[dependabot]

Updates the requirements on fastapi, starlette, pydantic, duckdb, polars, pandas, pyarrow, brotli-asgi, upstash-redis, anyio, certifi, idna and mcp to permit the latest version.
Updates fastapi from 0.161.1 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• See full diff in compare view

Updates starlette to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing #3665 and #3722.

Deprecated

• Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

• Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
• Keep path parameter values that look like another placeholder in url_path_for() #3725.
• Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
• Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
• Strip only one pair of matching outer quotes from Config env file values #3720.
• Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
• Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
• Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.

... (truncated)

Commits

• 8aa828c Version 1.10.0 (#3728)
• a85a5c3 Substitute URL path parameters in a single pass (#3725)
• 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
• b973efd Build URL-encoded form fields in parser callbacks (#3724)
• d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
• fb3e818 Compare remaining Match members by identity in routing (#3722)
• fc23aa1 Compare Match members by identity in Router.app (#3665)
• fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
• 4114432 Default omitted http.response.start headers in middlewares (#3721)
• 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
• Additional commits viewable in compare view

Updates pydantic to 2.14.2

Release notes

Sourced from pydantic's releases.

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

• Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @​Viicos in #14003
• Bump speedate to v0.18.0 by @​Viicos in #14007
• Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @​Viicos in #14083

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Lazily call repr of values during nested union serialization by @​Viicos in #14082
• Skip decorator field checks when no field decorators exist by @​alexmojaki in #14111
• Avoid heap allocation for small JSON model field buffers by @​alexmojaki in #14113

Fixes

• Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

  JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

  from pydantic import BaseModel, ConfigDict
  from pydantic.alias_generators import to_camel
  class Page(BaseModel):
  model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
  page_size: int = 10
  
  Page.model_validate_json('{"page_size": 50}')
  Before: Page(page_size=10)
  After: ValidationError (extra_forbidden)

  See the pull request for the full list of behavior changes. This change addresses GHSA-qpmf-fgh3-ff25.

• Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #14090. Addresses GHSA-3r8g-cqwr-jr29.

• Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

• Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

• Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

• Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

• Implement recursion guard for validate_strings() by @​Viicos in #14029

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.2 (2026-10-29)

GitHub release

What's Changed

Packaging

• Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @​Viicos in #14003
• Bump speedate to v0.18.0 by @​Viicos in #14007
• Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @​Viicos in #14083

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Lazily call repr of values during nested union serialization by @​Viicos in #14082
• Skip decorator field checks when no field decorators exist by @​alexmojaki in #14111
• Avoid heap allocation for small JSON model field buffers by @​alexmojaki in #14113

Fixes

• Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

  JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

  from pydantic import BaseModel, ConfigDict
  from pydantic.alias_generators import to_camel
  class Page(BaseModel):
  model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
  page_size: int = 10
  
  Page.model_validate_json('{"page_size": 50}')
  Before: Page(page_size=10)
  After: ValidationError (extra_forbidden)

  See the pull request for the full list of behavior changes.

• Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

• Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

• Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

• Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

• Implement recursion guard for validate_strings() by @​Viicos in #14029

• Support named tuples in Sequence serialization by @​Viicos in #14033

... (truncated)

Commits

• aa540ac Update changelog for v2.14.2
• 6cde12f Update changelog for v2.14.2
• 2db7c25 Fix deep copy of self-referential models
• d783154 Update changelog for v2.14.2
• df49b6c Avoid heap allocation for small JSON model field buffers
• cd93e69 Skip decorator field checks when no field decorators exist
• 2771e57 Make JSON validation by iteration consistent with Python approach
• 8102e3f Avoid Python tuple allocation during model fields validation
• dd139b5 Bump pydantic.v1 namespace to v1.10.27
• 66155f9 Prepare release v2.14.2
• Additional commits viewable in compare view

Updates duckdb to 2.0.0

Release notes

Sourced from duckdb's releases.

DuckDB v2.0.0

duckdb-python 2.0.0 is the Python package for DuckDB 2.0. It supports Python >= 3.11 and drops Python 3.10. From Python 3.12 on, one wheel per platform serves every Python version. The binding layer was rewritten on nanobind, query results stream instead of being collected up front, the relational API was rebuilt on SQL text, and the way DataFrames, Arrow data and polars frames are read was replaced. Many long-standing bugs are fixed, and moving data in and out of Python is much faster. The engine is DuckDB 2.0.0; see its release notes for what changed in SQL and storage.

Highlights

• Moving data is much faster. Numeric exports to numpy, pandas, Arrow and polars take a quarter to two fifths of the 1.5 time; in-memory Arrow, polars and pandas 3 inputs are scanned on all threads, 8x to 20x faster; Arrow UDFs run about 20x faster; draining an Arrow reader on 16 threads takes an eighth of the time. (#693, #697, #700)
• Results stream. con.execute() starts the query and you read rows as you fetch them; con.complete() and con.abort() finish or cancel an open result, and an open result or Arrow reader owns the connection until it is done.
• The relational API is rebuilt on SQL text. A relation is a lazy query, bound at every step so its schema is known; rel.sql_query() shows exactly what will run. Many new methods and expression helpers (col, lit, when, window functions). One semantic change: a plain string in an expression is a value, not a column name. (#697)
• A new Appender for fast bulk inserts: with con.appender("t") as a: a.append_row(...), under a microsecond per row. (#661)
• One stable ABI wheel per platform for Python 3.12 and later, so a new Python release works on day one. Python 3.15 is supported. (#672, #673, #684)
• Arrow export on con.execute() results changed: fetch_arrow_table, fetch_record_batch and arrow(n) are gone; use con.sql(query).to_arrow_table() or .to_arrow_reader(). (#702)
• The experimental Spark API is brought up to date: it is now compatible with PySpark 4.2.0 and 3.5.9 (#686). We would love your input on whether to continue support or to drop it in future releases.

Upgrading from 1.x: what to check

1. Make sure you run Python 3.11 or later.
2. If you call fetch_arrow_table, fetch_record_batch, arrow(n) or pl() on the result of con.execute(), switch to con.sql(query).to_arrow_table(), to_arrow_reader() or pl(). Libraries that call the removed names on an execute result need an update. (#702)
3. If you call fetchone(), fetchmany(), fetch_df_chunk() or execute() on a relation, use rel.limit(n).fetchall(), rel.to_arrow_reader(), rel.materialize(), or run the query through con.execute(). (#697)
4. If you compare a relation column with a plain string, col("s") == "x" now compares with the text x. Wrap column names in col(). (#697)
5. If you rely on import duckdb having opened the default database, note that it happens on the first duckdb.sql() or duckdb.connect() call instead. (#680)
6. If you pass Decimal values with a positive exponent, such as Decimal("1E+2"), they now arrive as the number they denote, 100, where 1.5 produced 1.00. (#654)
7. If you write files with overwrite=False, an existing file is now refused instead of replaced. (#668)
8. If a test or script depends on str(rel) being free, note that it runs the query each time now.

Breaking changes

Arrow export on DB-API results (#702)

Results of con.execute() are now read row by row and are not kept in memory, so they cannot hand their data to Arrow for free. fetch_arrow_table, fetch_record_batch, arrow(rows_per_batch) and pl() on a DB-API result are removed; they had been deprecated. to_arrow_table() and to_arrow_reader() remain, also as duckdb.to_arrow_table() and duckdb.to_arrow_reader(), but they materialize the rows twice, once as the result and once as Arrow, and emit a UserWarning pointing at the relational path, con.sql(query).to_arrow_table(), which we recommend instead. The reader no longer streams: its first batch arrives after the whole query ran. After a partial fetchone or fetchmany the Arrow call returns the remaining rows instead of raising. With preserve_insertion_order off, the row order can differ between calls. duckdb.arrow(n) with an integer is gone; duckdb.arrow(arrow_object) still builds a relation.

# 1.5
table = con.execute("SELECT * FROM t").fetch_arrow_table()
reader = con.execute("SELECT * FROM t").fetch_record_batch(10_000)
2.0
table = con.sql("SELECT * FROM t").to_arrow_table()
reader = con.sql("SELECT * FROM t").to_arrow_reader(10_000)

Relations are SQL text (#697)

The relational API is a query building API, not an execution API. A relation is a piece of SQL text with a schema bound once when it is built, so every step knows its columns and types. It runs nothing until you ask for data, and it runs again on every read; rel.sql_query() returns exactly the text that runs, as one SELECT per group of steps and a common table expression where the order of clauses breaks. The engine's binder decides every column name and type; nothing is renamed by the client.

What you are most likely to notice:

• A bare string operand of an expression is a value, not a column. For one release a warning is raised when the string matches a column name; the warning goes in 2.1. A dotted string is not split into parts; pass the parts separately.

... (truncated)

Commits

• 83c7199 Build the dictionary test's indices with a 64 bit arange (#705)
• b12fd55 Build the dictionary test's indices with a 64 bit arange
• 6aa2ce3 Build the Linux and macOS wheels with clang and ThinLTO (#703)
• 2f0ac79 Pin submodule to v2.0.0 hash
• f7826ad Fix wrong values and lost parallelism in the pandas, numpy and Arrow input sc...
• 2f2a0dd Bring back to_arrow_table and to_arrow_reader on DB-API results over a re-fee...
• 6086a15 Keep the macOS wheels native, like the engine's release
• 07ee3e2 Build the Linux and macOS wheels with clang and ThinLTO
• a2c151f Register the linked extensions when the module loads, not only on import (#701)
• dd2a3e9 Read numpy masks a word at a time
• Additional commits viewable in compare view

Updates polars to 2.1.0

Release notes

Sourced from polars's releases.

Python Polars 2.1.0

💥 Breaking changes

• Disallow mixed string <=> numeric arithmetic in eager (#30071)

🚀 Performance improvements

• Limit the memory of buckets sorted ahead in the sort flush (#30297)
• Make file readers wait for spills while over the memory budget (#30296)
• Count unspilled frames in the memory estimate right away (#30295)
• Simplify more boolean expressions and drop redundant null checks (#30293)
• Wait for spills while over the out-of-core memory budget (#30294)
• Lower the default out-of-core prefetch fraction to 0.5 (#30292)
• Aggregate unique and n_unique in the streaming group-by itself (#30281)
• Return freed memory to the OS right away while out-of-core data is spilled (#30280)
• Gather List(Array) and Array columns without per-row slices (#30278)
• Evaluate the streaming window node out of core (#30282)
• Avoid deep copies when building a DataFrame from flat dataclasses (#30275)
• Sort the window partitions by each order key instead of their row encoding (#30277)
• Scan the haystack for a single needle in is_in (#30276)
• Prefer fixed-width columns when only the row count is needed (#30274)
• Native gather for List arrays (#30019)
• Evaluate windows in filter predicates in the streaming window node (#30272)
• Don't busy-wait in RAYON.block_on (#30259)
• Encode nested Parquet levels directly from the level buffers (#30251)
• Reduce memory of CSV scans on wide rows (#30165)
• Avoid quadratic JSON serialization of nested lists and maps (#30203)
• Skip the gather when exploding lists without nulls (#30234)
• Speed up writing nested Parquet columns (#30245)
• Don't keep whole parquet string dictionaries alive for a few selected rows (#30248)
• Set default spill compression level to 1 (#30237)
• Reuse zstd contexts in compression and avoid memcpys (#30233)
• Remove repeated and scalar ordering keys before the sort rewrites (#30231)
• Remove repeated keys from by's (#30095)
• Keep only one guessed unique key per join order leaf (#30191)
• Don't let extra join keys shrink an estimate once one key is unique (#30190)
• Reduce binary size of asof join with by keys (#30192)
• Reduce binary size of SQL visitors and parallel group-by collect (#30171)
• Push as-of join key filters to the right input (#30123)
• Drop null as-of right keys with a parallel filter before the join node (#30125)
• Keep as-of nearest join state small (#30126)
• Explode lists in group_by aggregations without a per-group apply (#30020)
• Streaming OOC group-by with shuffles (#29911)
• Drop scalar ordering keys in the optimizer (#30063)
• Merge union inputs that scan files of the same kind into one multi-file scan (#30056)
• Use the streaming scalar window for std, var and combined reductions in over (#30066)
• Limit the bytes of local CSV and NDJSON files read at once in multi-file scans (#30055)
• Check the matched flag of join keys in the table entry before the bitset (#30067)
• Track matched build rows of all join tables in a bitset (#30050)
• Add dedicated list gather kernels (#30049)

... (truncated)

Commits

• 7f902bd Python Polars 2.1.0 (#30124)
• dfb63c7 fix(rust): Include rolling index columns in expression metadata (#29245)
• a26073c perf: Limit the memory of buckets sorted ahead in the sort flush (#30297)
• 8d11086 test: Fix allocator-dependent failure in masked zero-copy to_numpy test (#3...
• a9a998b perf: Make file readers wait for spills while over the memory budget (#30296)
• 8b57b77 perf: Count unspilled frames in the memory estimate right away (#30295)
• 720d744 refactor: Simplify the out-of-core decay state and tests (#30283)
• f7a3227 perf: Simplify more boolean expressions and drop redundant null checks (#30293)
• 48de7ae perf: Wait for spills while over the out-of-core memory budget (#30294)
• 28cfd43 fix: Compare Array(Struct) rows field by field (#30290)
• Additional commits viewable in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates pyarrow to 26.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.0

Release Notes URL: https://arrow.apache.org/release/26.0.0.html

Commits

• 4461671 MINOR: [Release] Update versions for 26.0.0
• 9d03a26 MINOR: [Release] Update .deb/.rpm changelogs for 26.0.0
• 5ce3c95 MINOR: [Release] Update CHANGELOG.md for 26.0.0
• 28e6c67 GH-51687: [C++] Skipt tests that require threads if ARROW_ENABLE_THREADING=OF...
• 12409f8 GH-51682: [CI][C++] Add liburiparser-dev to system dependency image (#51683)
• 1deceed GH-51675: [Python][Packaging] Apply upstream fix to UriParser from vcpkg and ...
• cca44b5 GH-51638: [CI][C++][Parquet] Update expected JSON output in parquet-reader-te...
• 5183e21 GH-46901: [C++][Compute] Add remainder and modulo kernels (#48914)
• f0d043c MINOR: [Docs][C++] Fix doxygenfile path for arrow/flight/transport.h (#51677)
• 17be9c7 GH-51652: [Python] Add NumPy StringDType to Arrow conversion (#51157)
• Additional commits viewable in compare view

Updates brotli-asgi from 1.6.0 to 1.7.0

Commits

• 922b528 chore(release): bump version to 1.7.0 (#45)
• 3c22d2e fix(deps): require patched Brotli and replace brotlipy with brotlicffi (#44)
• 2aa982a fix(deps): support Starlette 1.x and drop Python 3.9 (#43)
• 4365280 Release 1.6.0 (#41)
• See full diff in compare view

Updates upstash-redis to 1.8.0

Release notes

Sourced from upstash-redis's releases.

1.8.0

What's Changed

• DX-2352: redis search by @​CahidArda in upstash/redis-py#70
• DX-2960: send Upstash-Telemetry-Retry header with the attempt number by @​CahidArda in upstash/redis-py#71

Full Changelog: upstash/redis-py@v1.6.0...1.8.0

Commits

• 868f2ec DX-2960: send Upstash-Telemetry-Retry header with the attempt number (#71)
• 7b8dd03 chore: bump version to 1.7.0
• c8d7c49 DX-2352: redis search (#70)
• e3379e9 fix: bump version to 1.6.0
• 1033c50 Dx 2353 - Update Redis API compat page for v1.15 (#68)
• bed0d54 DX-2186: Add Redis stream commands (#66)
• 4e3a254 DX-2204: add telemetry data collection and opt-out option (#67)
• See full diff in compare view

Updates anyio to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates certifi to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• See full diff in compare view

Updates idna to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

3.19 (2026-08-18)

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL dis...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dgz-engineering	Building	Preview	Nov 1, 2026 6:40pm UTC

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.