Skip to content

deps(deps): bump the python-production group across 1 directory with 4 updates - #97

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-production-35910d4300
Open

deps(deps): bump the python-production group across 1 directory with 4 updates#97
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-production-35910d4300

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown

Bumps the python-production group with 4 updates in the / directory: cryptography, fastapi-pagination, multipart and typer.

Updates cryptography from 49.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:


50.0.0 - 2026-07-31

  • SECURITY ISSUE: :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:3218. Credit to @​X1AOxiang for reporting the issue. CVE-2026-69247
  • Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm.
  • Added xof() class methods to :class:~cryptography.hazmat.primitives.hashes.SHAKE128 and :class:~cryptography.hazmat.primitives.hashes.SHAKE256 for constructing algorithm instances configured for use with :class:~cryptography.hazmat.primitives.hashes.XOFHash.
  • The :mod:X.509 verification <cryptography.x509.verification> APIs are now considered stable and are subject to our API stability policy.
  • Added the :doc:/cobblestone recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>_ for streaming authenticated encryption of large messages.
  • Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them.
  • Added support for using :class:~cryptography.x509.Name as a field type in the :doc:/hazmat/asn1/index module.
  • Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it.
  • Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field.
  • :func:~cryptography.x509.ocsp.load_der_ocsp_request and :func:~cryptography.x509.ocsp.load_der_ocsp_response now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading

... (truncated)

Commits

Updates fastapi-pagination from 0.15.16 to 0.16.0

Release notes

Sourced from fastapi-pagination's releases.

0.16.0

v0.16.0 is the first stable release of the v0.16 line.

If you are upgrading from v0.15, please read the v0.16 migration guide — this release contains breaking changes.

What's New

bind_params and execute_options for sqlalchemy/sqlmodel

paginate/apaginate from fastapi_pagination.ext.sqlalchemy and fastapi_pagination.ext.sqlmodel now accept bind_params and execute_options, which are applied to every statement that is executed (both the items query and the count query).

from sqlalchemy import bindparam, select
from fastapi_pagination.ext.sqlalchemy import paginate
paginate(
session,
select(User).where(User.age > bindparam("min_age")),
bind_params={"min_age": 18},
execute_options={"populate_existing": True},
)

Breaking Changes in v0.16

1. pydantic v1 support was dropped

pydantic package now requires version 2.13.4 or higher.

UsePydanticV1 customization and all version specific helpers from fastapi_pagination.pydantic were removed.

2. Deprecated async paginate functions were removed

Async paginate functions, that were deprecated in v0.15.0, are now removed. Please use apaginate instead.

# before
from fastapi_pagination.ext.sqlalchemy import paginate
after
from fastapi_pagination.ext.sqlalchemy import apaginate

3. Deprecated extensions were removed

... (truncated)

Commits
  • 0c17db5 Update dependencies to latest versions
  • 93c08eb Add bind_params and execute_options to sqlalchemy paginate (#2042)
  • bb05b11 Bump dependencies to latest versions
  • 1d80eb9 Bump to next version [no ci]
  • bf13923 Merge pull request #2039 from uriyyo/dependabot/uv/ruff-0.16.7
  • ac9048e Bump ruff from 0.16.6 to 0.16.7
  • 86bc420 Merge pull request #2040 from uriyyo/dependabot/uv/psycopg2-binary-2.9.13
  • 7249b1a Bump psycopg2-binary from 2.9.12 to 2.9.13
  • 1812088 Merge pull request #2041 from uriyyo/dependabot/uv/elasticsearch-9.5.1
  • 041b875 Bump elasticsearch from 9.5.0 to 9.5.1
  • Additional commits viewable in compare view

Updates multipart from 1.3.1 to 2.0.0

Release notes

Sourced from multipart's releases.

v2.0.0

Full Changelog: defnull/multipart@v1.3.0...v2.0.0

Changelog

Sourced from multipart's changelog.

========= Changelog

This project follows Semantic Versioning (major.minor.patch), with the exception that behavior changes are allowed in minor or patch releases as long as the change corrects behavior to match documentation, specification or expectation. In other words: Bugfixes do not count as backward incompatible changes, even if they technically change behavior from incorrect to correct and may break applications that rely on incorrect or undefined behavior or undocumented APIs. EOL Python versions may also be dropped during minor releases.

Release 2.1 (Not released yet)

  • Added: :meth:PushMultipartParser.parse_async_iterable helper method.

Release 2.0

This release drops EOL python versions, improves error handling and includes multiple performance improvements that can result in up to 30% faster file uploads and 50% faster text field handling.

  • change: Dropped support for Python 3.8 and 3.9 (both EOL), added support for Python 3.14
  • change: Accessing :attr:MultipartSegment.size before the segment is complete now raises :exc:ParserStateError. The new attribute :attr:MultipartSegment.bytes_received provides the in-progress segment body byte count previously exposed by :attr:MultipartSegment.size.
  • change: :class:PushMultipartParser now emits :class:bytes instead of :class:bytearray for part body chunks. Update your isinstance checks if you have any.
  • change: Enforce part_limit (128 by default) for url-encoded data in parse_form_data(). This is consistent with multipart handling and an important safeguard against denial of service attacks.
  • change: New strict-mode check to reject extremely large boundaries.
  • change: Raise more helpful :exc:ParserStateError instead of implicit :exc:AssertionError or :exc:TypeError when the parser is used incorrectly.
  • change: The boundary delimiter must not appear inside a segment body (RFC-7578 4.1). This triggers a fatal error now.
  • feat: Hardened (and faster) header validation.
  • build: Change default branch to main.

Release 1.3

... (truncated)

Commits
  • a14fdd6 Release of 2.0.0
  • dca7836 Prepare 2.0 release
  • 1240e8c build: fix venv builder in makefile
  • ba1d834 change: MultipartSegment.size now throws if incomplete.
  • 59322fe build: More github CI checks and fixed makefile
  • 4421f32 Switch to stdlib cached_property
  • 520fdf9 All public APIs should be in all
  • 42e7ea7 docs: cleanup
  • bce8554 feat: parse_content_disposition is now a publich API
  • e1c47df Link to defnull.de for benchmarks
  • Additional commits viewable in compare view

Updates typer from 0.26.8 to 0.27.2

Release notes

Sourced from typer's releases.

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0

Breaking Changes

Internal

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0 (2026-07-15)

Breaking Changes

Internal

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 28, 2026
@svazquezco
svazquezco force-pushed the dependabot/uv/python-production-35910d4300 branch from 4e90b87 to f936dd1 Compare October 5, 2026 09:10
@dependabot @svazquezco
deps(deps): bump the python-production group across 1 directory with …
2bf34bc 
…4 updates

Bumps the python-production group with 4 updates in the / directory: [cryptography](https://github.com/pyca/cryptography), [fastapi-pagination](https://github.com/uriyyo/fastapi-pagination), [multipart](https://github.com/defnull/multipart) and [typer](https://github.com/fastapi/typer).

Updates `cryptography` from 49.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.1)

Updates `fastapi-pagination` from 0.15.16 to 0.16.0
- [Release notes](https://github.com/uriyyo/fastapi-pagination/releases)
- [Commits](uriyyo/fastapi-pagination@0.15.16...0.16.0)

Updates `multipart` from 1.3.1 to 2.0.0
- [Release notes](https://github.com/defnull/multipart/releases)
- [Changelog](https://github.com/defnull/multipart/blob/main/CHANGELOG.rst)
- [Commits](defnull/multipart@v1.3.1...v2.0.0)

Updates `typer` from 0.26.8 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.26.8...0.27.2)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-production
- dependency-name: fastapi-pagination
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-production
- dependency-name: multipart
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-production
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@svazquezco
svazquezco force-pushed the dependabot/uv/python-production-35910d4300 branch from f936dd1 to 2bf34bc Compare October 9, 2026 08:16
@sonarqubecloud

sonarqubecloud Bot commented Oct 9, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants