[dependabot]

Bumps the uv-all group with 3 updates in the / directory: pydantic-settings, starlette and ty.

Updates pydantic-settings from 2.16.1 to 2.16.2

Release notes

Sourced from pydantic-settings's releases.

v2.16.2

Highlights

This patch release fixes env decoding of nested dictionary values, CliApp handling of AliasPath, nested secrets directory precedence and discriminated union defaults with nested_model_default_partial_update.

Behavior changes

• An explicit secrets_dir on NestedSecretsSettingsSource now takes precedence (#1093). Previously it was ignored when the wrapped SecretsSettingsSource inherited a directory from model config, and an explicit empty list was masked too. The order is now: the wrapper's secrets_dir argument, then the wrapped source's directory, then model config. If you pass both Settings(_secrets_dir=...) and NestedSecretsSettingsSource(..., secrets_dir=...), the wrapper's argument now wins.

Bug fixes

Env and dotenv sources

• Dictionary values typed as a union, such as dict[str, list[str] | str] or dict[str, list[str] | None], now JSON-decode values set through env_nested_delimiter (#1089, #1097). Only JSON arrays and objects are decoded, so plain values like 123, true or "quoted" are kept as strings. Decoding follows enable_decoding and the NoDecode/ForceDecode of the field that holds the dict, and type aliases and Annotated value types are resolved.
• Nested dictionary values such as dict[str, list[dict[str, str]]] are decoded at the right level again (#1109), so APP_VALUES__X='[{"k":"v"}]' no longer reaches validation as a string.

CLI

• CliApp.run now rebuilds AliasPath inputs for BaseModel and pydantic dataclass commands (#1096). A supplied path used to be reduced to the field name, which failed validation. AliasChoices priority is respected and unsupplied path defaults are left to the model.

Discriminated union defaults

• With nested_model_default_partial_update=True, inner discriminated unions written as Annotated[..., Field(discriminator='...')] are now detected (#1076). When the incoming tag selects another member, the default's fields are no longer merged into it.
• A stdlib dataclass default on a discriminated union field no longer raises NameError when another field of the dataclass has a string annotation naming a local class (#1077). Only the discriminator's own annotation is resolved now.

What's Changed

• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056
• Detect nested Field discriminators in default partial updates by @​digit50 in pydantic/pydantic-settings#1076
• Resolve only the discriminator annotation of stdlib dataclass defaults by @​digit50 in pydantic/pydantic-settings#1077
• Decode nested dictionary values with complex union types by @​chering14 in pydantic/pydantic-settings#1089
• Fix regressions from nested dict union value decoding (#1089) by @​hramezani in pydantic/pydantic-settings#1097
• Fix explicit nested secrets directory precedence by @​DivyamTalwar in pydantic/pydantic-settings#1093
• Fix CliApp reconstruction of AliasPath inputs by @​DivyamTalwar in pydantic/pydantic-settings#1096
• Fix JSON decoding of nested dictionary environment values by @​Hugohong258 in pydantic/pydantic-settings#1109
• Prepare release 2.16.2 by @​hramezani in pydantic/pydantic-settings#1111

New Contributors

• @​digit50 made their first contribution in pydantic/pydantic-settings#1076
• @​chering14 made their first contribution in pydantic/pydantic-settings#1089
• @​DivyamTalwar made their first contribution in pydantic/pydantic-settings#1093
• @​Hugohong258 made their first contribution in pydantic/pydantic-settings#1109

Full Changelog: pydantic/pydantic-settings@v2.16.1...v2.16.2

Commits

• 94150a0 Prepare release 2.16.2 (#1111)
• 9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
• 7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
• 2d1f924 Fix explicit nested secrets directory precedence (#1093)
• e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
• e71a53e Decode nested dictionary values with complex union types (#1089)
• 8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
• c50c853 Detect nested Field discriminators in default partial updates (#1076)
• 9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
• See full diff in compare view

Updates starlette from 1.9.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing #3665 and #3722.

Deprecated

• Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

• Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
• Keep path parameter values that look like another placeholder in url_path_for() #3725.
• Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
• Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
• Strip only one pair of matching outer quotes from Config env file values #3720.
• Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
• Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
• Ignore Range on requests other than GET and HEAD in FileResponse #3679.

Commits

• 8aa828c Version 1.10.0 (#3728)
• a85a5c3 Substitute URL path parameters in a single pass (#3725)
• 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
• b973efd Build URL-encoded form fields in parser callbacks (#3724)
• d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
• fb3e818 Compare remaining Match members by identity in routing (#3722)
• fc23aa1 Compare Match members by identity in Router.app (#3665)
• fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
• 4114432 Default omitted http.response.start headers in middlewares (#3721)
• 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
• Additional commits viewable in compare view

Updates ty from 0.0.91 to 0.0.95

Release notes

Sourced from ty's releases.

0.0.95

Release Notes

Released on 2026-10-29.

Bug fixes

• Accept another unpacked TypeVarTuple as a default (#29752)
• Accept keyword arguments for TypeAliasType name and value (#29802)
• Detect traversal budget exhaustion in products of lower bounds (#29679)
• Fix recursive protocol materialization self-comparison (#29809)
• Reject out-of-scope type variables in PEP 695 pack defaults (#29805)
• Use a trailing ParamSpec default after a TypeVarTuple (#29755)

LSP server

• Parenthesize assignment and generator expressions in argument hint edits (#29797)
• Place argument name inlay hints before grouping parentheses (#29794)
• Place variable type inlay hints after grouping parentheses (#29795)

Contributors

• @​carljm
• @​AlexWaygood
• @​charliermarsh

Install ty 0.0.95

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.95/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.95/ty-installer.ps1 | iex"

Download ty 0.0.95

File	Platform	Checksum
ty-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ty-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ty-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ty-i686-pc-windows-msvc.zip	x86 Windows	checksum
ty-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ty-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.95

Released on 2026-10-29.

Bug fixes

• Accept another unpacked TypeVarTuple as a default (#29752)
• Accept keyword arguments for TypeAliasType name and value (#29802)
• Detect traversal budget exhaustion in products of lower bounds (#29679)
• Fix recursive protocol materialization self-comparison (#29809)
• Reject out-of-scope type variables in PEP 695 pack defaults (#29805)
• Use a trailing ParamSpec default after a TypeVarTuple (#29755)

LSP server

• Parenthesize assignment and generator expressions in argument hint edits (#29797)
• Place argument name inlay hints before grouping parentheses (#29794)
• Place variable type inlay hints after grouping parentheses (#29795)

Contributors

• @​carljm
• @​AlexWaygood
• @​charliermarsh

0.0.94

Released on 2026-10-28.

Bug fixes

• Correctly handle line continuation when fixing unused ignore comments (#29781)
• Fix Linux x86-64 startup on older kernels (#4853)
• Fix a panic when a comprehension filter depends on a later binding (#29786)
• Fix a panic when sorting diagnostics without a source location (#29780)
• Fix panic on a chained assignment with a missing value (#29787)
• Reject defaulted TypeVars after a TypeVarTuple in legacy generic classes (#29753)

Other changes

• Django: suppress invalid-override errors for Meta configurations (#29769)

Contributors

• @​sharkdp
• @​charliermarsh
• @​MichaReiser

0.0.93

... (truncated)

Commits

• 48c5ea1 Bump version to 0.0.95 (#4870)
• 13ef399 Speed up releases by using larger runners for all Windows builds (#4805)
• f8ea270 Bump version to 0.0.94 (#4857)
• 7a36fc9 Fix Linux x86-64 startup on older kernels (#4853)
• 3db5e4d Bump version to 0.0.93 (#4842)
• f8fd0e8 Update astral-sh/setup-uv action to v10.3.2 (#4843)
• c1ca420 Update uv to v0.13.6 (#4845)
• 4c5c907 Update prek dependencies (#4844)
• 0445d64 Optimize Linux x86-64 ty releases with LLVM BOLT (#4833)
• 3933e69 Bump version to 0.0.92 (#4821)
• Additional commits viewable in compare view

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[cloudsmith-bot]

@dependabot rebase