Bump the python-dependencies group with 5 updates

[dependabot]

Updates the requirements on uvicorn, ruff, pytest, pytest-cov and hypothesis to permit the latest version.
Updates uvicorn to 0.52.3

Release notes

Sourced from uvicorn's releases.

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Changelog

Sourced from uvicorn's changelog.

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

... (truncated)

Commits

• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• 2a5ff18 Version 0.52.2 (#3066)
• 1920297 Update zttp to 0.0.22 (#3063)
• 5c560da chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3061)
• See full diff in compare view

Updates ruff to 0.16.3

Release notes

Sourced from ruff's releases.

0.16.3

Release Notes

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
• [pylint] Allow continue in finally on Python 3.8 (#27626)
• [pylint] Fix PLE1307 false positive with bools (#27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#27570)
• Enable PGO for Linux ARM64 Ruff releases (#27574)
• Enable PGO for Windows x86-64 Ruff releases (#27573)
• Enable PGO for macOS ARM64 Ruff releases (#27572)
• Reduce Expr size to 64 bytes (#27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

• Use mimalloc v3 (#27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.3

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
• [pylint] Allow continue in finally on Python 3.8 (#27626)
• [pylint] Fix PLE1307 false positive with bools (#27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#27570)
• Enable PGO for Linux ARM64 Ruff releases (#27574)
• Enable PGO for Windows x86-64 Ruff releases (#27573)
• Enable PGO for macOS ARM64 Ruff releases (#27572)
• Reduce Expr size to 64 bytes (#27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

• Use mimalloc v3 (#27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh
• @​chirizxc

... (truncated)

Commits

• b0e4702 Bump 0.16.3 (#27723)
• ecdd401 [ty] Separate script and uv modules from project metadata (#27720)
• 1263524 [ty] Simplify display implementations with std::fmt::from_fn (#27718)
• 59196ba [ty] Unify polarity-aware relation construction (#27707)
• b8c5e73 [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (#27706)
• 2b0d210 [ty] Centralize matched argument relations (#27705)
• a9130f3 [pyupgrade] Add rule to replace while 1 with while True (while-one, `...
• c64c7d6 [ty] Model try exception flow with operation checkpoints (#27471)
• 9dea5ef [ty] Avoid deriving sequents for typevars with concrete bounds (#27587)
• 9798e88 [ty] Preserve enum exhaustiveness with custom missing methods (#27700)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates pytest-cov to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

• Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

• Improve handling of ResourceWarning from sqlite3.

  The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

  With this fix one can suppress ResourceWarning from sqlite3 from command line::

  pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

• Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

• Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

• Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

7.0.0 (2025-09-09)

• Dropped support for subprocesses measurement.

  It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

  To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

  .. code-block:: ini

  [run] patch = subprocess

  This release also requires at least coverage 7.10.6.

• Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

• Removed some not really necessary testing deps like six.

... (truncated)

Commits

• 66c8a52 Bump version: 7.0.0 → 7.1.0
• f707662 Make the examples use pypy 3.11.
• 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
• 8ebf20b Update changelog.
• 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
• fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
• 78c9c4e Only run the 3.9 on older deps.
• 4849a92 Punctuation.
• 197c35e Update changelog and hopefully I don't forget to publish release again :))
• 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
• Additional commits viewable in compare view

Updates hypothesis to 6.165.6

Commits

• cec6388 Bump hypothesis version to 6.165.6 and update changelog
• 49a2698 Merge pull request #4855 from Liam-DeVoe/publish-ppc64le-and-windows-arm64-wh...
• a598ab9 Revert "optimize single-branch one_of"
• f440660 optimize single-branch one_of
• b5f6c94 claude: publish ppc64le and windows arm64 wheels
• 2f49474 Bump hypothesis version to 6.165.5 and update changelog
• 15e547b Merge pull request #4850 from Liam-DeVoe/rename-internal-example-terminology
• d7fcdfa Merge remote-tracking branch 'upstream/master' into plait/review-hypothesis-4850
• 265fcc3 Bump hypothesis version to 6.165.4 and update changelog
• ebb7b7b Merge remote-tracking branch 'upstream/master' into rename-internal-example-t...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions