Skip to content

chore(deps): bump the backend-dependencies group across 1 directory with 20 updates - #2459

Closed
dependabot[bot] wants to merge 968 commits into
mainfrom
dependabot/pip/backend/main/backend-dependencies-9206f9b5f8
Closed

chore(deps): bump the backend-dependencies group across 1 directory with 20 updates#2459
dependabot[bot] wants to merge 968 commits into
mainfrom
dependabot/pip/backend/main/backend-dependencies-9206f9b5f8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Updates the requirements on fastapi, cryptography, uvicorn, pydantic, pydantic-settings, psycopg, redis, sse-starlette, python-multipart, aiosqlite, python-whois, openai, pytest, pytest-cov, ruff, pytest-asyncio, anyio, pip-audit, pyyaml and trio to permit the latest version.
Updates fastapi to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates cryptography to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates uvicorn to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

  • Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

  • Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

... (truncated)

Commits
  • ee8e45c Version 0.52.1 (#3056)
  • b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
  • 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
  • 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
  • 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
  • e148451 Handle connection loss during WebSocket write backpressure (#3050)
  • e16a69b Add missing write flow control to websockets-sansio (#3048)
  • ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
  • 8f1b884 Version 0.52.0 (#3044)
  • f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
  • Additional commits viewable in compare view

Updates pydantic to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • Additional commits viewable in compare view

Updates pydantic-settings to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

... (truncated)

Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates psycopg to 3.3.4

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.5 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
  • Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Current release

Psycopg 3.3.4 ^^^^^^^^^^^^^

  • Fix possible spurious connection timeout in systems with very long uptimes in C extension (:ticket:[#1280](https://github.com/psycopg/psycopg/issues/1280)).
  • Fix client-side adaptation of enums whose name require quotes (:ticket:[#1298](https://github.com/psycopg/psycopg/issues/1298)).
  • Consistently populate ~Cursor.statusmessage after ~Cursor.executemany() (:ticket:[#1302](https://github.com/psycopg/psycopg/issues/1302)).

Psycopg 3.3.3 ^^^^^^^^^^^^^

  • Retain Error.pgconn when raising a single exception for multiple connection attempt errors (:ticket:[#1246](https://github.com/psycopg/psycopg/issues/1246)).
  • Return a proper error when server sends ErrorResponse for a Sync after a Parse (:ticket:[#1260](https://github.com/psycopg/psycopg/issues/1260)).

Psycopg 3.3.2

... (truncated)

Commits
  • 83f1103 chore: bump psycopg_pool package version to 3.3.1
  • 1828770 chore: bump psycopg package version to 3.3.4
  • 8be14bb Merge pull request #1301 from oliverhaas/fix/sync-pool-open-race
  • aee0bf2 fix(pool): fix race in the construction of the sync ConnectionPool lock
  • bc4d303 chore(deps): bump the actions group across 1 directory with 4 updates
  • 785379f fix: retain statusmessage after executemany with returning=False
  • 8882a73 perf: do less if X in Y: return Y[X] for cache-like patterns
  • 2f78539 Merge pull request #1299 from dvarrazzo/fix-camel-enum
  • 37ef1dc test: skip test on crdb depending on precise regtype behaviour
  • 7f2f1d1 fix: fix client-side representation of enums requiring quotes
  • Additional commits viewable in compare view

Updates redis to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

  • Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).
  • Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).
  • Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).
  • Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).
  • Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).
  • Sentinel — replica sentinel aliases (#4127).

🚀 New Features

  • Add replica sentinel aliases (#4127)
  • Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)
  • feat: add TS.READ command support to the timeseries module (#4170)
  • feat: add SDIFFCARD and SUNIONCARD command support (#4171)
  • feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)
  • feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)
  • feat: add async maintenance-notifications support for standalone and cluster clients (#4177)
  • feat: add COLLECT reducer support to search aggregations (#4179)
  • feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)
  • feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)
  • feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

  • feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

  • fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)
  • Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits
  • e013126 Testing with 8.10 GA (#4227)
  • 059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
  • d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
  • fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
  • 9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
  • 14714a0 fix: Fixed double decoding issue with unquote() (#4222)
  • 227280a Update lib version to 8.1.0
  • 88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
  • 599fd75 feat: add FT.ALIASLIST support (#4198)
  • 71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
  • Additional commits viewable in compare view

Updates sse-starlette to 3.4.8

Release notes

Sourced from sse-starlette's releases.

v3.4.8

Full Changelog: sysid/sse-starlette@v3.4.7...v3.4.8

Commits
  • a815cd3 Bump version to 3.4.8
  • 79d7745 Bump version to 3.4.7
  • 5ee7ba5 Merge pull request #205 from sysid/dependabot/uv/cryptography-50.0.0
  • ae7c799 Merge pull request #203 from sysid/dependabot/uv/pyasn1-0.6.4
  • 2cded15 chore(deps): bump cryptography from 48.0.1 to 50.0.0
  • 1c41d17 chore(deps): bump pyasn1 from 0.6.3 to 0.6.4
  • c956ba3 Bump version to 3.4.6
  • 2dd7924 Merge pull request #202 from mahenzon/fix/deterministic-ping-tests
  • 6ffcd0d update test_sse: make ping tests independent of wall-clock timing
  • d630709 Merge pull request #200 from sysid/dependabot/github_actions/actions/checkout-7
  • Additional commits viewable in compare view

Updates python-multipart to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

  • Speed up partial-boundary scanning for CR/LF-dense part data #300.

0.0.31 (2026-06-04)

  • Speed up multipart header parsing and callback dispatch #295.
  • Bound header field name size before validating #296.
  • Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

  • Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.
  • Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.

0.0.29 (2026-05-17)

  • Handle malformed RFC 2231 continuations in parse_options_header #270.

0.0.28 (2026-05-10)

  • Speed up partial-boundary tail scan via bytes.find #281.
  • Cap multipart boundary length at 256 bytes #282.

0.0.27 (2026-04-27)

  • Add multipart header limits #267.
  • Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

  • Skip preamble before the first multipart boundary more efficiently #262.
  • Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

  • Add MIME content type info to File #143.
  • Handle CTE values case-insensitively #258.
  • Remove custom FormParser classes #257.
  • Add UPLOAD_DELETE_TMP to FormParser config #254.
  • Emit field_end for trailing bare field names on finalize #230.
  • Handle multipart headers case-insensitively #252.
  • Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

  • Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

... (truncated)

Commits
  • 238ead6 Version 0.0.32 (#302)
  • 8672979 Replace per-byte partial-boundary scan with rfind lookbehind (#300)
  • 8190779 Bump the python-packages group with 7 updates (#301)
  • 0d3c086 Use uv package ecosystem for Dependabot (#299)
  • 4cffc68 Version 0.0.31 (#298)
  • c814948 Reject negative Content-Length in parse_form (#297)
  • 6b837d4 Bound header field name size before validating (#296)
  • e0c4f9d Bump the github-actions group with 3 updates (#294)
  • b8a01bb Bump the python-packages group with 3 updates (#293)
  • 6732164 Speed up multipart header parsing and callback dispatch (#295)
  • Additional commits viewable in compare view

Updates aiosqlite to 0.22.1

Changelog

Sourced from aiosqlite's changelog.

v0.22.1

Bug fix release

NOTE: Starting with v0.22.0, the aiosqlite.Connection object no longer inherits from threading.Thread. If not using aiosqlite as a context manager, clients must await connection.close() or call connection.stop() to ensure the helper thread is completed and terminated correctly. A ResourceWarning will be emitted for any connection that is garbage collected without being closed or stopped.

  • Added synchronous stop() method to aiosqlite.Connection to enable safe cleanup and termination of the background thread without dependence on having an active event loop (#370)
$ git shortlog -s v0.22.0...v0.22.1
     2	Amethyst Reese

v0.22.0

Feature release

  • Support set_authorizer query access controls (#349)
  • Wait for transaction queue to complete when closing connection (#305)
  • Emit warning when connection goes out of scope without being closed (#355)
  • Remove dependency on typing_extensions (#365)
$ git shortlog -s v0.21.0...v0.22.0
     1	Alec Berryman
     1	Amethyst Reese
     1	David Andreoletti
     1	Markus Heidelberg
     1	beerpsi
    19	dependabot[bot]

v0.21.0

Maintenance release

  • Fix: close connection correctly when BaseException raised in connection (#317)
  • Metadata improvements

... (truncated)

Commits

Updates python-whois to 0.9.6

Commits

Updates openai to 2.53.0

Release notes

Sourced from openai's releases.

v2.53.0

2.53.0 (2026-08-03)

Features

  • api: Add gpt-5.5 and tool name/namespace to Responses types (#3569) (dd1202d)

Bug Fixes

  • ci: avoid NumPy source builds and duplicate HTTPX coverage (#3573) (b58332f)
Changelog

Sourced from openai's changelog.

2.53.0 (2026-08-03)

Features

  • api: Add gpt-5.5 and tool name/namespace to Responses types (#3569) (dd1202d)

Bug Fixes

  • ci: avoid NumPy source builds and duplicate HTTPX coverage (#3573) (b58332f)

2.52.1 (2026-07-31)

Full Changelog: v2.52.0...v2.52.1

Chores

  • ci: pin setup-uv v5 to its underlying commit (#3560) (cbdc98b)

2.52.0 (2026-07-31)

Full Changelog: v2.51.0...v2.52.0

Features

  • api: content provenance checks (

Rakshak05 and others added 30 commits July 1, 2026 22:04
@Rakshak05
tests(metasploit): add parser and metadata unit tests #1427 (#1527)
8441e05 
* Resolves issue-#1427

* Removes white spaces.
@Rakshak05
Resolves issue-#1426 (#1526)
a522725
@Rakshak05
Resolves issue-#1429 (#1529)
93d2b89
@tmdeveloper007
test: add executor extract_target unit tests via import-safe helper m…
a128b47 
…odule (#1524)

The extract_target helper in executor.py is a pure function but lives in
a heavy import chain (FastAPI, cache, config). Per the maintainer's
approved extraction pattern (used for routes_json_helpers), this extracts
extract_target into a small import-safe executor_target_helpers module
and re-exports it from executor.py so existing call sites keep working.

Closes #1389.

Co-authored-by: tmdeveloper007 <[email protected]>
@anshikaagr
ci: ignore local virtualenv directories (#1510)
8ec56fc
@Rakshak05
Resolves issue-#1423 (#1511)
db9aa8c
@sahare77
Fix #1170: Bottom section UI overlap/misalignment on Dashboard (mobil…
5681e24 
…e view) (#1513)
@sahare77
Fix #1488: Missing Rate Limiters on Management Endpoints (#1514)
1606c2c
@sahare77
Fix #1491: Unhandled Type Conversion and Logic Errors in Workflows (#…
00e5bd2 
…1515)
@sahare77
Fix #1490: Missing Validation for JSON Payload Contents (#1516)
8b35203
@Rakshak05
[PLUGINS] Add parser unit tests for httpx plugin #1425 (#1520)
060d620 
* Resolves issue-#1425

* Removed white spaces.
@Tomeshwari-02 Tomeshwari-02
docs: update browser auth session flow (#1555)
9edf153 
Co-authored-by: Tomeshwari-02 <[email protected]>
@deepsikha-dash
test(secret_scanner): add parser fallback coverage (#1556)
846d190
@Rafiaminhaj
feat(validation): introduce string length constraints on policy, prof…
604e4e5 
…ile, and workflow endpoints (#1557)
@tmdeveloper007
test: add unit tests for executor_target_helpers.extract_target (#1563)
5cb0dd4 
Co-authored-by: tmdeveloper007 <[email protected]>
@tmdeveloper007
test: add unit tests for wpscan plugin parser helpers (#1564)
09c55a7 
Co-authored-by: tmdeveloper007 <[email protected]>
@tmdeveloper007
test: add unit tests for hashcat plugin parser (#1565)
d95c69a 
Co-authored-by: tmdeveloper007 <[email protected]>
@tmdeveloper007
test: add unit tests for port-scanner plugin parser (#1566)
1369bac 
Co-authored-by: tmdeveloper007 <[email protected]>
@tmdeveloper007
test: add unit tests for virtual-host-finder plugin parser (#1567)
2a6adf7 
Co-authored-by: tmdeveloper007 <[email protected]>
@deepsikha-dash
feat(zap_scanner): replace placeholder connector with ZAP baseline co…
b64a68a 
…mmand
@ionfwsrijan
fix: sse toctou race (#1523)
4b7bdc0 
* fix: TOCTOU race condition in SSE task streaming causing indefinite connection hang

- Add _task_terminal flag to TaskExecutor, set on all terminal exit paths
- Clean up listener queues when task completes to prevent memory leaks
- Add post-subscribe status re-check in event_generator to close TOCTOU window
- Add 30s timeout on queue.get() to prevent indefinite blocking
- Handle TimeoutError by checking task status before continuing

Fixes #1484

* SSE TOCTOU: remove unused _task_terminal, add regression tests
@ionfwsrijan
fix: notification history bola (#1522)
a12f939 
* fix: add owner authorization to notification history endpoint (BOLA)

- Add owner: str = Depends(get_current_owner) to list_notification_history
- Add JOIN with notification_rules and WHERE nr.owner_id = ? filter to both
  the data query and the count query
- Add owner_id column to notification_history table schema
- Create migration 007 to backfill owner_id on existing rows

Fixes #1483

* Notification BOLA: add migration + tests for owner isolation
@ionfwsrijan
fix: concurrency limiter corruption (#1521)
74a3b0a 
* fix: add concurrent_limiter.acquire() before task execution in run_workflow_once and fix ordering in _run_workflow

- Add concurrent_limiter.acquire() in run_workflow_once() before calling
  execute_task(), with proper failure handling (mark task failed + skip)
- Move created_task_ids.append() to after the acquire succeeds in
  WorkflowScheduler._run_workflow() so failed acquires don't pollute
  the task list

Fixes #1482

* Add regression tests for workflow concurrency ordering

- test_acquire_before_execute_task: verifies concurrent_limiter.acquire
  is called before asyncio.create_task(executor.execute_task)
- test_rejected_acquire_marks_failed_and_skips_execution: rejected steps
  are marked failed and execute_task is not called
- test_rejected_acquire_does_not_block_accepted_tasks: one rejected step
  doesn't prevent subsequent steps from being processed
- test_scheduler_acquire_before_append_task_id: scheduler calls acquire
  before recording task_ids
- test_scheduler_rejected_task_not_in_created_ids: rejected task IDs are
  excluded from the created_task_ids list passed to record_workflow_run
@deepsikha-dash
test(yara_scan): add parser unit tests
f0cbdff
@jiya2401
test: add unit tests for useVirtualList hook behavior
b85d223
@jiya2401
fix: remove trailing whitespace
5d5cfc5
Tomeshwari-02
test: authenticate settings e2e via session check
cc4f9bc
Tomeshwari-02
fix: include credentials on task streams
d725d39
Tomeshwari-02
fix: log out during settings purge
5cb653c
Tomeshwari-02
test: include all Playwright e2e specs
76020b5
@dependabot dependabot Bot added python Pull requests that update python code dependencies Pull requests that update a dependency file labels Aug 4, 2026
aaniya22 and others added 2 commits August 5, 2026 13:00
@aaniya22
test: add _validate_lengths coverage
5267f90 
* test: add unit tests for _validate_lengths field length guard

Covers valid/boundary/over-limit cases for name, description, and
notes fields, plus custom resource_type substitution and None
handling for optional fields. Closes #2307.

* fix: bump undici to patch high-severity vulnerability (GHSA-8xcm-r25x-g524 and related)
@manassanjaymishra24
fix: persist system theme and harden frontend dependencies
c242c01 
* fix(theme): persist dark mode in localStorage and sync html class

* fix(deps): override undici to resolve npm audit vulnerability

* fix(deps): bump undici override to ^8.10.0 to resolve high severity audit vulnerability

* fix(deps): update jsdom to v25 and override undici for CI compatibility
utksh1
utksh1 approved these changes Aug 6, 2026
View reviewed changes

@utksh1 utksh1 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot backend dependency updates. Approved.

tmdeveloper007 and others added 18 commits August 6, 2026 14:17
@tmdeveloper007 Mavis Bot
test: add tests for rate_limiter.check_scan_rate_limit (closes #2446) (…
2f82738 
…#2451)

* test: add tests for rate_limiter.check_scan_rate_limit (closes #2446)

* test: fix sys.modules pollution in rate_limiter check_scan_rate_limit tests (closes #2446)

---------

Co-authored-by: Mavis Bot <[email protected]>
@utksh1
feat(frontend): add WebSocket hook and sanitization utility
c548731 
- Add useWebSocket hook for real-time task updates
- Add sanitizeRawOutput for secure scanner output rendering
- Update .gitignore to exclude SQLite temp files (*.db-shm, *.db-wal)
@utksh1
chore(scripts): add GitHub issue management automation
b97ece5 
- Add scripts for assigning issues to contributors
- Add script for closing low-quality/spam issues
- Include documentation and assignment summary
@utksh1
checkpoint: pre-ponytail audit
c66affb
@utksh1
chore: ponytail cleanup - remove 2,118 lines of dead code
650fa1d 
- Delete 8 entire files (duplicate/unused implementations)
- Delete 7 trivial test files
- Remove 7 unused npm packages (styled-components, react-icons, etc)
- Remove one-liner wrappers and dead code
- Net: -54 npm packages, -2,118 lines, 30-40% complexity reduction

Files deleted:
- scripts/enhance_github_issues_old.py (superseded)
- scripts/validate_plugin.py (duplicate)
- backend/secuscan/sandbox_executor.py (unused)
- frontend/src/components/I18nContext.tsx (no i18n)
- frontend/src/hooks/useVirtualList.ts (unused)
- frontend/src/hooks/useWebSocket.ts (unused)
- plugins/domain-finder/parser.py (duplicate)
- 7 trivial test helper files

Packages removed:
- @hugeicons/core-free-icons, @hugeicons/react
- react-icons, styled-components
- html2canvas, jspdf, cross-env

Generated by: ponytail-audit with 34 parallel subagents
See: PONYTAIL_AUDIT_REPORT.md for 345 total findings
@utksh1
fix: remove cross-env from test scripts
b7da6d1
@utksh1
fix: remove I18nContext import after cleanup
1961704
@utksh1
chore: phase 2 config cleanup - remove 6 dead flags
212e24d 
- Delete parser_hash_algorithm (never used)
- Delete network_audit_retention_days (never referenced)
- Delete sandbox_allow_network (unused flag)
- Delete notification_ssrf_enabled (always mandatory)
- Delete notification_blocked_ip_ranges (duplicate of MANDATORY_DENYLIST)
- Delete base_url property (redundant with public_base_url)

Replace notification_blocked_ip_ranges with MANDATORY_DENYLIST throughout.
Inline base_url in main.py debug endpoint.

Lines removed: ~25
Risk: Zero (dead code)
@utksh1
refactor(remediation): inline normalize_package_name and clean_versio…
dbc9ef4 
…n_string helpers

- Remove normalize_package_name() wrapper (3 lines)
- Remove clean_version_string() wrapper (10 lines)
- Inline re.sub pattern for package normalization (7 uses)
- Inline version cleaning logic with direct regex match
- Total: 13 lines removed

Phase 10 complete: 1,062 lines removed (49% of 2,166-line goal)
@utksh1
refactor(executor): inline _resolve_execution_timeout, _classify_comm…
726b042 
…and_result, _build_severity_counts

- Remove _resolve_execution_timeout() wrapper (3 lines)
- Remove _classify_command_result() helper (18 lines)
- Remove _build_severity_counts() helper (7 lines)
- Inline timeout resolution with direct dict.get chain (1 use)
- Inline status classification with ternary expression (1 use)
- Inline severity counting with dict comprehension (3 uses)
- Total: 28 lines removed

Phase 11 complete: 1,090 lines removed (50.3% of 2,166-line goal)
@utksh1
chore: phase 3 cleanup - remove unused helpers and stats
f4d97ce 
- Delete get_plugin_check_latency_ms() (unused micro-benchmark)
- Delete _is_absolute_path() (use Path.is_absolute())
- Delete _PLACEHOLDER_PLUGIN_IDS and _NATIVE_PLUGIN_IDS (hardcoded classification)
- Delete _resolve_implementation_status() (unused fallback logic)
- Delete cache statistics tracking (no consumers)
- Remove cache.url parameter (unused)

Lines removed: ~50
Risk: Zero (dead code)
@utksh1
refactor(executor): remove _resolve_execution_timeout, _classify_comm…
aada003 
…and_result, _build_severity_counts

- Delete _resolve_execution_timeout() (16 lines) - inlined at call site
- Delete _classify_command_result() (51 lines) - inlined with ternary
- Delete _build_severity_counts() (7 lines) - inlined at 3 call sites
- Total: 74 lines removed

Phase 11 complete: 1,090 lines removed (50.3% of goal)
50% MILESTONE REACHED
@utksh1
refactor(executor): complete helper function removal
5c14f5a 
- Inline _resolve_execution_timeout with min() at call site
- Inline _build_severity_counts at 2 remaining call sites
- Remove _resolve_execution_timeout (16 lines)
- Remove _classify_command_result (51 lines)
- Remove _build_severity_counts (7 lines)
- Total: 74 lines removed

Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal)
🎉 EXCEEDED 50% MILESTONE
@utksh1
refactor(executor): remove all helper functions - Phase 11 complete
6d57e1c 
- Inline _resolve_execution_timeout at call site (1 use)
- Inline _build_severity_counts at call sites (2 uses)
- Remove _resolve_execution_timeout function (16 lines)
- Remove _classify_command_result function (51 lines)
- Remove _build_severity_counts function (7 lines)
- Total: 74 lines removed

🎉 Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal)
🎉 EXCEEDED 50% MILESTONE by 98 lines
@utksh1
chore: phase 4 cleanup - remove wildcard network patterns
3674d35 
- Delete allowed_networks wildcard system (redundant with network_allowlist CIDR)
- Delete _net_within_allowed_networks() helper
- Delete parse_csv_or_list validator (Pydantic handles CSV natively)
- Update routes.py to expose network_allowlist/denylist instead

Lines removed: ~20
Risk: Zero (wildcard system unused, CIDR system is primary)
@utksh1
refactor(executor): inline _deserialize_finding_rows and _normalize_a…
db57f72 
…sset_service_record

- Inline _deserialize_finding_rows at call site (1 use)
- Inline _normalize_asset_service_record in list comprehension (1 use)
- Remove _deserialize_finding_rows function (20 lines)
- Remove _normalize_asset_service_record function (15 lines)
- Total: 35 lines removed

Progress: 1,199 lines removed (55.4% of goal)
@utksh1
refactor: minimize obvious docstrings and comments across entire code…
88a92cd 
…base
@dependabot
chore(deps): bump the backend-dependencies group across 1 directory w…
21e92c8 
…ith 20 updates

Updates the requirements on [fastapi](https://github.com/fastapi/fastapi), [cryptography](https://github.com/pyca/cryptography), [uvicorn](https://github.com/Kludex/uvicorn), [pydantic](https://github.com/pydantic/pydantic), [pydantic-settings](https://github.com/pydantic/pydantic-settings), [psycopg](https://github.com/psycopg/psycopg), [redis](https://github.com/redis/redis-py), [sse-starlette](https://github.com/sysid/sse-starlette), [python-multipart](https://github.com/Kludex/python-multipart), [aiosqlite](https://github.com/omnilib/aiosqlite), [python-whois](https://github.com/richardpenman/whois), [openai](https://github.com/openai/openai-python), [pytest](https://github.com/pytest-dev/pytest), [pytest-cov](https://github.com/pytest-dev/pytest-cov), [ruff](https://github.com/astral-sh/ruff), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio), [anyio](https://github.com/agronholm/anyio), [pip-audit](https://github.com/pypa/pip-audit), [pyyaml](https://github.com/yaml/pyyaml) and [trio](https://github.com/python-trio/trio) to permit the latest version.

Updates `fastapi` to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.115.0...0.141.1)

Updates `cryptography` to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@42.0.0...50.0.0)

Updates `uvicorn` to 0.52.1
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.30.6...0.52.1)

Updates `pydantic` to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.8.2...v2.13.4)

Updates `pydantic-settings` to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.6.0...v2.15.0)

Updates `psycopg` to 3.3.4
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.0...3.3.4)

Updates `redis` to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v5.2.1...v8.1.0)

Updates `sse-starlette` to 3.4.8
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v2.1.0...v3.4.8)

Updates `python-multipart` to 0.0.32
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.9...0.0.32)

Updates `aiosqlite` to 0.22.1
- [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md)
- [Commits](omnilib/aiosqlite@v0.20.0...v0.22.1)

Updates `python-whois` to 0.9.6
- [Commits](https://github.com/richardpenman/whois/commits)

Updates `openai` to 2.53.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v1.0.0...v2.53.0)

Updates `pytest` to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.3.5...9.1.1)

Updates `pytest-cov` to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v6.0.0...v7.1.0)

Updates `ruff` to 0.16.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.12...0.16.2)

Updates `pytest-asyncio` to 1.4.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v0.24.0...v1.4.0)

Updates `anyio` to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.0.0...4.14.2)

Updates `pip-audit` to 2.10.1
- [Release notes](https://github.com/pypa/pip-audit/releases)
- [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md)
- [Commits](pypa/pip-audit@v2.6.0...v2.10.1)

Updates `pyyaml` to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0...6.0.3)

Updates `trio` to 0.33.0
- [Release notes](https://github.com/python-trio/trio/releases)
- [Commits](python-trio/trio@v0.27.0...v0.33.0)

---
updated-dependencies:
- dependency-name: aiosqlite
  dependency-version: 0.22.1
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: openai
  dependency-version: 2.52.0
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: pip-audit
  dependency-version: 2.10.1
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: psycopg
  dependency-version: 3.3.4
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: pydantic-settings
  dependency-version: 2.14.2
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: pytest-asyncio
  dependency-version: 1.4.0
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: python-whois
  dependency-version: 0.9.6
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: sse-starlette
  dependency-version: 3.4.6
  dependency-type: direct:production
  dependency-group: backend-dependencies
- dependency-name: trio
  dependency-version: 0.33.0
  dependency-type: direct:development
  dependency-group: backend-dependencies
- dependency-name: uvicorn
  dependency-version: 0.52.0
  dependency-type: direct:production
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot changed the title chore(deps): bump the backend-dependencies group in /backend with 20 updates chore(deps): bump the backend-dependencies group across 1 directory with 20 updates Aug 11, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/backend/main/backend-dependencies-9206f9b5f8 branch from 55d024c to 21e92c8 Compare August 11, 2026 15:06
@utksh1 utksh1 closed this Aug 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 15, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/backend/main/backend-dependencies-9206f9b5f8 branch August 15, 2026 18:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@utksh1 utksh1 utksh1 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.