Skip to content

chore(deps): bump the productiondependencies group across 6 directories with 5 updates - #238

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/extensions/all-postgres/template/productiondependencies-1a0ff10118
Open

chore(deps): bump the productiondependencies group across 6 directories with 5 updates#238
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/extensions/all-postgres/template/productiondependencies-1a0ff10118

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on psycopg, mlflow, sentry-sdk, sqlalchemy and uvicorn to permit the latest version.
Updates psycopg to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
  • Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
  • Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
  • Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
  • Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
  • Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
  • Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).
  • Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
  • Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
  • Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
  • Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
  • Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
  • Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits
  • a67654d chore: bump psycopg package version to 3.3.6
  • 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
  • 42966e9 test: add helpful comments to some tests
  • 5e8797f test: add reasonable connect_timeout to most tests
  • c81ba62 perf: reduce the overhead of wait_async()
  • d2bbfe4 refactor: use get_running_loop() in the async wait functions
  • 2b1484a test: add a script to measure the async wait functions
  • 573cf4a test: fix incorrect wait timing test
  • 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
  • 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
  • Additional commits viewable in compare view

Updates mlflow to 3.16.1

Release notes

Sourced from mlflow's releases.

MLflow 3.16.1 is a patch release that includes bug fixes and documentation updates.

Breaking changes:

Features:

Bug fixes:

  • [Tracing] Resolve Unity Catalog trace locations in Databricks Model Serving without local-store validation (#25884, @​james-fletcher-db)
  • [Model Registry] Fix S3 multipart upload encryption arguments (#25772, @​james-fletcher-db)
  • [Tracking / UI] basic-auth: serve the web UI to non-admins under fail-closed authorization (#25672, @​mkBGD)
Changelog

Sourced from mlflow's changelog.

3.16.1 (2026-09-15)

MLflow 3.16.1 is a patch release that includes bug fixes and documentation updates.

Breaking changes:

Features:

Bug fixes:

  • [Tracing] Resolve Unity Catalog trace locations in Databricks Model Serving without local-store validation (#25884, @​james-fletcher-db)
  • [Model Registry] Fix S3 multipart upload encryption arguments (#25772, @​james-fletcher-db)
  • [Tracking / UI] basic-auth: serve the web UI to non-admins under fail-closed authorization (#25672, @​mkBGD)

3.15.2 (2026-08-25)

MLflow 3.15.2 is a patch release that includes several major features and improvements.

Features:

Bug fixes:

3.15.1 (2026-08-03)

MLflow 3.15.1 is a patch release that includes bug fixes and documentation updates.

Bug fixes:

  • [Model Registry] Skip env_pack on ARM client images (#24762) (#24835, @​qyc)
  • [Scoring / Tracking] Harden version parsing against missing/non-PEP440 versions on Databricks Serverless (+ lint rule) (#24799) (#24813, @​PattaraS)

Documentation updates:

3.15.0 (2026-07-31)

... (truncated)

Commits
  • 32792af Update 3.16.1 changelog for #25884 (#25919)
  • 2d8856f [3.16] Resolve UC trace location in model serving without local-store validat...
  • ca721f4 [3.16] Update bundled mlflow/assistant/skills to latest upstream (#25918)
  • ff9e48b Update CHANGELOG for 3.16.1 (#25872)
  • b7ab3d1 Replace MinIO with RustFS in mlflow_artifacts example (#25808)
  • d2bd515 Adapt admin bootstrap tests for branch-3.16
  • 3730ed8 Fix S3 multipart upload encryption arguments (#25772)
  • 93c11e1 Remove the default basic-auth admin password shipped in basic_auth.ini (GHS...
  • 25240dd basic-auth: serve the web UI to non-admins under fail-closed authorization (#...
  • 5c36ecb Add a timeout option to the @scorer decorator (#25720)
  • Additional commits viewable in compare view

Updates psycopg to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
  • Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
  • Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
  • Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
  • Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
  • Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
  • Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).
  • Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
  • Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
  • Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
  • Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
  • Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
  • Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits
  • a67654d chore: bump psycopg package version to 3.3.6
  • 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
  • 42966e9 test: add helpful comments to some tests
  • 5e8797f test: add reasonable connect_timeout to most tests
  • c81ba62 perf: reduce the overhead of wait_async()
  • d2bbfe4 refactor: use get_running_loop() in the async wait functions
  • 2b1484a test: add a script to measure the async wait functions
  • 573cf4a test: fix incorrect wait timing test
  • 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
  • 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
  • Additional commits viewable in compare view

Updates sentry-sdk to 2.69.2

Release notes

Sourced from sentry-sdk's releases.

2.69.2

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

Huggingface Hub

Pydantic Ai

Other

Other

Changelog

Sourced from sentry-sdk's changelog.

2.69.2

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

Huggingface Hub

Pydantic Ai

Other

Other

2.69.1

New Features ✨

Bug Fixes 🐛

... (truncated)

Commits

Updates sqlalchemy to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

  • [platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

  • [platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

    References: #13592

Commits

Updates uvicorn to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

... (truncated)

Commits
  • 421708f Version 0.53.0 (#3136)
  • f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
  • 63971ed Document HTTP/2 support (#3130)
  • 7d1a005 Remove race from multiprocess health check test (#3128)
  • 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
  • 098b206 Remove timing race from SIGHUP supervisor test (#3127)
  • 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
  • 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
  • fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
  • fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the productiondependencies group across 6 directori…
fe76ada 
…es with 5 updates

Updates the requirements on [psycopg](https://github.com/psycopg/psycopg), [mlflow](https://github.com/mlflow/mlflow), [sentry-sdk](https://github.com/getsentry/sentry-python), [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) and [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version.

Updates `psycopg` to 3.3.6
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.5...3.3.6)

Updates `mlflow` to 3.16.1
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/v3.16.1/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.16.0...v3.16.1)

Updates `psycopg` to 3.3.6
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.5...3.3.6)

Updates `sentry-sdk` to 2.69.2
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.69.1...2.69.2)

Updates `sqlalchemy` to 2.0.54
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `uvicorn` to 0.53.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.53.0)

---
updated-dependencies:
- dependency-name: psycopg
  dependency-version: 3.3.6
  dependency-type: direct:production
  dependency-group: productiondependencies
- dependency-name: mlflow
  dependency-version: 3.16.1
  dependency-type: direct:production
  dependency-group: productiondependencies
- dependency-name: psycopg
  dependency-version: 3.3.6
  dependency-type: direct:production
  dependency-group: productiondependencies
- dependency-name: sentry-sdk
  dependency-version: 2.69.2
  dependency-type: direct:production
  dependency-group: productiondependencies
- dependency-name: sqlalchemy
  dependency-version: 2.0.54
  dependency-type: direct:production
  dependency-group: productiondependencies
- dependency-name: uvicorn
  dependency-version: 0.53.0
  dependency-type: direct:production
  dependency-group: productiondependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 21, 2026
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 21, 2026
@coderabbitai

coderabbitai Bot commented Sep 21, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6f84c3a3-3efb-4701-85f2-fe7480163990

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ulises-jeremias ulises-jeremias Awaiting requested review from ulises-jeremias ulises-jeremias is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants