fdc5c19220696144489f7144a8547"><code>63274a7</code></a>
<code>click.get_pager_file</code>: add tests (<a
href="https://redirect.github.com/pallets/click/issues/1572">#1572</a>
followup) (<a
href="https://redirect.github.com/pallets/click/issues/3405">#3405</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/0551bf53588ae87f462d336f24f853a156fefe3a"><code>0551bf5</code></a>
Fix <code>HelpFormatter.write_usage</code> producing spurious
characters</li>
<li><a
href="https://github.com/pallets/click/commit/fc41aa1d0b62494eb93e92ff3929601221e3abf4"><code>fc41aa1</code></a>
Apply class-body annotations to <code>KeepOpenFile</code> for
consistency</li>
<li><a
href="https://github.com/pallets/click/commit/b761eda3bad977ec2f485451d85fd8ec365f0bf4"><code>b761eda</code></a>
Skip some tests on Windows</li>
<li><a
href="https://github.com/pallets/click/commit/98302ac4f49e443a48abd3fbb95c86202b89547d"><code>98302ac</code></a>
Check <code>PAGER</code> usage, color preservation and edge-cases</li>
<li><a
href="https://github.com/pallets/click/commit/dbdae170879d460e78963f8af35c5cb9c5b86e89"><code>dbdae17</code></a>
Fix documentation</li>
<li><a
href="https://github.com/pallets/click/commit/1aa2d53d63ff68bf14b35931177aac9270e39713"><code>1aa2d53</code></a>
Redesigned tests and get_pager_file branching to be more clear and not
set color</li>
<li>Additional commits viewable in <a
href="https://github.com/pallets/click/compare/8.3.0...8.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=click&package-manager=uv&previous-version=8.3.0&new-version=8.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 04:12:13 +00:00
dependabot[bot] 3ccaafd6cd Bump pyjwt from 2.12.0 to 2.13.0 in /backend (#1712) 
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.12.0 to 2.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.13.0</h2>
<h1>PyJWT 2.13.0 — Security Release</h1>
<p>This release bundles five security fixes plus three additional
hardening / spec-compliance changes. We recommend all users upgrade.</p>
<h2>Security</h2>
<ul>
<li>
<p><strong><a
href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a>
— JWK JSON accepted as HMAC secret (algorithm confusion).</strong>
<code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and
SSH-formatted asymmetric keys but did not catch a JWK passed as a raw
JSON string. In a verifier configured with both symmetric and asymmetric
algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key,
an attacker could forge HS256 tokens using the JWK text as the HMAC
secret. The guard has been extended to reject any JWK-shaped JSON.
<em>Reported by <a
href="https://github.com/aradona91"><code>@​aradona91</code></a>.</em></p>
</li>
<li>
<p><strong><a
href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a>
— Algorithm allow-list bypass with <code>PyJWK</code> /
<code>PyJWKClient</code>.</strong> When verifying with a
<code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list
was checked against the token header <code>alg</code> as a string only;
actual verification used the algorithm bound to the <code>PyJWK</code>.
An attacker who controlled a registered JWKS key could sign with one
algorithm and advertise another on the header. PyJWT now requires the
token header <code>alg</code> to match the <code>PyJWK</code>'s
algorithm before verification. <em>Reported by <a
href="https://github.com/sushi-gif"><code>@​sushi-gif</code></a>.</em></p>
</li>
<li>
<p><strong><a
href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a>
— DoS via base64 decode of unused payload segment when
<code>b64=false</code>.</strong> For detached-payload JWS
(<code>b64=false</code>), the compact-form payload segment was
base64-decoded before being discarded in favor of the caller-supplied
<code>detached_payload</code>. An attacker could inflate the unused
segment to force CPU + memory cost without holding a valid signature.
The segment is now required to be empty per RFC 7515 Appendix F, and is
no longer decoded. <em>Reported by <a
href="https://github.com/thesmartshadow"><code>@​thesmartshadow</code></a>.</em></p>
</li>
<li>
<p><strong><a
href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a>
— <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong>
<code>PyJWKClient.fetch_data</code> passed its URI to
<code>urllib.request.urlopen</code>, which by default also handles
<code>file://</code>, <code>ftp://</code>, and <code>data:</code>
schemes. An application that fed an attacker-influenced URI into
<code>PyJWKClient</code> could be coerced into reading local files or
reaching other unintended schemes. <code>PyJWKClient</code> now rejects
any URI whose scheme isn't <code>http</code> or <code>https</code>.
<em>Reported by <a
href="https://github.com/KEIJOT"><code>@​KEIJOT</code></a>.</em></p>
</li>
<li>
<p><strong><a
href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a>
— <code>PyJWKClient</code> cache wiped on fetch error.</strong> A
<code>finally</code>-block <code>put(jwk_set=None)</code> cleared the
JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint
outage into application-wide auth failure. The cache write was moved
into the success path; transient errors no longer evict valid cached
keys. <em>Reported by <a
href="https://github.com/eddieran"><code>@​eddieran</code></a>.</em></p>
</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Reject empty HMAC keys outright in
<code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code>
instead of accepting them with only a warning. Defends against the
<code>os.getenv(&quot;JWT_SECRET&quot;, &quot;&quot;)</code> footgun.
<em>Thanks to <a
href="https://github.com/SnailSploit"><code>@​SnailSploit</code></a> and
<a href="https://github.com/spartan8806"><code>@​spartan8806</code></a>
for the reports.</em></li>
<li>Forward per-call <code>options</code> (including
<code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code>
through to <code>PyJWS._verify_signature</code>. The option was
previously silently dropped between the two layers, so it only took
effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a
href="https://github.com/WLUB"><code>@​WLUB</code></a> for the
report.</em></li>
<li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong>
the encoder now auto-adds <code>&quot;b64&quot;</code> to
<code>crit</code>, and the decoder rejects tokens that set
<code>b64=false</code> without listing it in <code>crit</code>.
<em>Thanks to <a
href="https://github.com/MachineLearning-Nerd"><code>@​MachineLearning-Nerd</code></a>
for the report.</em></li>
</ul>
<h2>Changed</h2>
<ul>
<li>Migrate the <code>dev</code>, <code>docs</code>, and
<code>tests</code> package extras to dependency groups, by <a
href="https://github.com/kurtmckee"><code>@​kurtmckee</code></a> in <a
href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li>
</ul>
<h2>Upgrade notes</h2>
<p>Most fixes are invisible to correctly-configured callers. A few
behavioral changes you may encounter:</p>
<ul>
<li><strong>Empty HMAC keys now raise.</strong> If your app passed
<code>&quot;&quot;</code> or <code>b&quot;&quot;</code> as a secret
(often via a missing env var, e.g.
<code>os.getenv(&quot;JWT_SECRET&quot;, &quot;&quot;)</code>),
<code>encode</code>/<code>decode</code> will now raise
<code>InvalidKeyError</code>. This is the intended behavior — fix the
configuration.</li>
<li><strong><code>PyJWK</code> decoding now requires the token's
<code>alg</code> to match the JWK's algorithm.</strong> Previously a
mismatch was silently honored if the header <code>alg</code> appeared in
the allow-list. Tokens that relied on this mismatch will now fail with
<code>InvalidAlgorithmError</code>.</li>
<li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at
construction time.</strong> Tests or dev environments that fetched JWKS
from <code>file://</code> URIs need to switch to a local HTTP server or
load the JWKS by other means (e.g. construct
<code>PyJWKSet.from_dict(...)</code> directly).</li>
<li><strong><code>b64=false</code> tokens are now strictly RFC 7515 /
7797 compliant.</strong> Tokens with a non-empty compact-form payload
segment, or that omit <code>&quot;b64&quot;</code> from
<code>crit</code>, will be rejected. PyJWT-produced tokens always
satisfy both invariants, so round-trips through PyJWT are
unaffected.</li>
<li><strong><code>enforce_minimum_key_length</code> set per-call now
takes effect.</strong> Callers who passed
<code>options={&quot;enforce_minimum_key_length&quot;: True}</code> to
<code>jwt.decode()</code> previously got no enforcement; they will now
get <code>InvalidKeyError</code> on undersized keys, as documented.</li>
</ul>
<p><strong>Full changelog:</strong> <a
href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p>
<h2>2.12.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Add typing_extensions dependency for Python &lt; 3.11 by <a
href="https://github.com/jpadilla"><code>@​jpadilla</code></a> in <a
href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.13.0
&lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0&gt;</code>__</h2>
<p>Security</p>
<pre><code>
- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
`GHSA-xgmm-8j9v-c9wx
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx&gt;`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
by @sushi-gif in `GHSA-jq35-7prp-9v3f
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f&gt;`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
influenced URIs cannot read local files or reach unintended schemes via
urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
by @KEIJOT in `GHSA-993g-76c3-p5m4
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4&gt;`__.
- Preserve the cached JWK Set on fetch errors in
``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
on any transient outage, turning one bad JWKS request into application-
wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8&gt;`__.
- Skip the unconditional base64 decode of the compact-form payload
segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
`GHSA-w7vc-732c-9m39
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39&gt;`__.
<p>Fixed</p>
<pre><code>
- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including
``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
``&amp;quot;b64&amp;quot;`` to the ``crit`` header parameter, and the
decoder rejects
tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed
</code></pre>
<ul>
<li>Migrate the <code>dev</code>, <code>docs</code>, and
<code>tests</code> package extras to dependency groups by <a
href="https://github.com/kurtmckee"><code>@​kurtmckee</code></a> in
<code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152)
&amp;lt;https://github.com/jpadilla/pyjwt/pull/1152&amp;gt;</code>__</li>
</ul>
<p><code>v2.12.1
&amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&amp;gt;</code>__
&lt;/tr&gt;&lt;/table&gt;
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a>
Apply ruff format</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a>
Restore <code>cast()</code> calls with cross-version <code>type:
ignore</code> for <code>prepare_key</code></li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a>
Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and
`ECAlgorithm.prepare...</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a>
Bundle security fixes and hardening into 2.13.0</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a>
Bump codecov/codecov-action from 5 to 6 (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a>
Migrate development extras to dependency groups (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30"><code>a4e1a3d</code></a>
Add typing_extensions dependency for Python &lt; 3.11 (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1151">#1151</a>)</li>
<li>See full diff in <a
href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.13.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyjwt&package-manager=uv&previous-version=2.12.0&new-version=2.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 03:16:52 +00:00
dependabot[bot] e0a455995f Bump mypy from 1.20.0 to 2.0.0 in /backend (#1709) 
Bumps [mypy](https://github.com/python/mypy) from 1.20.0 to 2.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's
changelog</a>.</em></p>
<blockquote>
<h1>Mypy Release Notes</h1>
<h2>Next Release</h2>
<h2>Mypy 2.1</h2>
<p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a
href="https://pypi.org/project/mypy/">PyPI</a>).
Mypy is a static type checker for Python. This release includes new
features, performance
improvements and bug fixes. You can install it as follows:</p>
<pre><code>python3 -m pip install -U mypy
</code></pre>
<p>You can read the full documentation for this release on <a
href="http://mypy.readthedocs.io">Read the Docs</a>.</p>
<h3>librt.vecs: Fast Growable Array Type for Mypyc</h3>
<p>The new <code>librt.vecs</code> module provides an efficient growable
array type <code>vec</code> that is
optimized for mypyc use. It provides fast, packed arrays with integer
and floating point
value types, which can be <strong>several times faster</strong> than
<code>list</code>, and tens of times faster
than <code>array.array</code> in code compiled using mypyc. It also
supports nested <code>vec</code> objects and
non-value-type items, such as <code>vec[vec[str]]</code>.</p>
<p>Refer to the <a
href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a>
for
the details.</p>
<p>Contributed by Jukka Lehtosalo.</p>
<h3>librt.random: Fast Pseudo-Random Number Generation</h3>
<p>The new <code>librt.random</code> module provides fast pseudo-random
number generation that is
optimized for code compiled using mypyc. It can be 3x to 10x faster than
the stdlib
<code>random</code> module in compiled code.</p>
<p>Refer to the <a
href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a>
for
the details.</p>
<p>Contributed by Jukka Lehtosalo (PR <a
href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p>
<h3>Mypyc Improvements</h3>
<ul>
<li>Enable incremental self-compilation (Vaggelis Danias, PR <a
href="https://redirect.github.com/python/mypy/pull/21369">21369</a>)</li>
<li>Make compilation order with multiple files consistent (Piotr
Sawicki, PR <a
href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li>
<li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr
Sawicki, PR <a
href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li>
<li>Fix incremental compilation with <code>separate</code> flag
(Vaggelis Danias, PR <a
href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li>
</ul>
<h3>Fixes to Crashes</h3>
<ul>
<li>Fix crash on partial type with <code>--allow-redefinition</code> and
<code>global</code> declaration (Jukka Lehtosalo, PR <a
href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li>
<li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a
href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/mypy/commit/7a765008a138ec46c579bfc6ef608860cab36033"><code>7a76500</code></a>
Remove +dev from version</li>
<li><a
href="https://github.com/python/mypy/commit/5a3ab3b29f03d8baafeced3761e1afc8bd58be79"><code>5a3ab3b</code></a>
Changelog for mypy 2.0 (<a
href="https://redirect.github.com/python/mypy/issues/21422">#21422</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/f9c86e21e88f96806c65790d604bf1264db39434"><code>f9c86e2</code></a>
Some changelog updates for 2.0 (<a
href="https://redirect.github.com/python/mypy/issues/21413">#21413</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/519eaf15e0ceafae30337083577a54c7d3f3b4fe"><code>519eaf1</code></a>
Bump librt to 0.10.0 (<a
href="https://redirect.github.com/python/mypy/issues/21415">#21415</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/158a6207d6e221cc403e1d556097b5abf5157cdd"><code>158a620</code></a>
Fix negative narrowing for containers (<a
href="https://redirect.github.com/python/mypy/issues/21411">#21411</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/e556eb93a3c551a320a536879ce0a1608d14d490"><code>e556eb9</code></a>
Try fixing mypy mypyc wheels (<a
href="https://redirect.github.com/python/mypy/issues/21392">#21392</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/f2c97971f5f4dcd749cf87df1e1308ab5754490a"><code>f2c9797</code></a>
Expose --num-workers and --native-parser (<a
href="https://redirect.github.com/python/mypy/issues/21387">#21387</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/db0cb2f7c68b0f9d43d6ee1ab68117c1550dac39"><code>db0cb2f</code></a>
Bump ast-serialize cache version (<a
href="https://redirect.github.com/python/mypy/issues/21388">#21388</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/1090ca6d476f629c566250a41204450043a47cf5"><code>1090ca6</code></a>
Bump ast-serialize version to 0.3.0 only (<a
href="https://redirect.github.com/python/mypy/issues/21391">#21391</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/714ca9f2ac76e7c6dd56e26fd555f69313ba47ab"><code>714ca9f</code></a>
[mypyc] Add note about librt.strings thread safety (<a
href="https://redirect.github.com/python/mypy/issues/21383">#21383</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/python/mypy/compare/v1.20.0...v2.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=uv&previous-version=1.20.0&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-09 04:12:38 +00:00
dependabot[bot] 4f1dc6ae80 Bump pyrefly from 0.63.1 to 0.64.1 in /backend (#1710) 
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.63.1 to
0.64.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/pyrefly/releases">pyrefly's
releases</a>.</em></p>
<blockquote>
<h2>Pyrefly v0.64.1</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/facebook/pyrefly/compare/0.64.0...0.64.1">https://github.com/facebook/pyrefly/compare/0.64.0...0.64.1</a></p>
<h2>Pyrefly v0.64.0</h2>
<p><strong>Status : BETA</strong>
<em>Release date: May 05, 2026</em></p>
<p>Pyrefly v0.64.0 bundles <strong>190 commits</strong> from <strong>20
contributors</strong>.</p>
<hr />
<h2>✨ New &amp; Improved</h2>
<table>
<thead>
<tr>
<th>Area</th>
<th>What's new</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Type Checking</strong></td>
<td>- You can now pass generic or overloaded callables to higher-order
functions and Pyrefly will preserve their structure in the return type.
For example, <code>identity(identity)</code> now correctly returns a
generic callable instead of degrading to <code>Unknown</code>. <!-- raw
HTML omitted --><!-- raw HTML omitted -->- Same-scope class rebinds
(like <code>Real = Dummy</code> after <code>class Real</code>) are now
checked against the original class as if it were an implicit
<code>type[Real]</code> annotation, preventing silent type changes and
fixing spurious constructor-call errors. <!-- raw HTML omitted --><!--
raw HTML omitted -->- Generic classes with missing type arguments in lax
mode now default to <code>Any</code> instead of raising variance errors,
improving consistency with how we handle other incomplete types. <!--
raw HTML omitted --><!-- raw HTML omitted -->- Pydantic
<code>field_validator</code> decorators with <code>mode='before'</code>
and <code>mode='plain'</code> are now supported, allowing validators to
accept broader input types before coercion. <!-- raw HTML omitted
--><!-- raw HTML omitted -->- Spurious unpack diagnostics are no longer
emitted when the right-hand side involves <code>Never</code> (e.g.
<code>a, b, c = never()</code> or <code>a, b = (never(), 1)</code>). The
unpack solver is now <code>Never</code>-aware, recognizing that the
producing expression cannot complete and any error message at the unpack
site would be misleading. <!-- raw HTML omitted --><!-- raw HTML omitted
-->- <code>assert</code> statements now check that <code>__bool__</code>
is callable on the test expression, matching the behavior already in
place for <code>if</code>, <code>while</code>, and ternary expressions
(and aligning with mypy and pyright).</td>
</tr>
<tr>
<td><strong>Language Server</strong></td>
<td>- The language server now advertises both <code>source.fixAll</code>
and <code>source.fixAll.pyrefly</code> code action kinds, enabling
selective fix-on-save configuration across editors that implement the
LSP protocol. <!-- raw HTML omitted --><!-- raw HTML omitted -->-
Document highlights now correctly distinguish between read and write
references, setting <code>DocumentHighlightKind::WRITE</code> for
assignments and declarations. <!-- raw HTML omitted --><!-- raw HTML
omitted -->- Go-to-definition on relative imports in site-packages files
now correctly resolves to the package source instead of returning null
when a <code>pyproject.toml</code> exists at the project root. <!-- raw
HTML omitted --><!-- raw HTML omitted -->- Notebook cell index
resolution has been fixed to prevent mismatches between code cells and
markdown cells, eliminating panics and incorrect byte offset
calculations in Jupyter notebooks. <!-- raw HTML omitted --><!-- raw
HTML omitted -->- Cross-module &quot;find references&quot; (external
references) is now enabled by default, returning references across the
entire project rather than just the current file. <!-- raw HTML omitted
--><!-- raw HTML omitted -->- A new quick fix turns the existing
&quot;Did you mean <code>Foo.BAR</code>?&quot; diagnostic note for
missing enum members into a code action that replaces the offending
string literal with the proper enum member access. <!-- raw HTML omitted
--><!-- raw HTML omitted -->- A new <code># pyrefly: ignore</code> quick
fix inserts a suppression comment for the diagnostic at the cursor,
automatically merging into an existing pyrefly-ignore directive on the
same line or on a comment-only line above when present. <!-- raw HTML
omitted --><!-- raw HTML omitted -->- Numeric parameter defaults now
preserve their source spelling (e.g. <code>0o777</code>,
<code>0xFF</code>, <code>0b101</code>) in hover and signature display
rather than being normalized to decimal. <!-- raw HTML omitted --><!--
raw HTML omitted -->- Code actions documentation has been added to the
IDE Supported Features page, covering quick fixes and
<code>source.fixAll.pyrefly</code> configuration.</td>
</tr>
<tr>
<td><strong>Onboarding &amp; VS Code Extension</strong></td>
<td>- A redesigned unconfigured-project experience: when no
<code>pyrefly.toml</code> is found, Pyrefly auto-detects nearby
<code>mypy.ini</code>, <code>pyrightconfig.json</code>, or
<code>[tool.mypy]</code>/<code>[tool.pyright]</code> sections in
<code>pyproject.toml</code> and synthesizes an in-memory configuration
migrated from those settings (using the <code>legacy</code> or
<code>default</code> preset respectively). With no detectable
configuration, the new <code>basic</code> preset is used. <!-- raw HTML
omitted --><!-- raw HTML omitted -->- A new
<code>python.pyrefly.typeCheckingMode</code> workspace setting (auto /
off / basic / legacy / default / strict, default <code>auto</code>) lets
users pick a preset for files not covered by an explicit Pyrefly
configuration, directly from the VS Code settings UI. The legacy
<code>python.pyrefly.displayTypeErrors</code> setting is now deprecated,
with values transparently mapped to the new model. <!-- raw HTML omitted
--><!-- raw HTML omitted -->- A new
<code>python.pyrefly.disableTypeErrors</code> workspace setting provides
a clean per-workspace kill switch for diagnostics, independent of the
type-checking mode. <!-- raw HTML omitted --><!-- raw HTML omitted -->-
The VS Code status bar has been redesigned: it now shows the active
preset (e.g. &quot;Pyrefly (Legacy)&quot;, &quot;Pyrefly (Basic)&quot;)
and the tooltip explains why that preset was chosen and links to the
relevant docs. <!-- raw HTML omitted --><!-- raw HTML omitted -->- After
a <code>pyrefly check</code> on an unconfigured project, the CLI now
prints a short upsell to <strong>stderr</strong> explaining what
configuration was synthesized and pointing at <code>pyrefly init</code>.
The message is routed to stderr so machine-readable stdout formats (e.g.
<code>--output-format json</code>) remain untouched.</td>
</tr>
<tr>
<td><strong>Configuration</strong></td>
<td>- Configuration presets (<code>off</code>, <code>basic</code>,
<code>legacy</code>, <code>default</code>, <code>strict</code>) are now
available via the <code>preset</code> option, providing named
collections of error severities and behavior settings as a base
configuration that user settings can override. <!-- raw HTML omitted
--><!-- raw HTML omitted -->- The <code>legacy</code> preset is now used
by <code>pyrefly init</code> for mypy migration, disabling checks mypy
doesn't have and setting looser inference defaults. <!-- raw HTML
omitted --><!-- raw HTML omitted -->- The <code>implicit-any</code>
error code has been split into sub-kinds
(<code>implicit-any-attribute</code>,
<code>implicit-any-empty-container</code>,
<code>implicit-any-parameter</code>,
<code>implicit-any-type-argument</code>) with <code>implicit-any</code>
as the parent, allowing finer-grained control over where implicit
<code>Any</code> is flagged. <!-- raw HTML omitted --><!-- raw HTML
omitted -->- The <code>unbound-name</code> error is now disabled in the
<code>legacy</code> preset to match mypy's default behavior, which does
not flag possibly-undefined variables.</td>
</tr>
<tr>
<td><strong>Error Reporting</strong></td>
<td>- A new <code>incompatible-overload-residual</code> error kind has
been introduced for cases where all branches of an overloaded callable
are pruned during higher-order function analysis, making it easier to
configure these errors independently. <!-- raw HTML omitted --><!-- raw
HTML omitted -->- Error messages for all-pruned overload residuals now
describe the incompatibility in terms of &quot;solved type
variables&quot; rather than &quot;solved type constraints&quot; for
better clarity. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The
<code>pyrefly suppress</code> command now correctly handles removal of
unused ignores via the <code>--remove-unused</code> flag, which was
previously broken.</td>
</tr>
<tr>
<td><strong>Factory Boy Support</strong></td>
<td>- Pyrefly now infers the correct model return types for
<code>create()</code>, <code>build()</code>,
<code>create_batch()</code>, and <code>build_batch()</code> methods on
<code>DjangoModelFactory</code> subclasses by reading the inner
<code>Meta.model</code> attribute. <!-- raw HTML omitted --><!-- raw
HTML omitted -->- False-positive <code>bad-override</code> errors on the
inner <code>Meta</code> class in factory-boy factories are now
suppressed, matching how we handle Django and Marshmallow.</td>
</tr>
<tr>
<td><strong>Reporting</strong></td>
<td>- The <code>pyrefly report</code> JSON output now includes a
<code>path</code> field on each <code>ModuleReport</code>, for
compatibility with typestats and similar tooling.</td>
</tr>
<tr>
<td><strong>Performance</strong></td>
<td>- Deeply-nested dict literals no longer cause exponential memory
growth during type inference. A depth-25 dict literal that previously
consumed ~7.7 GB now uses ~239 MB by computing the union of field types
on demand instead of storing it redundantly. <!-- raw HTML omitted
--><!-- raw HTML omitted -->- Callable residual finalization has been
optimized to avoid redundant type cloning and traversals, reducing
memory churn in attribute-heavy code. <!-- raw HTML omitted --><!-- raw
HTML omitted -->- Eliminated some bugs that caused Pyrefly to
unnecessarily analyze dependencies, improving latency and memory use,
especially in the IDE.</td>
</tr>
</tbody>
</table>
<hr />
<h2>🐛 bug fixes</h2>
<p>We closed <strong>15</strong> bug issues this release 👏</p>
<ul>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3057">#3057</a>:
Fixed an issue where string concatenation with the <code>+</code>
operator was incorrectly flagging <code>str</code> as not assignable to
<code>LiteralString</code> attributes. Pyrefly now preserves
<code>LiteralString</code> style when adding two explicit string
literals and uses implicit style otherwise.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/105">#105</a>:
Fixed premature type pinning in function calls where arguments were
incorrectly narrowed before all constraints were solved. For example,
<code>foo(x, y)</code> with <code>x: int | None</code> and <code>y: int
| None</code> no longer incorrectly narrows <code>x</code> to
<code>None</code> when passed to a generic
<code>foo[T](https://github.com/facebook/pyrefly/blob/HEAD/a: T, b:
T)</code>.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3198">#3198</a>:
Fixed <code>pyrefly suppress --remove-unused</code> which was not
actually removing unused error suppressions. The command now correctly
processes the <code>--remove-unused</code> flag.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3024">#3024</a>:
The language server now advertises <code>source.fixAll.pyrefly</code> in
addition to <code>source.fixAll</code>, allowing users to selectively
enable or disable Pyrefly's fix-all actions in editors that support LSP
code action kinds.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/2819">#2819</a>:
Fixed incorrect variance errors when using generic classes like
Pydantic's <code>RootModel</code> in lax mode. Missing type arguments
now degrade to <code>Any</code> instead of raising errors, matching our
handling of other incomplete types.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3000">#3000</a>:
Fixed &quot;find references&quot; failures in Cursor and other editors
caused by relative imports in site-packages not resolving correctly when
a <code>pyproject.toml</code> existed at the project root.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/2563">#2563</a>:
Fixed go-to-definition on relative imports in virtual environment
site-packages, which was returning null because the project root's
import path was matching before the more specific site-package
prefix.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3193">#3193</a>:
Fixed an error where <code>list[&quot;A|B&quot;]</code> was incorrectly
rejected as <code>not-a-type</code>. Type argument subscripts are now
bound as type expressions even in value context, allowing forward-ref
strings to be parsed.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3286">#3286</a>:
Fixed exponential memory blowup when type-checking deeply-nested dict
literals, which could cause VSCode to be killed by the OS. Memory usage
for a depth-25 dict dropped from ~7.7 GB to ~239 MB.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3261">#3261</a>:
Fixed a false positive <code>bad-class-definition</code> when a
dataclass field was assigned inside a <code>@classmethod</code> or
<code>__init_subclass__</code>. Pyrefly was incorrectly extracting these
as dataclass fields, even though Python's
<code>dataclasses.dataclass</code> ignores them at runtime.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/2914">#2914</a>:
<code>assert</code> statements now flag a non-callable
<code>__bool__</code> on the test expression, closing a gap that
previously only caught the issue inside <code>if</code>,
<code>while</code>, and ternary expressions.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/2867">#2867</a>:
Fixed <code>urlunparse</code> being inferred as returning
<code>Literal[b'']</code> instead of <code>str</code>. The fix reworks
<code>as_superclass</code> so tuple-like <code>NamedTuple</code>
subclasses are upcast through their erased tuple element types, which
stops <code>ParseResult</code> from spuriously matching
<code>Iterable[None]</code> and selecting the bytes overload.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3266">#3266</a>:
Added a quick fix for the existing &quot;Did you mean
<code>Foo.BAR</code>?&quot; diagnostic note for missing enum members,
turning the suggestion into a code action that rewrites the surrounding
string literal.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3230">#3230</a>:
Numeric parameter defaults now preserve their original spelling (e.g.
<code>0o777</code>) in hover and signature display rather than being
normalized to a decimal value.</li>
<li><a
href="https://redirect.github.com/facebook/pyrefly/issues/3302">#3302</a>:
Added a <code>path</code> field to the <code>pyrefly report</code> JSON
<code>ModuleReport</code>, restoring compatibility with typestats.</li>
</ul>
<p>Thank-you to all our contributors who found these bugs and reported
them! Did you know this is one of the most helpful contributions you can
make to an open-source project? If you find any bugs in Pyrefly we want
to know about them! Please open a bug report issue <a
href="https://github.com/facebook/pyrefly/issues">here</a></p>
<hr />
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/pyrefly/commit/71ff2a5cbc7ce9a82e758174fe25274256728c28"><code>71ff2a5</code></a>
upgrade</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/b3d41027a20764fd076c7af89d9dbb45e64dd458"><code>b3d4102</code></a>
Strip debuginfo from release binaries to reduce binary size</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/ccb904d47281c22195839bcc714eb1c38256e690"><code>ccb904d</code></a>
Fix Pyrefly regression with imported TypeVars via attribute access (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3333">#3333</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/fb2ef608a2bb9b896a0232be0783338eea3b028a"><code>fb2ef60</code></a>
support vscode-python-environments extension (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3327">#3327</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/e63fa8d7d9160d3d319569ee2a4439883eaa4c9e"><code>e63fa8d</code></a>
remove extensionDependency on ms-python.python (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3326">#3326</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/15b8f817923a9b3efb8f5192a8ba1359878c3e58"><code>15b8f81</code></a>
abstract away python-environment from extension (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3325">#3325</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/e267ba6974db6d041c1fe74975c08d938d8ae3d1"><code>e267ba6</code></a>
Fix provide_type race condition with config recheck cancellation (<a
href="https://redirect.github.com/facebook/pyrefly/issues/3316">#3316</a>)</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/fe26ba3ace3c39794b19b8220f35c56a19d0b9cf"><code>fe26ba3</code></a>
Fix failing quick fix test</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/6d9611de431d43e26d47b5e97e4499cf9a94e931"><code>6d9611d</code></a>
Use <code>FuncMetadata::def</code> to reduce code duplication</li>
<li><a
href="https://github.com/facebook/pyrefly/commit/a545b3a13cac916b4d92b69ee82bb936c3432eb0"><code>a545b3a</code></a>
Add a more general <code>FuncMetadata::def</code> helper</li>
<li>Additional commits viewable in <a
href="https://github.com/facebook/pyrefly/compare/0.63.1...0.64.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyrefly&package-manager=uv&previous-version=0.63.1&new-version=0.64.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-09 04:12:28 +00:00
dependabot[bot] 9a47d9cf6a Bump gunicorn from 25.3.0 to 26.0.0 in /backend (#1708) 
Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 25.3.0 to
26.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/benoitc/gunicorn/releases">gunicorn's
releases</a>.</em></p>
<blockquote>
<h2>26.0.0</h2>
<h2>Breaking Changes</h2>
<ul>
<li><strong>Eventlet worker removed</strong>: The <code>eventlet</code>
worker class has been dropped. Migrate to <code>gevent</code>,
<code>gthread</code>, or <code>tornado</code>.</li>
</ul>
<h2>New Features</h2>
<ul>
<li><strong>ASGI Framework Compatibility Suite</strong>: New end-to-end
compatibility test harness covering Starlette, FastAPI, Litestar, Quart,
Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).</li>
<li><strong>ASGI Test Suite Expansion</strong>: 134 additional ASGI unit
tests covering protocol semantics, lifespan, websockets, and chunked
framing.</li>
</ul>
<h2>Security</h2>
<ul>
<li><strong>HTTP/1.1 Request-Target Validation</strong> (RFC 9112
sections 3.2.3, 3.2.4):
<ul>
<li>Reject <code>authority-form</code> request-target outside
<code>CONNECT</code></li>
<li>Reject <code>asterisk-form</code> request-target outside
<code>OPTIONS</code></li>
<li>Reject <code>relative-reference</code> request-targets</li>
</ul>
</li>
<li><strong>Header Field Hardening</strong> (RFC 9110):
<ul>
<li>Reject control characters in header field-value (section 5.5)</li>
<li>Reject forbidden trailer field-names (section 6.5.1)</li>
<li>Reject <code>Content-Length</code> list form (RFC 9112 section
6.3)</li>
</ul>
</li>
<li><strong>Request Smuggling Hardening</strong>:
<ul>
<li>Tighten keepalive gate and scope <code>finish_body</code> byte
cap</li>
<li>Keep <code>_body_receiver</code> alive across the keepalive
smuggling gate so pipelined requests cannot re-enter a closed body</li>
<li>Address parser/protocol findings from a six-point WSGI/ASGI
audit</li>
</ul>
</li>
<li><strong>PROXY Protocol (ASGI)</strong>: Enforce
<code>proxy_allow_ips</code> and tighten v1/v2 parsing in the ASGI
callback parser.</li>
<li><strong>Connection Draining</strong>: Drain the connection on close
per RFC 9112 section 9.6 to prevent reset-on-close truncation.</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><strong>Body Framing on HEAD/204/304</strong>:
<ul>
<li>Keep <code>Content-Length</code> on HEAD and 304 responses (<a
href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>)</li>
<li>Drop body framing on HEAD/204/304 even when the framework set
it</li>
<li>Warn once when an ASGI app emits a body for a no-body response</li>
</ul>
</li>
<li><strong>HTTP/2 ASGI</strong>:
<ul>
<li>Fix <code>_handle_stream_ended</code> to set
<code>_body_complete</code> in the async HTTP/2 handler so request
bodies finalize correctly on stream end</li>
<li>Add <code>InvalidChunkExtension</code> mapping and fast-parser
support in ASGI tests (<a
href="https://redirect.github.com/benoitc/gunicorn/issues/3565">#3565</a>)</li>
</ul>
</li>
<li><strong>HTTP/1.1 100-Continue</strong>: Stop adding
<code>Transfer-Encoding: chunked</code> to 100-Continue interim
responses.</li>
<li><strong>WebSocket Close Handshake</strong> (RFC 6455):
<ul>
<li>Comply with the close handshake state machine</li>
<li>Close the transport after the close handshake completes</li>
<li>Fix binary send when the <code>text</code> key is
<code>None</code></li>
</ul>
</li>
<li><strong>Early Hints</strong>: Validate headers in the
<code>early_hints</code> callback to match <code>process_headers</code>;
pass only the header name to <code>InvalidHeader</code> (<a
href="https://redirect.github.com/benoitc/gunicorn/issues/3588">#3588</a>).</li>
<li><strong>ASGI Framework Fixes</strong>:
<ul>
<li>Fix ASGI disconnect handling for Django-style apps</li>
<li>Fix Litestar request handling (use raw ASGI receive for
body/headers)</li>
<li>Fix Litestar HTTP endpoints for compatibility tests</li>
<li>Fix Quart headers endpoint to normalize keys to lowercase</li>
<li>Fix Quart WebSocket close test app (missing
<code>accept()</code>)</li>
<li>Fix duplicate <code>Transfer-Encoding</code> header for BlackSheep
streaming</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/benoitc/gunicorn/commit/5d819cf36040f6cc6175fcc804d703fb899509dd"><code>5d819cf</code></a>
release: 26.0.0</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/b45c70df105f7d5dcbc5abfb732804d6464edc21"><code>b45c70d</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3611">#3611</a>
from zc-mattcen/docs-typo</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/99c8d48acf453deb5c49fe12e195dbc00d888d1e"><code>99c8d48</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3623">#3623</a>
from benoitc/chore/drop-eventlet-add-h2-uvloop-test-...</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/5a655af50f20e005dd9e32e6078dc82fa45f3d4b"><code>5a655af</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3622">#3622</a>
from benoitc/test/docker-port-and-ipv4-fixes</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/201df19a8011c0a1d6a0e75ebe22e89d48eb935e"><code>201df19</code></a>
chore: remove eventlet worker; add h2 and uvloop to test deps</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/f4ac8e1f1bf1d365e77f41915da55bec31873f84"><code>f4ac8e1</code></a>
test: pass action name to dirty client and stabilize after TTOU
spam</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/54d38afddf1f0db0c15b5f4ff63f3c7bfad96961"><code>54d38af</code></a>
test: unblock docker fixtures on macOS hosts</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/68843c8893dd938456f0a2da62085ab5776f8871"><code>68843c8</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>
from benoitc/fix/asgi-preserve-content-length-on-hea...</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/31f2618f733cc0c78690df63f4e344aaf3f56b20"><code>31f2618</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3620">#3620</a>
from benoitc/fix/asgi-proxy-protocol-trust-and-parsing</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/41ec7527dbd8a9e52728477700707ad40e41d9dc"><code>41ec752</code></a>
fix: keep Content-Length on HEAD and 304 responses</li>
<li>Additional commits viewable in <a
href="https://github.com/benoitc/gunicorn/compare/25.3.0...26.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gunicorn&package-manager=uv&previous-version=25.3.0&new-version=26.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-09 04:12:08 +00:00
dependabot[bot] 280a573976 Bump starlette from 1.0.0 to 1.0.1 in /backend (#1706) 
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.0 to
1.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Ignore malformed <code>Host</code> header when constructing
<code>request.url</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3279">Kludex/starlette#3279</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.0.0...1.0.1">https://github.com/Kludex/starlette/compare/1.0.0...1.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>1.0.1 (May 21, 2026)</h2>
<h4>Fixed</h4>
<ul>
<li>Ignore malformed <code>Host</code> header when constructing
<code>request.url</code> <a
href="https://redirect.github.com/encode/starlette/pull/3279">#3279</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/48f8e331b23ca692f4713ac1f370bff1b5cd034c"><code>48f8e33</code></a>
Version 1.0.1 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3281">#3281</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/f078832be1aa27ab0e7ec3153479a347749e967a"><code>f078832</code></a>
Remove Hugging Face sponsor block from docs (<a
href="https://redirect.github.com/Kludex/starlette/issues/3280">#3280</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/472951eba8f6e35be845fd1b91625a1b5488294b"><code>472951e</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/Kludex/starlette/issues/3277">#3277</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"><code>764dab0</code></a>
Ignore malformed <code>Host</code> header when constructing
<code>request.url</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3279">#3279</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/19d08115ce56da8d4da2838ecdd9c5882cb2b365"><code>19d0811</code></a>
Harden GitHub Actions workflows and Dependabot config (<a
href="https://redirect.github.com/Kludex/starlette/issues/3276">#3276</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/01f46378120fe2c6312074ed7e997e3b5f7d8c20"><code>01f4637</code></a>
chore(deps): bump idna from 3.10 to 3.15 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3274">#3274</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/b8fa5140d2ef9f22483d777e936ab4c2df897179"><code>b8fa514</code></a>
docs: fix typos in TestClient docs and test_requests comment (<a
href="https://redirect.github.com/Kludex/starlette/issues/3266">#3266</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/e935b6b5d4616c2317bbdadfb4cf07a8e7637955"><code>e935b6b</code></a>
fix uvicorn domain (<a
href="https://redirect.github.com/Kludex/starlette/issues/3269">#3269</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/96af9521a7e46bc0d00b5227186f03b70b6d242f"><code>96af952</code></a>
Add 7-day cooldown for dependency resolution via uv exclude-newer (<a
href="https://redirect.github.com/Kludex/starlette/issues/3265">#3265</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/61e385bd6dc438a90493c50f65ed232430f873fb"><code>61e385b</code></a>
Add zizmor GitHub Actions security analysis workflow (<a
href="https://redirect.github.com/Kludex/starlette/issues/3264">#3264</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/starlette/compare/1.0.0...1.0.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=starlette&package-manager=uv&previous-version=1.0.0&new-version=1.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 17:35:37 +00:00
dependabot[bot] 0b8e32af0a Bump sentry-sdk from 2.58.0 to 2.59.0 in /backend (#1704) 
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from
2.58.0 to 2.59.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's
releases</a>.</em></p>
<blockquote>
<h2>2.59.0</h2>
<h3>New Features ✨</h3>
<h4>Langchain</h4>
<ul>
<li>Record <code>run_name</code> as <code>gen_ai.function_id</code> on
Invoke Agent Spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5926">#5926</a></li>
<li>Record <code>run_name</code> in <code>on_tool_start</code> by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5925">#5925</a></li>
<li>Record <code>run_name</code> in <code>on_chat_model_start</code> by
<a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5924">#5924</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(ci) Cancel in-progress PR workflows on new commit push by <a
href="https://github.com/joshuarli"><code>@​joshuarli</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5994">#5994</a></li>
<li>(consts) Add updated span convention constants to SPANDATA by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6093">#6093</a></li>
<li>(fastapi) Support span streaming in active thread tracking by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6118">#6118</a></li>
<li>(httpx) Migrate to span first by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6084">#6084</a></li>
<li>(huggingface_hub) Migrate to span first by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6124">#6124</a></li>
<li>(mcp) Migrate to span first by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6131">#6131</a></li>
<li>Add <code>db.driver.name</code> spans to database integrations by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6082">#6082</a></li>
</ul>
<h3>Bug Fixes 🐛</h3>
<p>We've put additional data that might contain sensitive information,
like GraphQL documents, behind the <code>send_default_pii</code>
option.</p>
<h4>Httpx</h4>
<ul>
<li>Consistently early-exit when adding request source by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6151">#6151</a></li>
<li>Set <code>code.namespace</code> and <code>code.function</code>
instead of <code>code.function.name</code> in span streaming by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6150">#6150</a></li>
</ul>
<h4>Langchain</h4>
<ul>
<li>Record <code>run_name</code> as <code>gen_ai.function_id</code> for
text completions by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6073">#6073</a></li>
<li>Set agent name as <code>gen_ai.agent.name</code> for chat and tool
spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5877">#5877</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(asgi) Use <code>inspect.iscoroutinefunction</code> on Python 3.14+
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6135">#6135</a></li>
<li>(batcher) Reset lock and flusher in child after fork by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6163">#6163</a></li>
<li>(google_genai) Redact binary data in inline_data and fix multi-part
message extraction by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/5977">#5977</a></li>
<li>(grpc) Add isolation_scope to async server interceptor by <a
href="https://github.com/robinvd"><code>@​robinvd</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5940">#5940</a></li>
<li>(metrics,logs) Don't attach <code>span_id</code> if no active span
by <a href="https://github.com/sentrivana"><code>@​sentrivana</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6162">#6162</a></li>
<li>(monitor) Release <code>Monitor._thread_lock</code> after fork (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6148">#6148</a>)
by <a href="https://github.com/vokracko"><code>@​vokracko</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6159">#6159</a></li>
<li>(openai-agents) Resolve agent from <code>bindings</code> for
openai-agents &gt;= 0.14 by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6102">#6102</a></li>
<li>(profiler) Stop nulling buffer on teardown by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6075">#6075</a></li>
<li>(quart) Use <code>inspect.iscoroutinefunction</code> when Quart does
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6133">#6133</a></li>
<li>(security) Prevent GitHub script injection in update-tox workflow by
<a
href="https://github.com/fix-it-felix-sentry"><code>@​fix-it-felix-sentry</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6171">#6171</a></li>
<li>(starlette/fastapi) Use <code>inspect.iscoroutinefunction</code>
when Starlette does by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6134">#6134</a></li>
<li>(tornado) Make sure context manager doesn't double yield by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6152">#6152</a></li>
<li>Introduce <code>_get_current_streamed_span()</code> to keep types
backwards compatible by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6177">#6177</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>2.59.0</h2>
<h3>New Features ✨</h3>
<h4>Langchain</h4>
<ul>
<li>Record <code>run_name</code> as <code>gen_ai.function_id</code> on
Invoke Agent Spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5926">#5926</a></li>
<li>Record <code>run_name</code> in <code>on_tool_start</code> by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5925">#5925</a></li>
<li>Record <code>run_name</code> in <code>on_chat_model_start</code> by
<a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5924">#5924</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(ci) Cancel in-progress PR workflows on new commit push by <a
href="https://github.com/joshuarli"><code>@​joshuarli</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5994">#5994</a></li>
<li>(consts) Add updated span convention constants to SPANDATA by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6093">#6093</a></li>
<li>(fastapi) Support span streaming in active thread tracking by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6118">#6118</a></li>
<li>(httpx) Migrate to span first by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6084">#6084</a></li>
<li>(huggingface_hub) Migrate to span first by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6124">#6124</a></li>
<li>(mcp) Migrate to span first by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6131">#6131</a></li>
<li>Add <code>db.driver.name</code> spans to database integrations by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6082">#6082</a></li>
</ul>
<h3>Bug Fixes 🐛</h3>
<p>We've put additional data that might contain sensitive information,
like GraphQL documents, behind the <code>send_default_pii</code>
option.</p>
<h4>Httpx</h4>
<ul>
<li>Consistently early-exit when adding request source by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6151">#6151</a></li>
<li>Set <code>code.namespace</code> and <code>code.function</code>
instead of <code>code.function.name</code> in span streaming by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6150">#6150</a></li>
</ul>
<h4>Langchain</h4>
<ul>
<li>Record <code>run_name</code> as <code>gen_ai.function_id</code> for
text completions by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6073">#6073</a></li>
<li>Set agent name as <code>gen_ai.agent.name</code> for chat and tool
spans by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5877">#5877</a></li>
</ul>
<h4>Other</h4>
<ul>
<li>(asgi) Use <code>inspect.iscoroutinefunction</code> on Python 3.14+
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6135">#6135</a></li>
<li>(batcher) Reset lock and flusher in child after fork by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6163">#6163</a></li>
<li>(google_genai) Redact binary data in inline_data and fix multi-part
message extraction by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/5977">#5977</a></li>
<li>(grpc) Add isolation_scope to async server interceptor by <a
href="https://github.com/robinvd"><code>@​robinvd</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/5940">#5940</a></li>
<li>(metrics,logs) Don't attach <code>span_id</code> if no active span
by <a href="https://github.com/sentrivana"><code>@​sentrivana</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6162">#6162</a></li>
<li>(monitor) Release <code>Monitor._thread_lock</code> after fork (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6148">#6148</a>)
by <a href="https://github.com/vokracko"><code>@​vokracko</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6159">#6159</a></li>
<li>(openai-agents) Resolve agent from <code>bindings</code> for
openai-agents &gt;= 0.14 by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6102">#6102</a></li>
<li>(profiler) Stop nulling buffer on teardown by <a
href="https://github.com/ericapisani"><code>@​ericapisani</code></a> in
<a
href="https://redirect.github.com/getsentry/sentry-python/pull/6075">#6075</a></li>
<li>(quart) Use <code>inspect.iscoroutinefunction</code> when Quart does
by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6133">#6133</a></li>
<li>(security) Prevent GitHub script injection in update-tox workflow by
<a
href="https://github.com/fix-it-felix-sentry"><code>@​fix-it-felix-sentry</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6171">#6171</a></li>
<li>(starlette/fastapi) Use <code>inspect.iscoroutinefunction</code>
when Starlette does by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6134">#6134</a></li>
<li>(tornado) Make sure context manager doesn't double yield by <a
href="https://github.com/sentrivana"><code>@​sentrivana</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6152">#6152</a></li>
<li>Introduce <code>_get_current_streamed_span()</code> to keep types
backwards compatible by <a
href="https://github.com/alexander-alderman-webb"><code>@​alexander-alderman-webb</code></a>
in <a
href="https://redirect.github.com/getsentry/sentry-python/pull/6177">#6177</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-python/commit/689cb97e333534f093f16f75f2c212a986bab7e5"><code>689cb97</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/397dda917fa40782e48e24ac01ecf822de0771fc"><code>397dda9</code></a>
release: 2.59.0</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/c0c254a8f8bbd2009c409b12c50d6075e262c6f8"><code>c0c254a</code></a>
test: Rename file (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6194">#6194</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/d90a9238ccf84dd49b2c994e8cbc9cc7b8fdbf80"><code>d90a923</code></a>
ref(batcher): Only flush the bucket that triggered the flush event (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6168">#6168</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/6436518b21943881122e0cc6e0e49fe1355fd23f"><code>6436518</code></a>
ci: 🤖 Update test matrix with new releases (05/04) (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6186">#6186</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/98294ceeb77376237ce9c4cac66b1925adb37f54"><code>98294ce</code></a>
fix: Introduce <code>_get_current_streamed_span()</code> to keep types
backwards compati...</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/66b3c6b8178dd6fa8e2e976481a642b53db27319"><code>66b3c6b</code></a>
test(fastmcp): Span streaming tests (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6167">#6167</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/b5735abb51b21dba8cee1f35a918dbe51babf038"><code>b5735ab</code></a>
fix(batcher): Reset lock and flusher in child after fork (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6163">#6163</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/fc3eab43a6ee9af6fced602d5c56467e2d690603"><code>fc3eab4</code></a>
fix(metrics,logs): Don't attach <code>span_id</code> if no active span
(<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6162">#6162</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-python/commit/8e5bd96c7a21839b54849f813d834d46969abd2a"><code>8e5bd96</code></a>
test: Assert presence of profile chunks after shutdown (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/6174">#6174</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-python/compare/2.58.0...2.59.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sentry-sdk&package-manager=uv&previous-version=2.58.0&new-version=2.59.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 22:00:53 +00:00