build(deps): Bump the backend-minor-patch group across 1 directory with 10 updates

[dependabot]

Bumps the backend-minor-patch group with 10 updates in the /backend directory:

Package	From	To
boto3	1.43.66	1.43.83
clickhouse-connect	1.6.0	1.7.2
cloud-sql-python-connector	1.21.0	1.22.0
greenlet	3.5.4	3.5.5
lxml	6.1.1	6.1.2
pydantic	2.13.4	2.13.5
python-dotenv	1.2.2	1.2.3
sqlalchemy	2.0.51	2.0.52
starlette	1.4.1	1.6.0
uvicorn	0.52.1	0.52.4

Updates boto3 from 1.43.66 to 1.43.83

Commits

• 77e6582 Merge branch 'release-1.43.83'
• bdb0f45 Bumping version to 1.43.83
• 950987a Add changelog entries from botocore
• 156b04a Merge branch 'release-1.43.82'
• dfc3447 Merge branch 'release-1.43.82' into develop
• e6c550f Bumping version to 1.43.82
• 94d6577 Add changelog entries from botocore
• 18a131c Bump https://github.com/astral-sh/ruff-pre-commit (#4835)
• 1ee61ff Merge branch 'release-1.43.81'
• d3a3a52 Merge branch 'release-1.43.81' into develop
• Additional commits viewable in compare view

Updates clickhouse-connect from 1.6.0 to 1.7.2

Release notes

Sourced from clickhouse-connect's releases.

v1.7.2

clickhouse-connect v1.7.2

This patch release fixes SQLAlchemy reflection and SQL generation, query formatting, server-side parameter names, and HTTP proxy path handling.

What's Changed

Bug Fixes

• SQLAlchemy inspectors bound to an Engine now support get_columns() and reflect_table() on SQLAlchemy 2.x. Reflection also honors include_columns and exclude_columns. Closes #967.
• Queries ending with a semicolon, whitespace, or trailing comment now place client-appended FORMAT clauses correctly. Insert detection also follows SQL token rules. Closes #903.
• The async client now preserves explicit proxy_path values without adding extra slashes. Closes #963.
• The synchronous client now sends a normalized / request path through forwarding HTTP proxies when no proxy_path is configured. Closes #951.
• Server-side query placeholders now recognize $ in valid parameter names while preserving raw binary binding and ambiguity checks. Closes #936.
• SQLAlchemy ClickHouse types now implement the public literal processor contract for TypeDecorator and with_variant(). Closes #965.
• SQLAlchemy literals containing percent signs now compile safely alongside bound parameters and in server-side parameter mode. Closes #966.
• SQLAlchemy now applies ClickHouse backslash escaping to generic literal strings, defaults, aliases, TTL clauses, comments, and Alembic comment operations. Custom pre-escaping workarounds should be removed. Closes #975.
• SQLAlchemy union(), intersect(), and except_() now emit explicit DISTINCT operations. Use the corresponding _all() methods when duplicate-preserving behavior is required. Closes #973.
• SQLAlchemy Select.with_hint() now emits SAWarning when an applicable table hint would otherwise be ignored. Generated SQL remains unchanged. Closes #974.

Full Changelog: v1.7.1...v1.7.2

Installation

pip install clickhouse-connect

v1.7.1

clickhouse-connect v1.7.1

This is a patch release with two SQLAlchemy compatibility fixes.

What's Changed

Bug Fixes

• SQLAlchemy 2.1 compatibility: Identifier quoting forwarded the deprecated force argument to IdentifierPreparer.quote, which SQLAlchemy 2.1 removed, causing any dialect use to raise TypeError on 2.1.0b3. The parent call now passes only the identifier. The optional force parameter remains available on the ClickHouse preparer for direct callers. Closes #954.
• SQLAlchemy 1.4 compatibility: Column DDL using the clickhouse_materialized, clickhouse_alias, or clickhouse_ttl options raised AttributeError on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.

Full Changelog: ClickHouse/clickhouse-connect@v1.7.0...v1.7.1

Installation

pip install clickhouse-connect

v1.7.0

clickhouse-connect 1.7.0

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.7.2, 2026-08-19

Bug Fixes

• SQLAlchemy inspectors bound to an Engine can now call get_columns() and reflect_table() directly on SQLAlchemy 2.x. These methods now acquire and reuse one connection for each reflection operation, while inspectors already bound to a Connection continue to reuse it. Table reflection also honors positional include_columns and exclude_columns filters passed by SQLAlchemy instead of silently reflecting every column. Closes #967.
• Queries ending in a semicolon now keep the client-appended FORMAT clause inside the statement, including when the semicolon is followed by whitespace or a trailing comment. This fixes query, query_arrow, and raw_query with fmt for both sync and async clients. A lone directly trailing semicolon keeps the existing fast binding path, and inserts carrying inline data are never passed through the SQL lexer. Insert detection now follows SQL token rules, so quoted text such as ' INSERT INTO ' in a SELECT no longer misroutes the query, and identifiers named insert are not mistaken for the keyword. Closes #903.
• The async client now preserves an explicit proxy_path when constructing request URLs. It previously appended / unconditionally, changing /clickhouse to /clickhouse/ and /clickhouse/ to /clickhouse//, which could break exact-path proxy routing. Bare authority URLs still use /. Closes #963.
• The synchronous client now normalizes an empty request path to / when no proxy_path is configured, so requests routed through a forwarding HTTP proxy (http_proxy/HTTP_PROXY) use the normal absolute-form request-target (http://host:8123/?query=...) instead of the RFC-valid but non-normalized http://host:8123?query=..., which some proxies reject with HTTP 400 and others forward with the query string silently dropped. Direct connections are unaffected because urllib3 already normalizes the empty path, and an explicit proxy_path is left exactly as-is. This matches the async client, which already sent the path. Closes #951.
• Query placeholders now recognize $ in server-valid parameter names such as {id$x:Int32} or {$x$:String}. Previously these names were missed, which omitted their server-side values and could also drop DateTime64 precision and timezone hints. Placeholder detection is otherwise unchanged from 1.x. A $name$ dictionary key with a buffer value such as bytes, bytearray, or memoryview stays a raw binary bind. A non-buffer value for such a key can bind through a single {name:Type} placeholder, and ambiguous or repeated uses of the name raise ProgrammingError. SQLAlchemy server_side_params accepts the same names and rejects the reserved $name$ form. Closes #936.
• SQLAlchemy ClickHouse types now implement the public literal processor contract, so TypeDecorator wrappers and with_variant() render ClickHouse literals with proper quoting and escaping. Closes #965.
• SQLAlchemy ClickHouse type literals containing percent signs now compile safely alongside remaining bound parameters, and server-side parameter mode preserves consecutive percent signs in literals. Closes #966.
• SQLAlchemy now applies ClickHouse backslash escaping to generic literal_binds strings, string DEFAULT, MATERIALIZED, ALIAS, and TTL clauses, CREATE comments, and Alembic table and column comment operations. Backslash values now round-trip verbatim instead of being reinterpreted or terminating a quoted literal. ClickHouse-native literal processors and percent handling are unchanged. If custom TypeDecorator.process_literal_param or UserDefinedType code pre-escaped backslashes as a workaround, remove that workaround because the dialect now applies ClickHouse escaping. Closes #975.
• SQLAlchemy union(), intersect(), and except_() now compile to explicit UNION DISTINCT, INTERSECT DISTINCT, and EXCEPT DISTINCT, preserving SQLAlchemy's duplicate-removing semantics instead of relying on ClickHouse defaults. Their union_all(), intersect_all(), and except_all() counterparts remain explicit ALL operations. Users relying on previous duplicate-preserving behavior from union_default_mode='ALL' or ClickHouse's default intersect_default_mode='ALL' and except_default_mode='ALL' should switch to the corresponding _all() method. Closes #973.
• SQLAlchemy Select.with_hint() now emits an SAWarning when an applicable table hint would otherwise be silently ignored. The generated SQL remains unchanged for 1.x compatibility. Applications that promote SAWarning to an error will now stop at compilation instead of executing without the requested hint. Use the typed final(), sample(), prewhere(), and limit_by() methods for those ClickHouse clauses. Raw with_statement_hint() tail directives remain supported. Closes #974.

1.7.1, 2026-08-12

Bug Fixes

• SQLAlchemy 2.1 compatibility. Identifier quoting forwarded the deprecated force argument to IdentifierPreparer.quote, which SQLAlchemy 2.1 removed, so any dialect use raised TypeError on 2.1.0b3. The parent call now passes only the identifier. The optional force parameter stays on the ClickHouse preparer for direct callers. Closes #954.
• SQLAlchemy 1.4 compatibility. Column DDL using the clickhouse_materialized, clickhouse_alias, or clickhouse_ttl options raised AttributeError on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.

1.7.0, 2026-08-11

Improvements

• SQLAlchemy JSON columns now support storage-backed subcolumn access with column["segment"], column.subcolumn("segment", type_=...), and the statically typed json_subcolumn(...) helper. Nested paths compile as independently quoted dotted identifiers, and typed access uses CAST. Closes #899.
• show_clickhouse_errors now accepts "scrub" in addition to True/False. Scrub mode keeps the SQL exception text and symbolic name (for example UNKNOWN_TABLE) while stripping the server URL and trailing (version ...) trailer from client exception messages. Transport errors and mid-stream StreamFailureError messages honor the same setting. When error detail is disabled (False), the displayed exception string is generic. The chDB backend now uses the same generic text as HTTP, without its former trailing period. This setting governs str(exc) only. Transport errors remain attached as __cause__, so tracebacks can still contain the original host, URL, or library error text. Historical string booleans still work, but non-boolean values such as integers and unrecognized strings now raise ProgrammingError. Addresses the middle ground requested in #344.
• SQLAlchemy: added support for materialized common table expressions. cc_sqlalchemy.select(...).cte("name", materialized=True) emits WITH name AS MATERIALIZED (...), so a CTE referenced more than once is computed once instead of being inlined and re-executed at each reference. A module-level cc_sqlalchemy.cte(statement, "name", materialized=True) does the same for a statement built with the standard sqlalchemy.select. The keyword renders only on the ClickHouse dialect. The server materializes the CTE only when the experimental enable_materialized_cte setting is also enabled for the query and the analyzer is enabled. Materialized CTEs require ClickHouse 26.3 or later. The SQLAlchemy helpers reject recursive=True with materialized=True because ClickHouse does not support recursive materialized CTEs. Closes #900.
• Added the global naive_datetime_insert setting for Python object inserts, including naive ISO strings accepted by DateTime64. Set it to "server" to interpret a naive datetime in the timezone declared by the DateTime or DateTime64 column, or in the server timezone when the column has no timezone. The default remains "local" in 1.x and preserves the existing host-local conversion. This setting does not change datetime64-dtype NumPy and Pandas columns. Use naive_datetime_binding to control naive datetime query parameters. See #938.

Behavior Changes

• Removed runtime compatibility branches for unsupported ClickHouse server versions older than 25.8. Client initialization no longer substitutes the common.readonly value for servers older than 19.17 and always attempts guarded Native protocol negotiation, retaining the existing proxy-safe fallback. JSON inserts no longer fall back to String serialization for 24.8 and 24.9 servers. The module attribute clickhouse_connect.datatypes.dynamic.json_serialization_format remains importable for compatibility but assigning it no longer changes insert behavior. The generated cast_string_to_dynamic_use_inference default no longer depends on the obsolete allow_experimental_json_type setting. The global common.readonly option is deprecated and retained as a no-op. The default local Docker server is now ClickHouse 25.8.
• datetime.time and datetime.timedelta query parameters are now rendered as quoted literals. A time value was previously rendered without quotes and the server rejected it, so some queries added the quotes in the query text as a workaround, for example WHERE t = '%(t)s'. Those queries now produce a doubled quote and fail. Remove the manual quotes and bind the value normally. See #919.
• Naive datetime query parameters now bind as wall time instead of being interpreted in the client host timezone. Previously a naive value passed through astimezone for server-side {name:DateTime} parameters and DT64Param values, so the same query could match different rows depending on the timezone of the machine running it. Only workloads that bind naive datetime parameters with a non-UTC host timezone or a non-UTC target timezone are affected. Environments where both the host and the bind target are UTC see no change, and client-side % parameters against a UTC server were already sent verbatim. Two changes are observable. First, on a non-UTC host with a UTC target, server-side parameters and DT64Param values no longer shift, which corrects silently wrong results. Second, when the bind target is a non-UTC timezone, a naive value now means wall time in that timezone instead of the instant implied by the client local timezone, which can change matched rows for code that relied on the old conversion. A related consequence is that inserting a naive datetime and then filtering with the same naive value no longer matches on a non-UTC host, because the insert path still interprets naive values as host local time. #938 tracks unifying insert semantics. Timezone-aware datetimes are unchanged and still convert to the target bind timezone. Set common.set_setting("naive_datetime_binding", "legacy") to restore the previous behavior exactly. To make a naive value represent a specific instant under either mode, attach the intended tzinfo before binding.

Bug Fixes

• SQLAlchemy identifiers containing % now compile safely in statements with bound parameters. The DB-API bulk INSERT path also restores escaped percent signs in table and column names, so executemany keeps using one bulk insert instead of falling back to row-by-row execution or sending the wrong identifier. This includes %2E JSON key encodings used with json_type_escape_dots_in_keys.
• datetime.time and datetime.timedelta query parameters now bind as a quoted HH:MM:SS[.ffffff] literal for Time and Time64 columns. This fixes client-side %(name)s binding, timezone-aware time values, timedelta values, and values nested in arrays and tuples. A naive scalar time at the top level of a server-side {name:Time} bind already worked and is unchanged. A timedelta may be negative and may exceed 24 hours, and a pandas Timedelta with sub-microsecond nanoseconds formats a nine digit fraction. Plain Time accepts only whole seconds. Addresses the Time parameter failure in #919.
• SQLAlchemy: Time and Time64 columns now accept datetime.time and datetime.timedelta values in inserts and comparisons, and render correctly with literal_binds. The types inherit from the SQLAlchemy Interval type, which converted every bound value to an epoch datetime that the server rejected and coerced comparison values to its DateTime implementation. Reads still return timedelta. Part of #919.
• DB API module now provides the PEP 249 type constructors Binary, Date, Time, Timestamp, DateFromTicks, TimeFromTicks, and TimestampFromTicks. SQLAlchemy LargeBinary inserts no longer raise AttributeError. Addresses the Binary constructor failure in #919.
• Fractional DateTime64 values before the Unix epoch now serialize with the correct second. The serializer truncated negative timestamps toward zero before adding the fractional component, which shifted affected values forward by one second. This affected Python datetime values and accepted ISO strings in both naive datetime insert modes. See #938.
• Parsing a nested Variant, Tuple, Nested, or typed JSON column type whose element is an Enum with an escaped single quote in a value name no longer corrupts the escape sequence and fails while re-parsing the element type. Closes #878.
• None nested inside an Array or Tuple, or inside a Map when dict_parameter_format="map", now renders as the SQL NULL keyword instead of the \N sentinel used for top-level values. Top-level scalar None binds are unchanged. Closes #879.
• Inserting empty bytes b"" into a non-nullable FixedString(N) column now zero-pads to N bytes instead of raising DataError, matching the existing string and nullable-bytes write paths. Closes #880.
• Per-query and client settings that are not present in system.settings for the current user (including custom settings declared CHANGEABLE_IN_READONLY on a role) are now forwarded to ClickHouse instead of raising ProgrammingError: Setting ... is unknown or readonly. The client cannot discover those settings without extra privileges, so the server is treated as authoritative. Setting invalid_setting_action to drop still drops them, so a single settings dict stays portable across server versions. Known readonly settings still honor invalid_setting_action, and reserved HTTP request parameter names such as query, user, default_format, and the param_ bound-parameter namespace still raise a client-side ProgrammingError because they are not settings. Closes #530.
• SQLAlchemy reflection and metadata queries now force internal String decoding, so set_default_formats("String", "bytes") no longer turns reflected database, table, or column names into bytes. The Alembic startup current database lookup uses the same internal format. Alembic version table queries do not use the internal override and remain affected by a global String bytes format. Closes #920.
• Removing a block comment for query type detection no longer joins the tokens around it. The server lexer treats a comment as a token separator, but remove_sql_comments replaced it with nothing, so SELECT/*c*/number FROM numbers(9) became the single token SELECTnumber, stopped looking like a SELECT, and the client side query_limit was silently dropped, while SELECT number FROM numbers(9)/*c*/LIMIT 1 became numbers(9)LIMIT 1, hid the real LIMIT, and the client appended a second one that the server rejected with Code: 62. A removed block comment now leaves a single space behind, and the trailing LIMIT 0 check that routes a query to the columns only metadata probe accepts any whitespace between LIMIT and 0 instead of exactly one space, so LIMIT /*c*/0 keeps reaching that probe. A -- line comment is unchanged, its terminating newline was already kept. Closes #928.

... (truncated)

Commits

• 9283654 release prep for 1.7.2 (#980)
• 836e12e fix SQLAlchemy engine-bound table reflection (#979)
• 1b7b0af fix SQLAlchemy DISTINCT set operations (#978)
• c76037d warn on ignored SQLAlchemy table hints (#977)
• 6ca829b Joe/fix arrow trailing semicolon (#970)
• f110acc update review instructions and arch metadata (#976)
• 289f42a Fix SQLAlchemy DDL string literal escaping for comments and string defaults (...
• 9c24d33 Joe/fix chsqlatype literal bugs (#969)
• 2f34aa5 use centralized docs drift checker (#961)
• 8e15d09 async explicit proxy_path preservation (#964)
• Additional commits viewable in compare view

Updates cloud-sql-python-connector from 1.21.0 to 1.22.0

Release notes

Sourced from cloud-sql-python-connector's releases.

v1.22.0

1.22.0 (2026-08-18)

Features

• Add PSC DNS and Global Write Endpoint support to Python Connector (#1446) (62640f3)
• add support for psycopg (#1452) (ba58f8f)

Bug Fixes

• psycopg: add platform guard for platforms without AF_UNIX support (#1466) (2dfee66)
• update deps to the latest (#1456) (a1bdfc7)

Documentation

• update pg8000 link to new repository location (#1368) (2b20167)

Changelog

Sourced from cloud-sql-python-connector's changelog.

1.22.0 (2026-08-18)

Features

• Add PSC DNS and Global Write Endpoint support to Python Connector (#1446) (62640f3)
• add support for psycopg (#1452) (ba58f8f)

Bug Fixes

• psycopg: add platform guard for platforms without AF_UNIX support (#1466) (2dfee66)
• update deps to the latest (#1456) (a1bdfc7)

Documentation

• update pg8000 link to new repository location (#1368) (2b20167)

Commits

• 257407a chore(main): release 1.22.0 (#1455)
• 847b34f chore(deps): update dependency idna to v3.19 (#1468)
• 31c415e ci: skip schedule reporter on forks (#1469)
• 2dfee66 fix(psycopg): add platform guard for platforms without AF_UNIX support (#1466)
• 2b20167 docs: update pg8000 link to new repository location (#1368)
• ba58f8f feat: add support for psycopg (#1452)
• 5aa23dc test: improve unit test coverage and fix deprecation warnings (#1453)
• a1bdfc7 fix: update deps to the latest (#1456)
• 62640f3 feat: Add PSC DNS and Global Write Endpoint support to Python Connector (#1446)
• See full diff in compare view

Updates greenlet from 3.5.4 to 3.5.5

Changelog

Sourced from greenlet's changelog.

3.5.5 (2026-08-10)

• Link the C++ runtime statically into the Windows wheels again, as the Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported MSVCP140.dll, which no Windows CPython distribution ships, so importing greenlet failed on machines without the Visual C++ redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue and pull request by Daniel Sticker.

.. note:: Binary 3.15 wheels are now built with 3.15.0rc1. This should be compatible with future 3.15 releases and is believed compatible with 3.15b4 as well (but not earlier versions).

Commits

• ddb1453 Preparing release 3.5.5
• 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
• f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
• f1ce3ca Restore static linking of the C++ runtime for Windows wheels
• b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
• 726cc38 Bump the github-actions group with 3 updates
• e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
• be55a59 Check that the suspended greenlet is what keeps the class alive
• e9c01dd Back to development: 3.5.5
• See full diff in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

Commits

• f2874e9 Update release date.
• 687a295 Build: Exclude Py3.8 from windows-arm builds.
• acadc56 Build: Remove outdated build target.
• 59f93eb Build: Split old-Linux and other-Py3.8 builds.
• 923df83 Build: Fix manylinux2014 build.
• 975cc83 Build: Fix Px3.8 build setup.
• 09e5d3e Build: Fix cibuildwheel version.
• 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
• 5567037 Build: Exclude Py3.15 from 32bit builds.
• 904db40 Build: Update cibuildwheel to include Py3.15.
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates starlette from 1.4.1 to 1.6.0

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

• Add max_body_size to Starlette and route classes by @​Kludex in Kludex/starlette#3431
• Expose http.response.debug info via response extensions by @​y2kbugger in Kludex/starlette#3130

New Contributors

• @​y2kbugger made their first contribution in Kludex/starlette#3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Version 1.5.1

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @​nikolauspschuetz in encode/starlette#3389
• Limit FileResponse to 100 ranges by @​Kludex in encode/starlette#3430

Full Changelog: Kludex/starlette@1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @​Kludex in encode/starlette#3418
• Flush GZip output for each streamed chunk by @​Kludex in encode/starlette#3419
• Skip compression of partial responses in GZipMiddleware by @​Kludex in encode/starlette#3420
• Expand default excluded content types in GZipMiddleware by @​Kludex in encode/starlette#3421

Full Changelog: Kludex/starlette@1.4.1...1.5.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

• Add max_body_size to Starlette and route classes #3431.
• Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

• Reject inverted single-byte ranges in FileResponse #3389.
• Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

• Add exclude_content_types parameter to GZipMiddleware #3418.

Changed

• Expand default excluded content types in GZipMiddleware #3421.

Fixed

• Flush GZip output for each streamed chunk #3419.
• Skip compression of partial responses in GZipMiddleware #3420.

Commits

• 4f250d6 Version 1.6.0 (#3434)
• 9eea41a Expose http.response.debug info via response extensions (#3130)
• 38f8999 Add max_body_size to Starlette and route classes (#3431)
• c41236c Version 1.5.1 (#3432)
• 9c500db Limit FileResponse to 100 ranges (#3430)
• 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
• c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
• ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
• 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
• d96887e Add Pydantic Logfire banner to the docs (#3428)
• Additional commits viewable in compare view

Updates uvicorn from 0.52.1 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with <...

  Description has been truncated