chore(deps): update code dependencies (dev) #17
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: beaver/beavergram#17
Reference in new issue
Block a user
This PR contains the following updates:
1.18.4→1.20.00.31.0→0.32.00.136.3→0.142.43.3.1→3.4.83.5.1→3.5.62.2.23→2.2.262.14.1→2.15.00.0.38→0.0.480.48.0→0.54.00.22.1→0.23.0Release Notes
MagicStack/asyncpg (asyncpg)
v0.32.0Compare Source
Improvements
Support Python 3.15 (#1367, #1378)
(by @elprans in
1b11846and58c0c59)Support PostgreSQL 19 (#1379)
(by @elprans in
8d2a5ae)Make pool
min_sizea maintained connection floor and addinit_sizetocontrol the number of connections opened at startup (#1323).
Idle connections at or below
min_sizeare retained, and closed connectionsare replaced in the background.
init_sizedefaults tomin_size.To preserve the previous behavior, where the pool could drain to zero,
replace
min_size=Nwithinit_size=N, min_size=0.(by @shatilov-diman in
67a1cbc)Use
hashlib.pbkdf2_hmac()for faster SCRAM password derivation (#1359)(by @twelfthlabor in
00319a9)Use the statement cache for
copy_records_to_table()introspection (#1360)(by @matemax in
dd05865)Fixes
Clean up connections rejected by
target_session_attrsimmediately so anunresponsive rejected host cannot delay the selected connection, and cleanup
tasks cannot outlive the event loop. Rejected connections are aborted without
waiting for a graceful disconnect; servers may log "unexpected EOF on client
connection" if the Terminate message is not delivered before the transport
closes.
Fix a connection pool deadlock when releasing a connection after a protocol
abort (#1324)
(by @pchaseh in
4a83cc2)Honor
Connection.close(timeout=...)while waiting for a pendingcancellation (#1361)
(by @gyanu2507 in
c06bcb4)Prevent stuck cancellation from blocking connection teardown or pool release
by bounding cancellation with the command or release timeout (#1370)
(by @elprans in
4cf0220)Preserve the server error when the connection closes mid-operation (#1369)
(by @RitiGrover in
6c8f1a7)Fix COPY cleanup when a records generator raises, preserving the original
exception and avoiding protocol desynchronization and stalled rollback (#1358)
(by @CodingCossack in
fdc6bc8)Reparse unnamed statements before cursor binding when the statement cache
is disabled (#1364)
(by @elprans in
302ba49)Allow cursors in transactions started outside
Connection.transaction(),such as with an explicit
BEGIN(#1350)(by @aryansk in
25aaaf5)Remove the query logger when the
query_logger()block raises (#1373)(by @kratos0718 in
6a7fbd3)Fix a segfault in
Record.get()with an invalid number of positionalarguments (#1333)
(by @apoorvdarshan in
40a3832)Align SSL startup retries with libpq and improve SSL rejection diagnostics
(#1366). Retry alternative transports only before authentication succeeds.
Direct TLS now requires
sslmode=require,verify-ca, orverify-full,or an explicit
SSLContext.(by @elprans in
78752c9)Preserve password errors during SSL fallback when the fallback fails with
a less specific authorization error (#1331)
(by @Mauricio0129 in
2d97947)Handle cleartext password authentication when no password is supplied
without raising an
AttributeError(#1351)(by @aryansk in
6be5915)Set the
postgresqlALPN protocol on SSL contexts created by asyncpg sodirect TLS connections work with PostgreSQL 17 and later (#1372).
User-provided contexts must set this protocol for direct TLS connections.
(by @DurandA in
b21325d)Link explicitly against
libmon non-Windows platforms to fix undefinedmath symbol errors when loading the extensions (#1305)
(by @veeceey in
db8ecc2)Fix builds on FreeBSD 15 by linking against
libstdthreads(#1368)(by @elprans in
87bcaf9)Other
Replace
pkg_resourceswithpackaginginsetup.py(#1362)(by @elprans in
6695db7)Build Linux and macOS ARM64 wheels on native runners and add Windows ARM64
wheel builds (#1308)
(by @ddelange in
1e8cc1c)Add manual and PR-label-triggered dry runs to the release workflow (#1374)
(by @elprans in
1bd643e)Clarify how
execute()uses prepared statements and how to confirm anINSERTin the documentation (#1336)(by @pctablet505 in
cdf816c)Fix typos in comments and docstrings (#1332)
(by @maxtaran2010 in
bc3e246)fastapi/fastapi (fastapi)
v0.142.4Compare Source
Fixes
v0.142.3Compare Source
Fixes
Docs
Translations
Internal
bump-pre-commit-hooksworkflow. PR #16463 by @YuriiMotov.gpt-6-astramodel for translations. PR #16453 by @YuriiMotov.v0.142.2Compare Source
Fixes
v0.142.1Compare Source
Fixes
v0.142.0Compare Source
Features
Refactors
Docs
Translations
Internal
setup-uvaction to10.0.1. PR #16249 by @YuriiMotov.commit_in_placeinput intranslate.yml. PR #16216 by @YuriiMotov.zizmor.ymlworkflow (main->master). PR #16178 by @YuriiMotov..cacheinbuild-docs.yml. PR #16156 by @YuriiMotov.v0.141.1Compare Source
Fixes
app.frontend(). PR #16105 by @tiangolo.Docs
FASTAPI_ENVin FastAPI CLI guide. PR #16104 by @tiangolo.v0.141.0Compare Source
Features
app.frontend(check_dir="auto"), to make local development more convenient withfastapi dev. PR #16102 by @tiangolo.v0.140.13Compare Source
Fixes
status_codebeing ignored for SSE and JSONL streaming endpoints. PR #15937 by @SAURABHSALVE.Docs
format_sse_eventdocstring rendering of\n\nterminator. PR #15613 by @AshNicolus.v0.140.12Compare Source
Fixes
format_sse_eventto comply with SSE spec. PR #15515 by @Zawwarsami16.v0.140.11Compare Source
Fixes
response_model_*params ignored for non-generator endpoints withIterable[..]return type. PR #15093 by @YuriiMotov.v0.140.10Compare Source
Fixes
Internal
v0.140.9Compare Source
Fixes
exclude_defaultsnot propagated to dict keys and values injsonable_encoder. PR #16043 by @MBGrao.Internal
v0.140.8Compare Source
Fixes
include_router(). PR #15077 by @alex-raw.v0.140.7Compare Source
Refactors
Internal
v0.140.6Compare Source
Refactors
v0.140.5Compare Source
Refactors
v0.140.4Compare Source
Refactors
v0.140.3Compare Source
Refactors
v0.140.2Compare Source
Refactors
Internal
v0.140.1Compare Source
Refactors
v0.140.0Compare Source
Refactors
Docs
Internal
v0.139.2Compare Source
Fixes
v0.139.1Compare Source
Fixes
/users/john.doe. PR #16011 by @tiangolo.Docs
skip_usersnot being applied. PR #15995 by @YuriiMotov.Translations
llm-prompt.mdfor Hindi. PR #15810 by @YuriiMotov.Internal
FASTAPI_LATEST_CHANGEStoken inbump-pre-commit-hooksworkflow. PR #15984 by @YuriiMotov.v0.139.0Compare Source
Features
app.frontend(), e.g. for automatic cookie authentication for the frontend. PR #15908 by @tiangolo.Translations
Internal
allow-unsafe-pr-checkout: true. PR #15876 by @YuriiMotov.v0.138.2Compare Source
Refactors
app.frontend()return 404 for methods other thanGETorHEADwith no static file matches. PR #15863 by @tiangolo.Internal
v0.138.1Compare Source
Refactors
Internal
v0.138.0Compare Source
Features
app.frontend("/", directory="dist")androuter.frontend("/", directory="dist"). PR #15800 by @tiangolo.Docs
app.frontend()instructions to Agent Library Skill. PR #15805 by @tiangolo.Translations
Internal
release-notes.mdfor typos. PR #15796 by @YuriiMotov.gpt-5.5model intranslate.py, specify-chatto avoid warnings. PR #15792 by @YuriiMotov.v0.137.2Compare Source
Features
iter_route_contexts()for advanced use cases that used to userouter.routes(e.g. Jupyverse). PR #15785 by @tiangolo.Translations
Internal
coverage.sh. PR #15772 by @tiangolo.v0.137.1Compare Source
Fixes
v0.137.0Compare Source
Breaking Changes
APIRouterandAPIRouteinstances. PR #15745 by @tiangolo.Unblocks ✨ SO MANY THINGS ✨
Before this,
router.include_router(other_router)would take each path operation fromother_routerand "clone" it, or recreate it from scratch.This would mean that in the end there was only one top level router, part of the app.
The way it is structured here is that there are a few additional classes to handle intermediate metadata for router and route inclusion. That way the information of "router X includes Y and Y includes Z" is stored somewhere, without affecting (recreating / clonning) the final route.
Non Objectives
Dependencies for 404: previously I intended to support dependencies that would be executed even for 404, but that would conflict with the fact that a router could not find a match, but the next router did find a match. Executing dependencies in the router that did not find a match would not make sense, they could consume the request, body, etc. This original idea was discarded.
Specific Breaking Changes
Now
router.routesis no longer a plain list ofAPIRouteobjects, it can contain these intermediate objects that can contain additional routers, forming a tree.Any logic that depended on iterating on the
router.routesdirectly would be affected, that logic cannot expect to be able to extract data from a plain list of routes, as it's no longer a plain list but a tree.Additionally, any logic that iterated on
router.routesto modify them would now also see these new objects, and would not see all the routes in the app.router.routesshould be considered an internal implementation detail, only passed around to the FastAPI functions that need it.Features
subrouterinmainroutercan be done before adding routes (path operations) tosubrouter, because now the the entire object is stored instead of copying the routes.Alpha Features
This is not documented yet, so it's not officially supported yet and could change in the future.
But, as
APIRouteandAPIRouterinstances are now preserved, they could be customized.APIRouterhas two new methods,.matches()and.handle(), counterpart to the existing ones inAPIRoute. With this a router could customize how it matches and handles requests. For example, it could match only requests that include some specific header, for example for handling versions in headers.Still, for now, consider this very experimental and potentially changing and breaking in the future.
Future Features Enabled
APIRoutesubclasses (undocumented, but alraedy works as desccribed above)APIRoutersubclasses (undocumented, but already works as described above)Docs
Annotatedin inline example indocs/en/docs/tutorial/body-multiple-params.md. PR #15591 by @TheArchons.docs/en/docs/tutorial/security/oauth2-jwt.md. PR #14781 by @zadevhub.Translations
Internal
changing_dirinstead ofCLIRunner.isolated_filesystemto set working dir. PR #15616 by @YuriiMotov.httpx2test dependency to avoid deprecation warning. PR #15603 by @YuriiMotov.PrefectHQ/fastmcp (fastmcp)
v3.4.8: : Long Arm of the PatchCompare Source
This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 2 contributors.
What's Changed
Security 🔒
Docs 📚
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.7...v3.4.8
v3.4.7: : Know Your AudienceCompare Source
FastMCP 3.4.7 restores CIMD
private_key_jwtauthentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.What's Changed
Security 🔒
Docs 📚
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7
v3.4.6: : Trust, but ProxyCompare Source
FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.
What's Changed
Fixes 🐞
Docs 📚
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6
v3.4.5: : Key ChangeCompare Source
FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single
Ed25519key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — madeJWTVerifierreject every token, including ones correctly signed by supported keys in the same set.What's Changed
Fixes 🐞
Docs 📚
New Contributors
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5
v3.4.4: : Host in TranslationCompare Source
FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.
What's Changed
Enhancements ✨
Fixes 🐞
Docs 📚
New Contributors
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.3...v3.4.4
v3.4.3: : The Fast and the Secure-iousCompare Source
FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.
What's Changed
Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾
New Contributors
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3
v3.4.2: : Heads UpCompare Source
FastMCP 3.4.2 restores JWT compatibility for providers that include private, non-critical JWS header parameters. Tokens from providers like Clerk can carry header metadata such as
catwithout being rejected before signature and claim validation, while unsupported critical headers are still rejected.What's Changed
Fixes 🐞
Docs 📚
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.1...v3.4.2
v3.4.1: : Floor ItCompare Source
FastMCP 3.4.1 floors Starlette at
>=1.0.1so installs can no longer resolve to a version affected by CVE-2026-48710 — previously the dependency was only constrained transitively throughmcp, which allowed vulnerable versions. It also makes OAuthProxy log refresh-token cache misses instead of failing silently.What's Changed
Enhancements ✨
Security 🔒
Docs 📚
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.0...v3.4.1
v3.4.0: : Remote ControlCompare Source
FastMCP 3.4 is about reaching servers that live somewhere else. The headline is
fastmcp-remote, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, this release hardens the proxy layer those remote connections depend on — making bridges fail loudly instead of silently, and keeping authenticated sessions alive across the long idle periods that remote clients are prone to.fastmcp-remote
Some MCP hosts still insist on launching a local stdio command, even when the server you want is already running over HTTP. FastMCP could already proxy a remote URL through
fastmcp run, but that pulls in the full server-runner surface.fastmcp-remoteis the small, single-purpose version: one URL in, one local stdio proxy out.OAuth is enabled automatically for HTTPS servers, with support for explicit bearer tokens and custom headers when you need them. The implementation stays on FastMCP primitives —
Client, OAuth,create_proxy, and stdio — and credits the original npmmcp-remoteproject for the command shape.Bridges That Fail Loudly
Proxies are lazy bridges: they don't touch the upstream server during construction, but they do forward real MCP requests once a client connects. As of 3.4,
initializeis part of that forwarded surface — so a proxy only reports a successful handshake after the upstream server initializes too. A missing backend, a wrong URL (the server root instead of/mcp), denied upstream auth, or a non-MCP upstream now fails the downstreaminitializeinstead of producing a "connected" proxy whose capability fetches quietly come back empty. The proxy also forwardspingupstream now.This is an intentional behavior change from 3.3, and the reason bridge callers like
fastmcp-remotesurface real upstream failures instead of degrading into empty tool lists.Auth That Survives Idle Time
Remote sessions sit idle, and short-lived upstream tokens punish that.
fastmcp_access_token_expiry_secondsdecouples the FastMCP-issued token's lifetime from the upstreamexpires_in— the FastMCP token is just a reference into proxy storage, re-validated and transparently refreshed on every request, so it can safely outlive a 5-minute upstream token without forcing a full OAuth flow after every idle period. When the upstream issues no refresh token, the lifetime is capped to match.Alongside it,
token_expiry_threshold_secondstreats tokens as expired N seconds early to close refresh races, andWorkOSProvidergainsvalid_scopesandextra_authorize_params.Returnable Tool Errors
A tool could previously only signal an error by raising, which flattens to a text-only result and discards structured content.
ToolResultnow acceptsis_error, mapping toCallToolResult.isErrorso a tool can hand back a rich error the model can see and act on. The proxy uses this to forward upstream tool errors intact instead of collapsing them.Code Mode: Safe by Default
MontySandboxProvider()now applies a conservative baseline when constructed without limits — 30s duration, 100 MB memory — andCodeModecaps tool calls at 50 perexecuteblock. Both remain explicitly opt-out (limits=None,max_tool_calls=None), so the safe configuration is the default instead of something you had to remember to turn on.Under the Hood
The auth stack migrated its JWT handling to
joserfc. Thefastmcpdev CLI gains--hostand--log-panel/--no-log-panel. Resources created from templates now preserve annotations, meta, title, and icons; resource templates with query params work on proxied servers; OTEL spans cover the sampling step and tool execution; MCP config files are read as UTF-8; and the OAuth server metadata endpoint now answers at the/.well-known/openid-configurationalias.8 new contributors this release.
What's Changed
New Features 🎉
Breaking Changes ⚠️
Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾
New Contributors
Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.3.1...v3.4.0
python-greenlet/greenlet (greenlet)
v3.5.6Compare Source
==================
unintentionally being disabled. See
PR 529 <https://github.com/python-greenlet/greenlet/pull/529>_ by Yurii.v3.5.5Compare Source
==================
Appveyor builds did through 3.3.0. Since 3.3.1
_greenlet.pydimported
MSVCP140.dll, which no Windows CPython distribution ships,so importing greenlet failed on machines without the Visual C++
redistributable. See
issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issueand pull request by Daniel Sticker.
.. note::
Binary 3.15 wheels are now built with 3.15.0rc1. This should be
compatible with future 3.15 releases and is believed compatible
with 3.15b4 as well (but not earlier versions).
v3.5.4Compare Source
==================
Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.Thanks to ddorian and Kumar Aditya.
Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a
_PyCStackRef(for example, mid attributeresolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.Thanks to ddorian and Kumar Aditya.
Fix a deadlock on free-threaded builds when a greenlet switch happened
while a
PyCriticalSectionwas held -- for example inside asyncio'sTask.__step, which holds one on the running task for the duration ofthe step. See
PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
v3.5.3Compare Source
==================
Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.Thanks to ddorian and Kumar Aditya.
Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a
_PyCStackRef(for example, mid attributeresolution). See
issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_.Thanks to ddorian and Kumar Aditya.
Fix a deadlock on free-threaded builds when a greenlet switch happened
while a
PyCriticalSectionwas held -- for example inside asyncio'sTask.__step, which holds one on the running task for the duration ofthe step. See
PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>.Thanks to ddorian and Kumar Aditya.
.. note::
Binary 3.15 wheels are now built with Python 3.15b4. These may not
be compatible with earlier or later versions of 3.15. Binary
3.15 wheels of greenlet from previous releases (e.g., 3.5.3)
may not be compatible with Python 3.15b4.
v3.5.2Compare Source
==================
3.15. Thanks to Kumar Aditya in
PR #​511 <https://github.com/python-greenlet/greenlet/pull/511>_.Python 3.15. Thanks to Kumar Aditya in
PR #​512 <https://github.com/python-greenlet/greenlet/pull/512>_.KurimuzonAkuma/pyrogram (kurigram)
v2.2.26Compare Source
What's Changed
WINDOWflow control and per-kind proxy types by @Danipulok in kurigram-org/kurigram#364ee) secrets by @Danipulok in kurigram-org/kurigram#365ruffcheck, run frommake lintin CI andpre-commitby @Danipulok in kurigram-org/kurigram#366tests/unitortests/integrationsby @Danipulok in kurigram-org/kurigram#372JsonValueininit_connection_paramsby @Danipulok in kurigram-org/kurigram#367Message.topicalso holds aDirectMessagesTopicby @Danipulok in kurigram-org/kurigram#368Optionalfrom two_parse()helpers that always return an object by @Danipulok in kurigram-org/kurigram#369mypyreads as a# type:comment by @Danipulok in kurigram-org/kurigram#370MessageGenerationStoppedby @Danipulok in kurigram-org/kurigram#374save_file()used to log and hide by @Danipulok in kurigram-org/kurigram#373Noneback fromget_users()when the id belongs to no user by @Danipulok in kurigram-org/kurigram#378get_chat_admins_with_invite_links()handingtypes.Listan async generator by @Danipulok in kurigram-org/kurigram#379NOTE:prefix and the dashes standing in for punctuation by @Danipulok in kurigram-org/kurigram#380effect_idandis_enabledtoNone, not to theNoneTypeclass by @Danipulok in kurigram-org/kurigram#390reply_*/answer_*shortcuts by @Danipulok in kurigram-org/kurigram#391AsyncGenerator[T, None], notAsyncIterator[T]by @Danipulok in kurigram-org/kurigram#392KeyboardInlineButtonRowinReplyInlineMarkupby @Danipulok in kurigram-org/kurigram#396handlersonly when it is a list of handler pairs by @Danipulok in kurigram-org/kurigram#397stop()spawned instead of orphaning them by @Danipulok in kurigram-org/kurigram#398restart()from reconnecting a stopped session by @Danipulok in kurigram-org/kurigram#399repr()of aListwork for items that are notObjects by @Danipulok in kurigram-org/kurigram#401save_file()andInputChatPhoto.write()actually return by @Danipulok in kurigram-org/kurigram#403@Client.on_*()call declares by @Danipulok in kurigram-org/kurigram#402Updates by @Danipulok in kurigram-org/kurigram#405selfon thesave_file()overloads as the implementation does by @Danipulok in kurigram-org/kurigram#410Optionalwhere the default rules outNoneby @Danipulok in kurigram-org/kurigram#412tests/guardslayer by @Danipulok in kurigram-org/kurigram#413FakeClientby @Danipulok in kurigram-org/kurigram#414uv, dropping the hand-builtvenvandhatchby @Danipulok in kurigram-org/kurigram#415<=ceiling with a tested>=floor by @Danipulok in kurigram-org/kurigram#4193.10, dropping3.8and3.9by @Danipulok in kurigram-org/kurigram#421--used as punctuation in a comment by @Danipulok in kurigram-org/kurigram#439__all__rule the public exports guard enforces by @Danipulok in kurigram-org/kurigram#440kurigram[qrcode]extra when QR login cannot import it by @Danipulok in kurigram-org/kurigram#442restoremapping inedit_user_star_subscription()by @Danipulok in kurigram-org/kurigram#444StopIterationwhenclick()looks a button up by label by @Danipulok in kurigram-org/kurigram#448is_compactparameter in InputRichBlockTable and RichBlockTable by @deblomperrr in kurigram-org/kurigram#409str | Pathupload hints with aPathTypealias by @Danipulok in kurigram-org/kurigram#452InlineKeyboardButtonfields off the objects that hold them by @Danipulok in kurigram-org/kurigram#453LoginUrl.request_write_accessas theboolthe schema declares by @Danipulok in kurigram-org/kurigram#454New Contributors
Full Changelog: https://github.com/kurigram-org/kurigram/compare/v2.2.25...v2.2.26
v2.2.25Compare Source
What's Changed
workdirby @Danipulok in KurimuzonAkuma/kurigram#339NoneasOptionalby @Danipulok in KurimuzonAkuma/kurigram#343saved_peer_idin a direct-messages chat by @Danipulok in KurimuzonAkuma/kurigram#350flags.N?Vectorthe flags call absent by @Danipulok in KurimuzonAkuma/kurigram#352Messageby @Danipulok in KurimuzonAkuma/kurigram#346Nones by @Danipulok in KurimuzonAkuma/kurigram#341business,linked_channelandtopicread the message an update is about by @Danipulok in KurimuzonAkuma/kurigram#354Forbidden, and annotateRPCErrorby @Danipulok in KurimuzonAkuma/kurigram#353messages.GetSplitRangesresult by @ZeN220 in KurimuzonAkuma/kurigram#358New Contributors
Full Changelog: https://github.com/KurimuzonAkuma/kurigram/compare/v2.2.24...v2.2.25
v2.2.24Compare Source
What's Changed
Full Changelog: https://github.com/KurimuzonAkuma/kurigram/compare/v2.2.23...v2.2.24
pydantic/pydantic-settings (pydantic-settings)
v2.15.0Compare Source
Highlights
Behavior changes
case_sensitivenow applies to init kwargs and config-file sources (#900).InitSettingsSourceand the JSON/TOML/YAML config sources previously ignoredcase_sensitive. Since it defaults toFalse, case-insensitive matching is now the default for these sources — e.g.Settings(TeSt=...)now populates atestfield where it previously did not. Nested keys are still matched case-sensitively.IncompleteFieldDefinitionWarningtelling you to callmodel_rebuild(). If you havefilterwarnings = errorconfigured, this may surface as a new failure.ValidationError(#926) instead of a less specific error.New features
cli_show_env_vars=True(#860), so generated--helpoutput doubles as configuration documentation.PYDANTIC_SETTINGS_DEBUGfor debugging settings resolution (#906, #913). Set it to a truthy value withDEBUGlogging enabled to see each source's contribution in priority order, which source won for each value, and whichenv_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my.envbeing picked up?" question.toml_table_headerfor regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not justpyproject.toml.Traversablesupport for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — viaimportlib.resources.files(...)without casting toPath.project_idcan come from an earlier settings source (#878), rather than only from the constructor orGOOGLE_CLOUD_PROJECT.Bug fixes
case_sensitive=True(#894). Windows upper-casesos.environkeys, so fields raisedField requiredinstead of picking up their values.AliasPathon nested model fields not JSON-decoding env values (#898).dbx_tokenbeing swallowed by adb: dictfield.nested_model_default_partial_update=Truecorrupting discriminated unions (#876).Secretsubclasses crashing when loaded from the environment (#920).Optional[Annotated[MyEnum, ...]]withenv_parse_enums=True(#910).yaml_config_sectionnow falls back to defaults instead of raisingAttributeError: 'NoneType' object has no attribute 'keys'(#914).NestedSecretsSettingsSourceno longer follows symlinks pointing outsidesecrets_dir(#889).list_secretscall whencase_sensitive=True(#862), lowering the required IAM permissions to justroles/secretmanager.secretAccessor.types-boto3[secretsmanager]is no longer required at runtime (#880).Documentation
All changes (including dependency bumps and internal maintenance)
What's Changed
New Contributors
Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.15.0
v2.14.2Compare Source
What's Changed
This is a security patch release.
NestedSecretsSettingsSourcefrom following symlinks outsidesecrets_dirby @hramezani in #889Security
Fixes GHSA-4xgf-cpjx-pc3j:
NestedSecretsSettingsSourcewithsecrets_nested_subdir=Truecould follow a symbolic link insidesecrets_dirpointing outside it, reading out-of-tree files into settings values and bypassing thesecrets_dir_max_sizecap. Affected versions:>= 2.12.0, < 2.14.2.Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2
fastapi/sqlmodel (sqlmodel)
v0.0.48Compare Source
Features
Internal
v0.0.47Compare Source
Features
v0.0.46Compare Source
Fixes
v0.0.45Compare Source
Breaking Changes
datetimefields now useUTCDateTime, a custom type based onDateTime(timezone=True). It requires aware datetime parameters, normalizes them to UTC, and returns aware UTC values from database reads, including on SQLite and MySQL/MariaDB. Pydantic'sAwareDatetimeuses the same type, whileNaiveDatetimeexplicitly selectsDateTime(timezone=False). Plaindatetimevalidation still accepts both aware and naive values, but naive database parameters now raise an error.Existing databases are not changed automatically. To retain naive storage, use
NaiveDatetimeor an explicitField(sa_type=DateTime(timezone=False)). Explicit SQLAlchemy types retain their existing behavior. PostgreSQL needs a column migration that explicitly specifies the timezone of existing values. SQLite and MySQL/MariaDB keep their column definitions, but existing non-UTC values need a data migration before adopting the new type. Update datetime producers, query parameters, comparisons, and any database defaults to follow the new UTC convention.Read Datetimes and Timezones: Upgrade Existing Applications before upgrading.
v0.0.44Compare Source
Refactors
v0.0.43Compare Source
Fixes
Field. PR #2095 by @tiangolo.Internal
v0.0.42Compare Source
Features
Discriminatortype fordiscriminatorparameter inField. PR #1729 by @YuriiMotov.v0.0.41Compare Source
Refactors
min_itemsandmax_itemsparameters ofField. PR #1731 by @YuriiMotov.v0.0.40Compare Source
Docs
Field()instead ofcondecimal(). PR #2035 by @anxkhn.Internal
0.26.1. PR #2078 by @YuriiMotov.setup-uvaction to10.0.1. PR #2077 by @YuriiMotov.v0.0.39Compare Source
Features
uvx library-skills. PR #2017 by @tiangolo.Fixes
__sqlmodel_relationships__. PR #1996 by @svlandeg.Docs
Internal
guard-dependencies.yml. PR #1916 by @svlandeg.needs_py310marker from tests. PR #1852 by @stickm4n.mypywithtyin precommit. PR #1806 by @svlandeg.Kludex/uvicorn (uvicorn)
v0.54.0: Version 0.54.0Compare Source
📨 Send metadata after the response body
uvicorn0.54.0 adds response trailers and103 Early Hintsto its experimental HTTP/2 implementation throughzttp.http.response.trailersextension lets applications send metadata, such as checksums, after the response body. Clients must sendTE: trailersto receive them. Multiple trailer messages are combined before completing the response.--http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.💡 Hint at resources before the final response
103 Early Hintsover HTTP/2 (#3137). Applications can use the ASGIhttp.response.early_hintextension to send resource hints before the final response. Each supplied link becomes a separateLinkheader.Full changelog: 0.53.0...0.54.0
v0.53.0: Version 0.53.0Compare Source
🌐 Opt-in HTTP/2 support
uvicorn0.53.0 adds experimental HTTP/2 throughzttp, alongside a newzuvloopintegration and connection-handling improvements.zttp(#2982, #3101). Installzttp, then enable HTTP/2 with--http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.⚙️ More event loop choice
zuvloop(#3104). Installzuvloopseparately and select it explicitly with--loop zuvloopon CPython 3.14 or newer.🛡️ More reliable connections and proxies
Connection: closetoken lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.FORWARDED_ALLOW_IPSvalue now includes::1.Full changelog: 0.52.4...0.53.0
v0.52.4: Version 0.52.4Compare Source
Fixed
Dateheaders from accepted WebSocket handshakes withwebsockets-sansio(#3078)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.3...0.52.4
v0.52.3: Version 0.52.3Compare Source
Changed
zttpto 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.2...0.52.3
v0.52.2: Version 0.52.2Compare Source
Fixed
zttpto 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.1...0.52.2
v0.52.1: Version 0.52.1Compare Source
Fixed
websockets-sansioandwsprotoimplementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)websockets-sansioimplementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)Content-TypeandContent-Lengthheaders from WebSocket denial responses on thewebsockets-sansioimplementation, and deliver non-UTF-8 denial bodies intact (#3041)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.0...0.52.1
v0.52.0: Version 0.52.0Compare Source
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with
--http zttp, and please send any feedback to the issue tracker.Added
zttpHTTP/1.1 implementation, selectable with--http zttp(#2979)Fixed
Full Changelog: https://github.com/Kludex/uvicorn/compare/0.51.0...0.52.0
v0.51.0: Version 0.51.0Compare Source
What's Changed
Full Changelog: https://github.com/Kludex/uvicorn/compare/0.50.2...0.51.0
v0.50.2: Version 0.50.2Compare Source
What's Changed
Full Changelog: https://github.com/Kludex/uvicorn/compare/0.50.1...0.50.2
v0.50.1: Version 0.50.1Compare Source
What's Changed
Sec-WebSocket-Protocolvalues in the websockets-sansio implementation by @Aayush7352 in #3019New Contributors
Full Changelog: https://github.com/Kludex/uvicorn/compare/0.50.0...0.50.1
v0.50.0: Version 0.50.0Compare Source
What's Changed
asgiscope sub-dict per connection by @Kludex in #2976asgiscope dict per request by @Kludex in #2977autoto websockets-sansio by @Kludex in #2985Full Changelog: https://github.com/Kludex/uvicorn/compare/0.49.0...0.50.0
v0.49.0: Version 0.49.0Compare Source
What's Changed
Full Changelog: https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0
MagicStack/uvloop (uvloop)
v0.23.0Compare Source
Changes
Add Python 3.15 and 3.15t wheel builds and CI coverage (#758)
(by @honglei @fantix in
f7c0547)Add support for the
eager_startkeyword argument in create_task() (#748)(by @samypr100 in
3cbb095for #746 #718)Add thread name prefix to the default thread pool executor (#636)
(by @inikolaev @fantix in
0582f94for #562)Add support for special hostname
<broadcast>(#592)(by @jpbede in
3060cebfor #540)Upgrade libuv to v1.52.1 (#753)
(by @fantix in
e8efea4for #752)Improve performance by using Python C API to enter/exit context (#627)
(by @tarasko in
837ef22)Improve performance/latency of Transport.write (#619)
(by @tarasko in
1d9b6e0)Replace some SSL vectorcall with direct methods (#626)
(by @tarasko in
6a27cbe)Optimize SSL buffered reads using C values (#629)
(by @tarasko in
a308f75)Fixes
Detach socket on create_connection cancellation to prevent fd double-close (#740)
(by @junjzhang @fantix in
dc680ebfor #645 #738)Remove
loop._ready_lenin favor oflen(loop._ready)(#721)(by @x42005e1f in
5910a18for #720)Prefer inspect.iscoroutinefunction (#705)
(by @MatthieuDartiailh in
fd65027for #703)Fix context tests by explicitly yielding after run_in_executor (#743)
(by @samypr100 in
6cd24cb)Fix test_create_connection_open_con_addr with Python 3.13.9+ (#713)
(by @shadchin in
b93141afor #701)Skip flaky test_cancel_post_init on asyncio 3.13+ (#714)
(by @fantix in
3ea5c85for #709)Fix flaky test_fs_event (#717)
(by @fantix in
8da4547)Use C __atomic builtins for debug counters (#719)
(by @fantix in
836e3b2)Update the example to work with Python 3.14 (#710)
(by @Jamie-Chang in
b74c2f1)Build
Replace pkg_resources with packaging and use Cython 3.1 (#742)
(by @samypr100 in
b377b7cfor #729)Remove wheel as a build dependency (#696)
(by @DimitriPapadopoulos in
173e88c)Support any number of flags in UVLOOP_OPT_CFLAGS (#630)
(by @mgorny in
963a5f3)Configuration
📅 Schedule: (in timezone Europe/Warsaw)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: backend/pyproject.toml