build(deps): bump the python-minor-and-patch group across 1 directory with 52 updates

[dependabot]

Bumps the python-minor-and-patch group with 52 updates in the / directory:

Package	From	To
anthropic	1.0.0	1.8.0
atlassian-python-api	5.0.3	5.0.5
cryptography	50.0.0	50.0.1
lxml	6.1.2	6.1.3
openai	3.3.1	3.19.2
protobuf	7.36.0	7.36.2
pydantic	2.13.4	2.13.5
sentry-sdk	2.68.0	2.70.0
spacy	3.8.13	3.8.16
sqlalchemy	2.0.52	2.1.1
starlette	1.6.0	1.7.0
alembic	1.19.1	1.20.0
anyio	4.14.2	4.15.1
boto3	1.43.78	1.43.103
botocore	1.43.78	1.43.103
cachetools	7.1.7	7.2.0
click	8.4.2	8.5.0
cloudpathlib	0.24.0	0.25.0
google-api-core	2.34.0	2.39.0
google-api-python-client	2.199.0	2.200.0
google-auth	2.56.3	2.58.1
google-auth-httplib2	0.4.1	0.4.2
google-auth-oauthlib	1.4.0	1.4.1
googleapis-common-protos	1.75.1	1.75.4
greenlet	3.5.5	3.5.6
httpcore2	2.12.0	2.13.1
httpx2	2.12.0	2.13.1
idna	3.19	3.20
jiter	0.16.0	0.17.0
joblib	1.5.3	1.6.0
mako	1.4.1	1.4.3
markdown	3.10.3	3.11
msal	1.37.0	1.39.0
multidict	6.7.1	6.9.1
pandas	3.0.5	3.0.6
patsy	1.0.2	1.0.3
propcache	0.5.2	0.5.4
proto-plus	1.28.3	1.28.4
psycopg2-binary	2.9.12	2.9.13
pyjwt	2.13.0	2.15.0
pyparsing	3.3.2	3.3.3
pytz	2026.3.post1	2026.4
regex	2026.7.19	2026.9.10
slack-sdk	3.43.0	3.44.1
soupsieve	2.9.2	2.10
statsmodels	0.14.6	0.15.0
tqdm	4.70.0	4.70.1
typer	0.27.1	0.27.2
urllib3	2.7.0	2.8.0
uvicorn	0.52.4	0.54.0
wrapt	2.3.0	2.4.1
yarl	1.24.5	1.25.1

Updates anthropic from 1.0.0 to 1.8.0

Release notes

Sourced from anthropic's releases.

v1.8.0

1.8.0 (2026-09-22)

Full Changelog: v1.7.0...v1.8.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (f4f51c8)
• streaming: avoid a Python 3.13 crash at exit when a stream is left open (af029bd)
• tools: add_tools() takes effect straight away (#874) (06d0a6b)
• tools: leave reply-only params off the tool runner's compaction request (#871) (4687310)

Chores

• docs: add descriptions to the Dreams API reference (5574c63)
• docs: add descriptions to the User Profiles API reference (5574c63)
• docs: add memory store descriptions to the Managed Agents API reference (5574c63)
• docs: improve descriptions in the Dreams API reference (1f5e477)
• docs: simplify the session thread agent type description (a45b7ec)
• docs: update diagnostics field descriptions on beta messages (367750c)
• internal: fix tests (70c8cbd)
• internal: remove mypy (be01ed6)
• tests: update fixtures (77f6df8)

Documentation

• add path and header parameter descriptions (f429a30)

Refactors

• client: remove the request param transform in favour of the JSON encoder (539422c)

v1.7.0

1.7.0 (2026-09-18)

Full Changelog: v1.6.0...v1.7.0

Features

• api: add group with display_name to rate limits, deprecate group_type (28f0a83)
• tools: add compact_before_next_turn() to the tool runner (#641) (8b23fb3)

... (truncated)

Changelog

Sourced from anthropic's changelog.

1.8.0 (2026-09-22)

Full Changelog: v1.7.0...v1.8.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (f4f51c8)
• streaming: avoid a Python 3.13 crash at exit when a stream is left open (af029bd)
• tools: add_tools() takes effect straight away (#874) (06d0a6b)
• tools: leave reply-only params off the tool runner's compaction request (#871) (4687310)

Chores

• docs: add descriptions to the Dreams API reference (5574c63)
• docs: add descriptions to the User Profiles API reference (5574c63)
• docs: add memory store descriptions to the Managed Agents API reference (5574c63)
• docs: improve descriptions in the Dreams API reference (1f5e477)
• docs: simplify the session thread agent type description (a45b7ec)
• docs: update diagnostics field descriptions on beta messages (367750c)
• internal: fix tests (70c8cbd)
• internal: remove mypy (be01ed6)
• tests: update fixtures (77f6df8)

Documentation

• add path and header parameter descriptions (f429a30)

Refactors

• client: remove the request param transform in favour of the JSON encoder (539422c)

1.7.0 (2026-09-18)

Full Changelog: v1.6.0...v1.7.0

Features

• api: add group with display_name to rate limits, deprecate group_type (28f0a83)
• tools: add compact_before_next_turn() to the tool runner (#641) (8b23fb3)

Bug Fixes

... (truncated)

Commits

• 4421d56 Merge pull request #1946 from anthropics/release-please--branches--main--chan...
• d0247c2 release: 1.8.0
• be01ed6 chore(internal): remove mypy
• 06d0a6b fix(tools): add_tools() takes effect straight away (#874)
• af029bd fix(streaming): avoid a Python 3.13 crash at exit when a stream is left open
• 4687310 fix(tools): leave reply-only params off the tool runner's compaction request ...
• b5cc700 feat(api): add support for claude-opus-5-5, inline tool definitions and MCP t...
• 70c8cbd chore(internal): fix tests
• 539422c refactor(client): remove the request param transform in favour of the JSON en...
• 10a4c07 codegen metadata
• Additional commits viewable in compare view

Updates atlassian-python-api from 5.0.3 to 5.0.5

Release notes

Sourced from atlassian-python-api's releases.

5.0.5 Confluence server and Jira server bugfixes and more tests

What's Changed

• Add add_group_into_project_role to jira_server.py by @​neyrat-salvator in atlassian-api/atlassian-python-api#1671
• Fix/get_child_pages Method by @​dskdata in atlassian-api/atlassian-python-api#1674
• Add methods into init.py for work with plugins by @​neyrat-salvator in atlassian-api/atlassian-python-api#1678
• Fix attach_content on Confluence Server with an existing attachement by @​FSchumacher in atlassian-api/atlassian-python-api#1679
• Added get_page_id() and get_page_by_title() method for Cloud using V2 API by @​dskdata in atlassian-api/atlassian-python-api#1680

New Contributors

• @​FSchumacher made their first contribution in atlassian-api/atlassian-python-api#1679

Full Changelog: atlassian-api/atlassian-python-api@5.0.4...5.0.5

5.0.4 Confluence api method fix and new Company Calendar API

What's Changed

• Company Calendar: REST API implementation by @​gonchik in atlassian-api/atlassian-python-api#1657
• feat(bitbucket): add inline PR comment support for specific lines and files by @​mrcrysta1 in atlassian-api/atlassian-python-api#1662
• Pass expand via params in ConfluenceServer.get_page_space by @​Steve0x2a in atlassian-api/atlassian-python-api#1664
• fix(confluence): pass expand param correctly in get_page_space() by @​mrcrysta1 in atlassian-api/atlassian-python-api#1665
• Improve get_page_id method to return None if no results found by @​dskdata in atlassian-api/atlassian-python-api#1667
• Add again move_or_update_attachment_json_rpc to init.py by @​neyrat-salvator in atlassian-api/atlassian-python-api#1669
• fix: use GET+POST instead of PUT for Confluence Server attach_content (#1660) by @​mrcrysta1 in atlassian-api/atlassian-python-api#1666

New Contributors

• @​Steve0x2a made their first contribution in atlassian-api/atlassian-python-api#1664
• @​dskdata made their first contribution in atlassian-api/atlassian-python-api#1667

Full Changelog: atlassian-api/atlassian-python-api@5.0.3...5.0.4

Commits

• f550fd2 Pump version
• 36115cf Polish test
• 2888157 Work on tests
• b2f620a Add methods to retrieve page by title and get page ID using V2 API (#1680)
• 1b73d43 Crowd: Added crowd tests
• 66d6d01 Add general tests
• e89b3d6 Marketplace tests
• 918c009 X-Ray: mocks
• 06722f8 StatusPage: tests
• eba6fba linter
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates lxml from 6.1.2 to 6.1.3

Changelog

Sourced from lxml's changelog.

6.1.3 (2026-09-02)

Bugs fixed

• LP#2165901: External parameter entity parsing was allowed by default (with resolve_entities="internal"). Issue found by Tomer Fichman.

Commits

• 3c1a4c7 Prepare release of 6.1.3.
• c1191fc Update changelog.
• 03ec312 Disable parameter entity parsing when internal-only entity parsing is requested.
• 11d03e9 Build: Prevent duplicate Py3.8 wheel builds.
• 9efc586 Build: Exclude musllinux-ARM from Py3.8 wheel building to prevent slow emulat...
• 9716fb1 Build: Include older PyPy versions.
• 0f3327d Build: Exclude Win-Aarch64 from wheel build.
• 6967c96 Build: Make all built wheels downloadable even if they don't pass the release...
• 061218d Build: Exclude Py3.15 i686 wheels from validation (because they are intention...
• ce9fe0d Build: Fix Py3.8 windows build.
• See full diff in compare view

Updates openai from 3.3.1 to 3.19.2

Release notes

Sourced from openai's releases.

v3.19.2

3.19.2 (2026-09-23)

Bug Fixes

• preserve single files for fallback extraction paths (#3875) (bfd3680)

Chores

• api: clarify approximate web search location defaults (#3953) (a95c95e)
• api: clarify Realtime modality array definitions (#3954) (e79cf53)
• api: correct fine-tuning bounds and Realtime response reference (#3949) (325a948)

v3.19.1

3.19.1 (2026-09-23)

Bug Fixes

• chat: preserve single-pass tool iterables (#3770) (33ffa1f)
• client: merge HTTP headers case-insensitively (#3486) (5e39766)

Chores

• api: clarify Chat Completions seed limits (#3945) (be9d666)

Documentation

• clarify collaborator-only pull request policy (#3948) (ead1fa2)

v3.19.0

3.19.0 (2026-09-22)

Features

• api: add GCP external storage support (#3943) (d12d60f)
• api: add GPT-Rosalind research model (#3940) (d041d73)

Bug Fixes

• _utils/_transform: propagate api_exclude in _async_transform_recursive (#3324) (161ae65)
• api: handle omission markers in queued WebSocket events (#3944) (63e4616)
• client: retry only replayable request content (#3771) (6e0c2be)
• client: tolerate older optional aiohttp installations (#3941) (0d91efb)

... (truncated)

Changelog

Sourced from openai's changelog.

3.19.2 (2026-09-23)

Bug Fixes

• preserve single files for fallback extraction paths (#3875) (bfd3680)

Chores

• api: clarify approximate web search location defaults (#3953) (a95c95e)
• api: clarify Realtime modality array definitions (#3954) (e79cf53)
• api: correct fine-tuning bounds and Realtime response reference (#3949) (325a948)

3.19.1 (2026-09-23)

Bug Fixes

• chat: preserve single-pass tool iterables (#3770) (33ffa1f)
• client: merge HTTP headers case-insensitively (#3486) (5e39766)

Chores

• api: clarify Chat Completions seed limits (#3945) (be9d666)

Documentation

• clarify collaborator-only pull request policy (#3948) (ead1fa2)

3.19.0 (2026-09-22)

Features

• api: add GCP external storage support (#3943) (d12d60f)
• api: add GPT-Rosalind research model (#3940) (d041d73)

Bug Fixes

• _utils/_transform: propagate api_exclude in _async_transform_recursive (#3324) (161ae65)
• api: handle omission markers in queued WebSocket events (#3944) (63e4616)
• client: retry only replayable request content (#3771) (6e0c2be)
• client: tolerate older optional aiohttp installations (#3941) (0d91efb)
• helpers: use asyncio.get_running_loop() inside async methods (#3289) (bac3545)

3.18.0 (2026-09-22)

... (truncated)

Commits

• d9f7b7a release: 3.19.2 (#3951)
• e79cf53 chore(api): clarify Realtime modality array definitions (#3954)
• a95c95e chore(api): clarify approximate web search location defaults (#3953)
• 325a948 chore(api): correct fine-tuning bounds and Realtime response reference (#3949)
• bfd3680 fix: preserve single files for fallback extraction paths (#3875)
• 4d12746 release: 3.19.1 (#3946)
• 33ffa1f fix(chat): preserve single-pass tool iterables (#3770)
• 5e39766 fix(client): merge HTTP headers case-insensitively (#3486)
• ead1fa2 docs: clarify collaborator-only pull request policy (#3948)
• be9d666 chore(api): clarify Chat Completions seed limits (#3945)
• Additional commits viewable in compare view

Updates protobuf from 7.36.0 to 7.36.2

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates sentry-sdk from 2.68.0 to 2.70.0

Release notes

Sourced from sentry-sdk's releases.

2.70.0

New Features ✨

• New integration: Mistral AI (#4733) by @​alexander-alderman-webb

  Add the Mistral integration to your sentry_sdk.init call:

import sentry_sdk
from sentry_sdk.integrations.mistral import MistralIntegration
sentry_sdk.init(
dsn="...",
traces_sample_rate=1.0,
integrations=[
MistralIntegration(),
]
)

• New option: A fine-grained way to configure what data should be sent from the SDK.

  Offers much more flexibility than send_default_pii, allowing you to specify what data should be collected. If data_collection is defined, it takes precedence over send_default_pii.

  See https://docs.sentry.io/platforms/python/configuration/options/#data_collection for the available configuration options.

import sentry_sdk
sentry_sdk.init(
data_collection={
"user_info": False,
"gen_ai": {"inputs": False, "outputs": False},
"graphql": {"document": False, "variables": False},
"database_query_data": False,
"queues": False,
"http_bodies": [],
"cookies": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
"http_headers": {
"request": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
},
</tr></table>

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.70.0

New Features ✨

• New integration: Mistral AI (#4733) by @​alexander-alderman-webb

  Add the Mistral integration to your sentry_sdk.init call:

import sentry_sdk
from sentry_sdk.integrations.mistral import MistralIntegration
sentry_sdk.init(
dsn="...",
traces_sample_rate=1.0,
integrations=[
MistralIntegration(),
]
)

• New option: A fine-grained way to configure what data should be sent from the SDK.

  Offers much more flexibility than send_default_pii, allowing you to specify what data should be collected. If data_collection is defined, it takes precedence over send_default_pii.

  See https://docs.sentry.io/platforms/python/configuration/options/#data_collection for the available configuration options.

import sentry_sdk
sentry_sdk.init(
data_collection={
"user_info": False,
"gen_ai": {"inputs": False, "outputs": False},
"graphql": {"document": False, "variables": False},
"database_query_data": False,
"queues": False,
"http_bodies": [],
"cookies": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
"http_headers": {
"request": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
</tr></table>

... (truncated)

Commits

• 1eb7df5 Update CHANGELOG.md
• 92fd42b release: 2.70.0
• d99edef ref(data-collection): Promote data_collection from _experiments o top-lev...
• 045d2c1 test: Close client on teardown (#7562)
• b454d7d feat(mistral): Record gen_ai.output.messages (#7549)
• bdfd68c feat(mistral): Record gen_ai.input.messages (#7548)
• ea08f64 feat(mistral): Record gen_ai.system_instructions (#7547)
• dbddd0e feat(mistral): Record request parameters (#7531)
• 9342968 feat(mistral): Record token usage (#7529)
• 988fd0e feat(mistral): Add integration with Chat.complete and Chat.complete_async...
• Additional commits viewable in compare view

Updates spacy from 3.8.13 to 3.8.16

Release notes

Sourced from spacy's releases.

v3.8.16

No release notes provided.

v3.8.15: Fix click requirement

Typer removed click as a dependency in favour of vendoring it, but spaCy imports from Click, so the requirement needs to be added.

v3.8.14: Bug fix for model downloading in environments without pip on PATH

• Fix spacy download failing in environments where pip is not on PATH but is available as a Python module (e.g., some virtual environments and containers)

Commits

• 26b4d1d Remove publish_pypi workflow
• aed14d1 Increment version
• 66d2948 Fix build directory [ci skip]
• ca59885 Improve bandwidth usage on Netlify (#14024) [ci skip]
• f69c32f Install click with previous spaCy in upgrade test
• 29bc4f2 Fix release smoke/upgrade tests
• 86edb26 Build linux wheels in manylinux_2_28 containers
• 7a64151 Cap hypothesis below 6.156 to keep win_arm64 wheel builds working
• 768e8d5 Fix CI: bump mypy pin for numpy 2.5 stubs, sync confection pin
• edd3d0f Format tests README code blocks for ruff 0.16 markdown formatting
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.52 to 2.1.1

Release notes

Sourced from sqlalchemy's releases.

2.1.1

Released: September 25, 2026

platform

• [platform] [bug] Removed the legacy underscore-separated extra names such as mssql_pymssql and postgresql_psycopg from pyproject.toml. They normalize to the same names as the existing dash-separated extras, which is disallowed by PEP 685, and caused the 2.1.0 source distribution to fail to build with installers that enforce this rule, such as uv. The underscore spellings continue to work when installing, as installers normalize extra names before matching them.

  References: #13604

2.1.0

Released: September 24, 2026

orm

• [orm] [feature] Added _orm.composite.column_template parameter to _orm.composite(). When the composite class is a dataclass, this parameter accepts a string template such as "person_%s", containing exactly one %s placeholder, that's used to generate column names for dataclass fields that don't otherwise have an explicit name, rather than using the bare field name. This removes the need to hand-write a _orm.mapped_column() for each field when the same composite dataclass is mapped multiple times on the same class with different column-name prefixes. Pull request courtesy Leonardo Rosa.

  References: #12575

• [orm] [bug] Fixed issue where pickling an ORM object that had an instance level lazy loader established, such as when the _orm.raiseload() option is used, would emit a spurious warning regarding the loader containing additional criteria, if the object had itself been unpickled from a previous serialization. This would occur for objects that cross more than one serialization boundary, such as when using multiprocessing.

  This change is also backported to: 2.0.53

  References: #13574

• [orm] [bug] Fixed issue where calling _orm.aliased() against an existing _orm.aliased() construct, without passing an explicit selectable, would disregard the selectable of the existing construct and produce an

... (truncated)

Commits

• See full diff in compare view

Updates starlette from 1.6.0 to 1.7.0

Release notes

Sourced from starlette's releases.

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Changelog

Sourced from starlette's changelog.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.