Skip to content

deps(deps): bump the python-dependencies group with 4 updates - #150

Merged
github-actions[bot] merged 2 commits into
masterfrom
dependabot/pip/python-dependencies-9bb4831356
Aug 10, 2026
Merged

deps(deps): bump the python-dependencies group with 4 updates#150
github-actions[bot] merged 2 commits into
masterfrom
dependabot/pip/python-dependencies-9bb4831356

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 4 updates: pydantic-settings, soupsieve, chardet and uvicorn.

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

What's Changed

... (truncated)

Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates soupsieve from 2.9.1 to 2.9.2

Release notes

Sourced from soupsieve's releases.

2.9.2

  • FIX: Fix issue where :is() and :where() were not accounting for empty selectors in the max selector count as they should (@​arpitjain099).
  • FIX: Fix issue where :has() was allowing empty selectors in some circumstances even though it is not forgiving.
  • FIX: Reduce selector object size when :is() and :where() contain empty selectors.
Commits

Updates chardet from 7.4.3 to 7.5.1

Changelog

Sourced from chardet's changelog.

7.5.1 (2026-08-06)

Bug Fixes:

  • Fixed markup-declared encodings being reported under a name that can't decode the input. A page declaring Shift_JIS but using CP932 extension characters (like ①) came back as SHIFT_JIS, which fails .decode() on those same bytes. Superset promotion (CP932, CP949) now always fires when the reported name can't decode the data but the superset can. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)
  • Fixed a lying charset declaration beating genuine UTF-8 content. A UTF-8 page declaring <meta charset="iso-8859-1"> came back as ISO-8859-1, which decodes to mojibake. Valid multi-byte UTF-8 now wins over a conflicting declaration; pure ASCII and real single-byte content still honor it. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)
  • Fixed BOM-less UTF-16 byte-order detection for pure-CJK text. With no ASCII in the sample, the only null bytes come from the low byte of characters like U+4E00 (一), which sit in the wrong parity position, so short Chinese UTF-16 samples came back with reversed endianness at full confidence. Byte order is now chosen by decoding both ways and comparing text quality, with the null signal breaking near-ties. Found by scoring chardet against charset-normalizer's char-dataset. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)

7.5.0 (2026-08-05)

Bug Fixes:

  • Fixed multi-byte encodings being eliminated when the input ends in an incomplete character. Byte-validity filtering decoded with a one-shot strict decode, which cannot tell a truncated tail from corrupt data, so a single dangling lead byte dropped every CJK candidate and the result came down to input-length parity — a 184-byte GBK sample detected as GB18030, the same sample minus one byte as Windows-1256. This was also reachable on complete, well-formed files, because chardet slices its own input at max_bytes and at _SCAN_LIMIT in _validate_bytes(): a valid 14 kB GBK page with an honest <meta charset="gbk"> lost its declaration, and with it text/html and 0.95 confidence, whenever byte 4096 happened to split a character. Validity checks now decode incrementally with final=False, deferring a partial trailing character while still rejecting corruption anywhere before it. (António Afonso <https://github.com/aadsm>_ via Claude, [#376](https://github.com/chardet/chardet/issues/376) <https://github.com/chardet/chardet/pull/376>_)

  • Fixed compat_names (the default) leaking internal Python codec names

... (truncated)

Commits
  • 40f85b0 docs: stamp 7.5.1 release date
  • cd5c8b3 docs: tighten recent changelog entries
  • 142b945 docs: align recent changelog entries with house style
  • 9955af2 Fix two markup-stage bugs that returned undecodable or wrong encodings
  • 0689e76 style: apply ruff format to utf1632 changes
  • dfce346 Fix BOM-less UTF-16 byte order for pure-CJK text with no ASCII
  • 531dfb7 docs: add 7.5.0 performance entries to changelog
  • 1f9b91b ci: exclude models/init.py from mypyc on Windows separate builds
  • 5cff59e ci: fix release wheel builds for mypy 2.x and PEP 668 runners
  • 60d1723 docs: stamp 7.5.0 release date
  • Additional commits viewable in compare view

Updates uvicorn from 0.52.0 to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
Commits
  • ee8e45c Version 0.52.1 (#3056)
  • b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
  • 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
  • 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
  • 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
  • e148451 Handle connection loss during WebSocket write backpressure (#3050)
  • e16a69b Add missing write flow control to websockets-sansio (#3048)
  • ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the python-dependencies group with 4 updates
0a78a71 
Bumps the python-dependencies group with 4 updates: [pydantic-settings](https://github.com/pydantic/pydantic-settings), [soupsieve](https://github.com/facelessuser/soupsieve), [chardet](https://github.com/chardet/chardet) and [uvicorn](https://github.com/Kludex/uvicorn).


Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)

Updates `soupsieve` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](facelessuser/soupsieve@2.9.1...2.9.2)

Updates `chardet` from 7.4.3 to 7.5.1
- [Release notes](https://github.com/chardet/chardet/releases)
- [Changelog](https://github.com/chardet/chardet/blob/main/docs/changelog.rst)
- [Commits](chardet/chardet@7.4.3...7.5.1)

Updates `uvicorn` from 0.52.0 to 0.52.1
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.0...0.52.1)

---
updated-dependencies:
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: soupsieve
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: chardet
  dependency-version: 7.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.52.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 10, 2026
@github-actions
github-actions Bot merged commit 7c5cca4 into master Aug 10, 2026
@github-actions
github-actions Bot deleted the dependabot/pip/python-dependencies-9bb4831356 branch August 10, 2026 13:07
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

🤖 Auto-merged

This Dependabot PR has been automatically merged because all branch-protection required checks passed.

Version handling:

  • Dependency update: version bumped from 3.8.16 to 3.8.17

Decision:

  • PR version is behind or equal to base

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@actions-user