Deps: Bump the python-packages group with 11 updates

[dependabot]

Bumps the python-packages group with 11 updates:

Package	From	To
shtab	1.8.2	1.9.3
uvicorn	0.52.0	0.52.1
coverage	7.15.2	7.15.4
ast-serialize	0.6.0	0.7.0
h2	4.4.0	4.4.1
librt	0.13.0	0.14.0
packaging	26.2	26.3
pydantic	2.14.0a1	2.14.0b1
pydantic-core	2.47.0	2.48.0
starlette	1.3.1	1.4.1
websockets	17.0	17.0.1

Updates shtab from 1.8.2 to 1.9.3

Release notes

Sourced from shtab's releases.

shtab v1.9.3 stable

• ⚒️ misc tcsh improvements & fixes (#213)
  • support positional completion under subcommands at any depth
  • guard against out-of-range array indexing
  • handle arguments with a custom .complete in the multi-requirement branch
  • complete --opt=<TAB> for options taking a value (nargs != 0)
  • deduplicate rules
• 🎣 fix fish backend (#232)
  • fix option values breaking subcommands (#228)
  • fix argument values conflicting with command names (#229)
  • handle positional order (#230)
  • fix FILE missing filenames & options unintentionally completing filenames (#227)
• 🐟 fix fish descriptions (#233 <- #231)
  • expand argparse placeholders (e.g. %(prog)s)
  • subcommand help fallback if description missing
• 🛠️ misc refactoring (#238)
  • tests debug output: minor bytes/str fix
  • inline some single-use functions
• 🗜️ tests auto-caplog (#237)
• ± tests diff examples output summary (#234)
• 🌐 update docs FAQs & URLs

shtab v1.9.2 stable

• 🤦 revert to original (shtab<=1.8.1) zsh space/quote handling (#225 <- #224, #196)
• 🔪 fix more zsh edge cases
  • nargs=0 (#221 <- #215)
  • non-sequence choices (#220 <- #214)

shtab v1.9.1 stable

• 🐟 fix fish preamble (#222)
• 👾 fix bash bug (#196)
• 📚 slight docs tidy & refactor
• 🛠️ minor CI framework updates

shtab v1.9.0 stable

• 🐟 support fish shell! (#216 <- #195, #174, #134, #196)
• 🔨 fix shtab --verbose CLI behaviour (#223)
• 📚 docs: git-fame generated contributors list

Commits

• 91e3130 Merge pull request #238 from tqdm/devel
• 33d031e misc tidy
• b0a498b Merge pull request #233 from ThomasWaldmann/fix-fish-descriptions
• 4c664ea misc updates & tidy
• 5cf4ddf fish: expand argparse placeholders, fallback help
• fc7fe03 Merge pull request #237 from tqdm/tests-auto-caplog
• d892b3f tests: auto-caplog
• 79536de Merge pull request #232 from ThomasWaldmann/fix-fish-backend
• d59f615 CI: update fish>=4
• e885d27 fish: drop Choice support, misc tidy
• Additional commits viewable in compare view

Updates uvicorn from 0.52.0 to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Commits

• ee8e45c Version 0.52.1 (#3056)
• b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
• 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
• 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
• 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
• e148451 Handle connection loss during WebSocket write backpressure (#3050)
• e16a69b Add missing write flow control to websockets-sansio (#3048)
• ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
• See full diff in compare view

Updates coverage from 7.15.2 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

• Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Commits

• 4c0e7ff docs: sample HTML for 7.15.4
• db4cc32 docs: prep for 7.15.4
• c33085c style: start gradual move to ruff 0.16
• 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
• b64d53d build: make 3.15 wheels
• 53792ab build: show the python version for kits
• f6b03c7 chore: make upgrade_one package=cibuildwheel
• d9b660a chore: make upgrade
• b128a31 docs: oops, move this entry to the correct place
• a7a2c15 fix: escape filename urls in html report href attributes (#2227)
• Additional commits viewable in compare view

Updates ast-serialize from 0.6.0 to 0.7.0

Commits

• 74193f3 Bump version to 0.7.0
• 5b7276c Minor update after adding wheels for Python 3.15 (#73)
• 49e34a5 Vendor Ruff crates (#70)
• fbca1af Build musllinux wheels for ppc64le and riscv64 (#72)
• c2db11c Build wheels for Python 3.15 (#71)
• See full diff in compare view

Updates h2 from 4.4.0 to 4.4.1

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

Commits

• bc239af v4.4.1
• 92b925e add test for duplicate host headers
• 292a408 reject duplicate Host headers in request headers
• 04d3b87 update changelog
• 439b970 prepare for next release cycle
• 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
• See full diff in compare view

Updates librt from 0.13.0 to 0.14.0

Commits

• 3c133fa Sync mypy and bump version
• c963cc9 Build wheels for Python 3.15 (#43)
• See full diff in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates pydantic from 2.14.0a1 to 2.14.0b1

Changelog

Sourced from pydantic's changelog.

v2.14.0b1 (2026-08-06)

GitHub release

What's Changed

This is the first beta release of the 2.14 version, providing some new features and performance improvements for model builds.

This release is the first to provide initial support for Python 3.15, although not all 3.15 specific features are supported yet.

Packaging

• Add agent skills by @​Viicos in #13193

New Features

• Add support for EllipsisType by @​Viicos in #13484
• Add initial support for Python 3.15 by @​Viicos in #13587

Changes

• Populate __slots__ from generic class during parameterization by @​Viicos in #13243
• Avoid using explicit Any in the Mypy plugin by @​Viicos in #13196
• Support Fraction type in pydantic-core by @​Viicos in #13339
• Use constant-time comparison for SecretStr and SecretBytes types by @​Viicos in #13518
• Fix application of constraints in pipeline API by @​Viicos in #13516
• Optimize type lookup logic in core schema generation by @​Viicos in #13573
• Add a named-tuple core schema by @​Viicos in #13505
• Raise explicit TypeError on invalid index_key serialization wrap handler by @​Viicos in #13506

Performance

• Cache ModelPrivateAttr.default_factory_takes_validated_data property by @​Viicos in #13390
• Introduce micro-optimizations for model class building by @​dmontagu in #13540
• Try Format.VALUE before FORWARDREF when evaluating annotations in ModelMetaclass by @​Viicos in #13584
• Optimize type lookup logic in core schema generation by @​Viicos in #13573
• Avoid exponential core schema traversal in gather_schemas_for_cleaning() by @​dmontagu in #13523

Fixes

• Validate falsy AliasGenerator outputs by @​jiyujie2006 in #13248
• Do not resolve recursive 'definitions-ref' schemas in schema cleaning by @​Viicos in #13276
• Fix missing max_length check on lazy iteration validation by @​davidhewitt in #13278
• Handle missing errors with default factories taking validated data by @​Viicos in #13291
• Recognise WindowsPath as a schema type by @​davidhewitt in #13326
• Fix application of nested operators in pipeline API by @​Viicos in #13363
• Fix type variable substitution in __pydantic_extra__ by @​Viicos in #13391
• Fix json_schema_extra dict being dropped when a callable follows it in Annotated by @​Srivatsa03 in #13374
• Skip RootModel.__init__() in Mypy plugin by @​Viicos in #13441
• Defer placeholders in Mypy plugin by @​Viicos in #13442

... (truncated)

Commits

• 5922459 Prepare release v2.14.0b1 (#13597)
• 111c942 Refactor model namespace inspection (#13596)
• b348cf0 Add initial support for Python 3.15 (#13587)
• 4792336 Bump PyO3 to 0.29.2 (#13572)
• 57d0ad8 Raise explicit TypeError on invalid index_key serialization wrap handler ...
• 53b39c3 Add a named-tuple core schema (#13505)
• 98a08d3 Revert moving pydantic-core tests (#13589)
• 5f49d85 Add AllowInfNan type to the field metadata gathering (#13586)
• 2e5f0e2 Try Format.VALUE before FORWARDREF when evaluating annotations in `ModelM...
• de3175c Migrate pydantic-core tests to main tests directory (#13582)
• Additional commits viewable in compare view

Updates pydantic-core from 2.47.0 to 2.48.0

Commits

• See full diff in compare view

Updates starlette from 1.3.1 to 1.4.1

Release notes

Sourced from starlette's releases.

Version 1.4.1

What's Changed

• Default thread_minimum_size in GZipResponder by @​Kludex in Kludex/starlette#3415

Full Changelog: Kludex/starlette@1.4.0...1.4.1

Version 1.4.0

What's Changed

• Lazily allocate GZipMiddleware compression resources by @​Kludex in Kludex/starlette#3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @​Kludex in Kludex/starlette#3411
• Offload large GZip compression by @​Kludex in Kludex/starlette#3410

New Contributors

• @​benberryallwood made their first contribution in Kludex/starlette#3334
• @​lkk7 made their first contribution in Kludex/starlette#3359

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Changelog

Sourced from starlette's changelog.

1.4.1 (August 5, 2026)

Fixed

• Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

• Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

• Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
• Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.

Commits

• 9c55062 Version 1.4.1 (#3416)
• 152cef4 Default thread_minimum_size in GZipResponder (#3415)
• 3d6d6c2 Version 1.4.0 (#3413)
• cb824a1 Offload large GZip compression (#3410)
• 5567e27 Run ASGI benchmarks on a real event loop (#3412)
• be5bf5e Add GZip event-loop responsiveness benchmark (#3409)
• 7ed6b26 Use zlib.compressobj instead of GzipFile in GZipMiddleware (#3411)
• a375798 Lazily allocate GZipMiddleware compression resources (#3407)
• 0eb9ca8 Exercise GZipMiddleware benchmarks through ASGI (#3408)
• 08f29c9 Add GZipMiddleware bypass benchmarks (#3406)
• Additional commits viewable in compare view

Updates websockets from 17.0 to 17.0.1

Release notes

Sourced from websockets's releases.

17.0.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits

• fd3f16c Release version 17.0.1.
• 3e4634a Remove superfluous "no cover" pragmas.
• b93ef1e Add tests for the asyncio server.
• fef04d8 Fix backpressure in the Trio implementation.
• eb3600c Restore compatibility of serve_forever with uvloop.
• 8b5e767 Simplify asyncio server implementation.
• 94f6384 Refactor connection handling outside of Server class.
• 3826993 Unpin sphinx.
• 31ec002 Add Trio to requirements for building docs.
• ff7a7fb Increase timeout for building wheels.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions