Skip to content

chore(deps): bump the production-dependencies group with 11 updates - #167

Closed
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/pip/staging/production-dependencies-872495ba9a
Closed

chore(deps): bump the production-dependencies group with 11 updates#167
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/pip/staging/production-dependencies-872495ba9a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates:

Package From To
alembic 1.18.5 1.19.0
cachetools 7.1.4 7.1.7
cryptography 49.0.0 50.0.0
fastapi 0.139.2 0.141.1
gitpython 3.1.53 3.1.58
grpcio 1.82.1 1.83.0
grpcio-testing 1.82.1 1.83.0
grpcio-tools 1.82.1 1.83.0
phonenumbers 9.0.34 9.0.36
sentry-sdk 2.66.0 2.66.1
tqdm 4.69.0 4.70.0

Updates alembic from 1.18.5 to 1.19.0

Release notes

Sourced from alembic's releases.

1.19.0

Released: August 4, 2026

changed

  • [changed] [installation] Environmental updates:

    -   Trove classifiers now include Python 3.15 which is now part of CI
    integration

      

    • 

      Python 3.14 is also added to trove classifiers which had been previously
omitted
      

      • 

    • 

      Implemented PEP 604 style unions in type annotations

feature

  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK constraints, as part of the default autogenerate behavior. Detection is name-based only; a constraint whose name is unchanged is presumed equivalent regardless of its expression text, as reliably normalizing SQL expressions across backends for comparison purposes is not generally feasible. This behavior is implemented as a plugin named alembic.autogenerate.checkconstraint_byname, and may be disabled if not desired by excluding it from the EnvironmentContext.configure.autogenerate_plugins list. Pull request courtesy Francois van Kempen.

    References: #508

bug

  • [bug] [commands] Fixed inconsistency where running stamp or downgrade to base in offline (--sql) mode would emit a DROP TABLE alembic_version statement, while the same operations in online mode never drop the version table. Offline mode no longer emits this DROP, matching online behavior. The version table continues to be created when it does not exist; only the spurious offline-only drop has been removed. Pull request courtesy imurodl.

    References: #1822

Commits

Updates cachetools from 7.1.4 to 7.1.7

Changelog

Sourced from cachetools's changelog.

v7.1.7 (2026-08-01)

  • Improve Cache.__setitem__ behavior when replacing an existing cache item with a larger value.

  • Update CI environment.

v7.1.6 (2026-07-24)

  • Minor style improvements to keep ruff happy.

v7.1.5 (2026-07-23)

  • Fix TLRUCache silently keeping stale values on expired overwrites.

  • Reject negative cache item getsizeof values.

  • Update build environment.

Commits

Updates cryptography from 49.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates fastapi from 0.139.2 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

0.141.0

Features

  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates gitpython from 3.1.53 to 3.1.58

Release notes

Sourced from gitpython's releases.

3.1.58 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

... (truncated)

Commits
  • 30be45d prepare changelog for upcoming release
  • fc2f02c Merge pull request #2197 from Cyrus580529/shared-symlink-guard
  • b10e250 test: use the shared guard instead of local copies
  • e3e5da8 test: skip tests that need symlink privileges
  • 30d05e3 test: add a shared symlink capability guard
  • 9a8f6fe Merge pull request #2204 from gitpython-developers/security-fixes
  • f2550b6 Guard pathspec file inputs in high-level commands
  • d9ddb55 Guard unsafe git init options
  • 9b5dcaf Guard read-tree index output paths
  • 96a888f Check joined short-option values before Git execution
  • Additional commits viewable in compare view

Updates grpcio from 1.82.1 to 1.83.0

Release notes

Sourced from grpcio's releases.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
  • [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

  • Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
  • [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

  • [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
  • [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
  • [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
  • [Python] Pyright typeCheckingMode - standard. (#42739)
  • [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
  • [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
  • [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)
Commits
  • c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
  • b5c40cd [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower boun...
  • 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
  • b215f80 [Release] Bump core version to 56.0.0 for upcoming release (#42934)
  • cf95af0 [Python] Add abort_with_status to the aio ServicerContext ABC (#42733)
  • 725c173 Automated rollback of commit 8848182a65239ce4a7a26650c82aee3ec7ed1eee.
  • 821431b [PH2] Induced Frames and Reset Frames for PH2
  • 6d0b58e disable metadata_publish_to_app_tag experiment
  • 41d533a Implement Weighted Random Shuffling and CDS Weight Normalization for pick_fir...
  • 8848182 [xDS] split up the grpc_xds_client BUILD target (#42872)
  • Additional commits viewable in compare view

Updates grpcio-testing from 1.82.1 to 1.83.0

Updates grpcio-tools from 1.82.1 to 1.83.0

Release notes

Sourced from grpcio-tools's releases.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
  • [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

  • Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
  • [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

  • [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
  • [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
  • [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
  • [Python] Pyright typeCheckingMode - standard. (#42739)
  • [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
  • [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
  • [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)
Commits
  • c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
  • 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
  • 1454079 [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 (#42914)
  • 6953d6a [Python] Remove 3.15 until Python 3.15 RC is released. (#42900)
  • b025e18 [Python] Support 3.15 (#42388)
  • b6a490e [Python][grpcio-tools] Fix build error when CXX contains spaces (#42742)
  • 8a56164 [Core] Upgrade to protobuf@35.1 to get upstream MSVC bug fix. (#42773)
  • 95f01e5 [Release] Bump version to 1.83.0-dev (on master branch) (#42638)
  • f72dd8c [Python] Trim Python2 backward compatibility syntax - remove "future" (#4...
  • See full diff in compare view

Updates phonenumbers from 9.0.34 to 9.0.36

Commits
  • 5fc9318 Prep for 9.0.36 release
  • eefd53f Generated files for metadata
  • 064dc99 Merge metadata changes from upstream 9.0.36
  • bf0c2ed Fix geocoder returning empty when longer prefix lacks requested language (#323)
  • 314e40f Prep for 9.0.35 release
  • ba1f5b1 Generated files for metadata
  • 6245715 Merge metadata changes from upstream 9.0.35
  • See full diff in compare view

Updates sentry-sdk from 2.66.0 to 2.66.1

Release notes

Sourced from sentry-sdk's releases.

2.66.1

Bug Fixes 🐛

Tracing

Internal Changes 🔧

Changelog

Sourced from sentry-sdk's changelog.

2.66.1

Bug Fixes 🐛

Tracing

Internal Changes 🔧

Commits
  • 653a292 Update CHANGELOG.md
  • e20c226 release: 2.66.1
  • 4524b65 fix(tracing): Stop setting NoOpSpan on scope in the streaming trace lifecyc...
  • 2e9f26e ref(tracing): No-op and emit warning in start_transaction with the streamin...
  • 3a50950 fix(tracing): handle exceptions raised within traces_sampler and other callba...
  • b5171b7 ref: Use top-level trace_lifecycle and ignore_spans options in tests (#6855)
  • 17e0348 ref: Use old sampling context format in span streaming (#6848)
  • 2e09497 test: Add streaming tests to test_http_headers (#6785)
  • 9996734 feat(tracing): Send sentry.segment.name.source instead of `sentry.span.sour...
  • 00224f7 remove span streaming docs in changelog (#6831)
  • Additional commits viewable in compare view

Updates tqdm from 4.69.0 to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

  • contrib.concurrent: major improvements
    • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
    • fix total based on shortest iterable length (#1473)
    • use default max_workers (#1543 <- #1530, #1518)
    • support timeout, buffersize (#1576)
    • improve ETA (#1708 <- #1161)
    • update as_completed (#1709 <- #1565)
    • add tqdm.concurrent.intepreter_map (#1777)
  • asyncio: support iterables with only __aiter__ (#1714 <- #1686)
  • support reset(float("inf")) (#1783 <- #1781, #651)
  • framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

Commits
  • 96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
  • c27393e misc tidy
  • 061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
  • 9fc160b Update how we check for interpreter_map support in the tests
  • b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
  • 16d5486 Add support for nested progress bars
  • 9f5890f Add initial implementation for interpreter_map
  • 321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
  • 4664b57 minor tidy
  • 426a098 Treat inf total as unknown in reset() too
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group with 11 updates
8852f06 
Bumps the production-dependencies group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.5` | `1.19.0` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.4` | `7.1.7` |
| [cryptography](https://github.com/pyca/cryptography) | `49.0.0` | `50.0.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.2` | `0.141.1` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.53` | `3.1.58` |
| [grpcio](https://github.com/grpc/grpc) | `1.82.1` | `1.83.0` |
| [grpcio-testing](https://grpc.io) | `1.82.1` | `1.83.0` |
| [grpcio-tools](https://github.com/grpc/grpc) | `1.82.1` | `1.83.0` |
| [phonenumbers](https://github.com/daviddrysdale/python-phonenumbers) | `9.0.34` | `9.0.36` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.66.0` | `2.66.1` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.69.0` | `4.70.0` |


Updates `alembic` from 1.18.5 to 1.19.0
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `cachetools` from 7.1.4 to 7.1.7
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v7.1.4...v7.1.7)

Updates `cryptography` from 49.0.0 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

Updates `fastapi` from 0.139.2 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.2...0.141.1)

Updates `gitpython` from 3.1.53 to 3.1.58
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.53...3.1.58)

Updates `grpcio` from 1.82.1 to 1.83.0
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.82.1...v1.83.0)

Updates `grpcio-testing` from 1.82.1 to 1.83.0

Updates `grpcio-tools` from 1.82.1 to 1.83.0
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.82.1...v1.83.0)

Updates `phonenumbers` from 9.0.34 to 9.0.36
- [Commits](daviddrysdale/python-phonenumbers@v9.0.34...v9.0.36)

Updates `sentry-sdk` from 2.66.0 to 2.66.1
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.66.0...2.66.1)

Updates `tqdm` from 4.69.0 to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.69.0...v4.70.0)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: cachetools
  dependency-version: 7.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gitpython
  dependency-version: 3.1.58
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: grpcio
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: grpcio-testing
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: grpcio-tools
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: phonenumbers
  dependency-version: 9.0.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.66.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 13, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/staging/production-dependencies-872495ba9a branch August 13, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants