Skip to content

chore(deps): bump the pip-backend-minors-patch group across 1 directory with 14 updates - #279

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dashboard/backend/pip-backend-minors-patch-0282d7df45
Closed

chore(deps): bump the pip-backend-minors-patch group across 1 directory with 14 updates#279
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dashboard/backend/pip-backend-minors-patch-0282d7df45

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip-backend-minors-patch group with 14 updates in the /dashboard/backend directory:

Package From To
fastapi 0.141.1 0.143.0
uvicorn 0.52.4 0.54.0
sqlalchemy 2.0.52 2.1.4
asyncpg 0.31.0 0.32.0
pydantic 2.12.5 2.14.0
alembic 1.19.1 1.20.0
flower 2.1.0 2.2.0
pytest-playwright 0.9.0 0.10.0
playwright 1.62.0 1.63.0
allure-pytest 2.16.0 2.16.2
psycopg2-binary 2.9.12 2.9.13
python-dotenv 1.2.2 1.2.4
locust 2.46.4 2.46.7
pyotp 2.9.0 2.10.0

Updates fastapi from 0.141.1 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits

Updates sqlalchemy from 2.0.52 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

    References: #13659

engine

  • [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

    This change is also backported to: 2.0.55

    References: #13640

  • [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

    This change is also backported to: 2.0.55

    References: #13641

  • [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

Updates asyncpg from 0.31.0 to 0.32.0

Release notes

Sourced from asyncpg's releases.

v0.32.0

Improvements

  • Support Python 3.15 (#1367, #1378) (by @​elprans in 1b118464 and 58c0c595)

  • Support PostgreSQL 19 (#1379) (by @​elprans in 8d2a5aed)

  • Make pool min_size a maintained connection floor and add init_size to control the number of connections opened at startup (#1323). Idle connections at or below min_size are retained, and closed connections are replaced in the background. init_size defaults to min_size. To preserve the previous behavior, where the pool could drain to zero, replace min_size=N with init_size=N, min_size=0. (by @​shatilov-diman in 67a1cbc5)

  • Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#1359) (by @​twelfthlabor in 00319a9b)

  • Use the statement cache for copy_records_to_table() introspection (#1360) (by @​matemax in dd058652)

Fixes

  • Clean up connections rejected by target_session_attrs immediately so an unresponsive rejected host cannot delay the selected connection, and cleanup tasks cannot outlive the event loop. Rejected connections are aborted without waiting for a graceful disconnect; servers may log "unexpected EOF on client connection" if the Terminate message is not delivered before the transport closes.

  • Fix a connection pool deadlock when releasing a connection after a protocol abort (#1324) (by @​pchaseh in 4a83cc2f)

  • Honor Connection.close(timeout=...) while waiting for a pending cancellation (#1361) (by @​gyanu2507 in c06bcb4d)

  • Prevent stuck cancellation from blocking connection teardown or pool release by bounding cancellation with the command or release timeout (#1370) (by @​elprans in 4cf02203)

  • Preserve the server error when the connection closes mid-operation (#1369) (by @​RitiGrover in 6c8f1a7a)

  • Fix COPY cleanup when a records generator raises, preserving the original exception and avoiding protocol desynchronization and stalled rollback (#1358) (by @​CodingCossack in fdc6bc8f)

... (truncated)

Commits
  • d701e11 asyncpg v0.32.0
  • b04f8f2 Bump to macOS 26 in runners, set deployment target to 11 (#1384)
  • 3934d77 tests: Capture expected pool retry warnings during role changes (#1383)
  • 2c37501 tests: Avoid DeprecationWarning when settings up uvloop (#1382)
  • b7eea79 Test pool min_size backoff on target attribute mismatch (#1381)
  • 46dda91 Terminate rejected target_session_attrs candidates before returning (#1380)
  • 8d2a5ae Support PostgreSQL 19 (#1379)
  • 58c0c59 Bump uvloop (#1378)
  • 67a1cbc Make pool min_size a maintained connection floor (#1323)
  • 25aaaf5 fix: allow cursors in external transactions (#1350)
  • Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Updates alembic from 1.19.1 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

  • [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

    References: #1846

  • [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

    References: #916

bug

  • [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

    References: #1768

  • [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

Updates flower from 2.1.0 to 2.2.0

Release notes

Sourced from flower's releases.

v2.2.0

Security

  • Added CSRF protection for cookie-authenticated sessions
  • Added protection against cross-site state-changing requests
  • Added an OAuth state check to all login handlers
  • Restricted the post-login redirect to local paths
  • Enabled TLS certificate validation for the RabbitMQ management API
  • Escaped all table cells on the tasks and workers pages
  • Escaped load average values in the workers grid
  • Added HttpOnly and SameSite to session cookies
  • Added the X-Content-Type-Options: nosniff header
  • Limited CORS headers to the unauthenticated API
  • Served API error messages as plain text

Features

  • Added a logout link for OAuth sessions #1074
  • Added a timeout option to the task apply API
  • Added a page size selector to the tasks page #1518
  • Linked task names to a list of all tasks with that name
  • Linked the task counts on the workers page to the matching tasks
  • Honored the column order of the tasks_columns option #1262
  • Added thousands separators to task counts #1374
  • Formatted durations and showed a dash for missing values
  • Added search examples as placeholder text
  • Made wide tables scroll sideways and shortened UUIDs on mobile
  • Limited worker page task lists to 50 entries by default #1087
  • Removed the Retried column from the workers page
  • Named browser tabs by page

Performance and reliability

  • Made persistent state saves atomic #1403
  • Fixed startup failing on a corrupt persistent state database #1398
  • Added a warning when state saving dominates the save interval
  • Reapplied --max-tasks to restored persistent state #1380
  • Honored the --purge-offline-workers grace period after worker-offline events #1190
  • Inspected a worker lazily on its first page visit #1388
  • Fetched worker task lists only when inspecting a single worker
  • Validated the --broker-api URL at startup
  • Required both --certfile and --keyfile when either is set
  • Validated task API query parameters and publish payloads

Bug fixes

  • Fixed worker task table column widths #1521 by @​ShubhAtWork
  • Fixed the default RabbitMQ management API URL to use the management port #1232
  • Fixed the theme dropdown not closing and stuck navbar tooltips
  • Fixed a server error on the task page for tasks without a name

... (truncated)

Commits
  • 4d4a9ac Set release version
  • b884844 Exclude compiled and hidden files from the sdist
  • fba84ef Merge remote-tracking branch 'origin/master' into 2.0
  • ea34f92 Fix broken and moved links in the docs
  • 1336fbd Fix the unpicklable state test on Python 3.10 to 3.13
  • 0f04846 Open the state shelves with context managers
  • 8034099 Apply the ruff style rewrites to the package
  • b14b43d Fix the ruff errors in the tests
  • b9f7189 Apply ruff's safe fixes and literal rewrites to the package
  • ff33bc8 Tidy the task API test bodies and name lookups
  • Additional commits viewable in compare view

Updates pytest-playwright from 0.9.0 to 0.10.0

Release notes

Sourced from pytest-playwright's releases.

v0.10.0

Highlights

Traces for playwright.request API contexts (#333). --tracing now also records contexts created with playwright.request.new_context(), one chunk per test, so a session-scoped API context yields a trace per test. The traces follow the same retain-on-failure handling, trace-N.zip naming and report attachments as browser traces. Requires Playwright 1.60 or newer.

Artifacts in test reports (#332). Kept screenshots, videos and traces are added to the teardown report as playwright_screenshot, playwright_video and playwright_trace user properties, so --junitxml writes them as <property> elements and pytest_runtest_logreport hooks and reporters can pick them up. With pytest-html >= 4 they are linked from the report, and embedded with --self-contained-html.

Reruns keep their own artifacts (#331). With pytest-rerunfailures, every attempt now writes to its own folder, test-results/<test>-retry1/ and so on, like Playwright Test. Attempts no longer overwrite each other.

Artifacts survive fixture failures in teardown (#330). --tracing retain-on-failure, --video retain-on-failure and --screenshot only-on-failure now keep artifacts when a fixture fails during teardown. A test skipped from a fixture no longer counts as failed.

Per-test browser launch options (#329):

@pytest.mark.parametrize(
    "browser_type_launch_args",
    [{"args": ["--lang=de-DE"]}],
    indirect=True,
)
def test_german(page):
    ...

Each distinct value launches its own browser; command line options such as --headed and --slowmo still apply.

Multi-browser parametrization fixes. Overriding the page fixture no longer drops --browser parametrization on older pytest versions (#314). browser_name is now parametrized indirectly, so tests keep their original order within a browser (#284).

VS Code debugger (#328). The browser is launched headed under the debugger only when a display is available. On Linux without DISPLAY or WAYLAND_DISPLAY set, it stays headless unless --headed is passed.

Breaking changes

  • pytest-base-url is now an optional dependency (#334). The plugin provides --base-url, the base_url ini option, the PYTEST_BASE_URL environment variable and the base_url fixture on its own. --verify-base-url needs the extra:

    pip install pytest-playwright[base-url]

  • Minimum pytest version is 7.0 for pytest-playwright and 8.2 for pytest-playwright-asyncio (#333).

  • python-slugify 9.x is now supported (#324).

Full Changelog: microsoft/playwright-pytest@v0.9.0...v0.10.0

Commits
  • 80d7569 feat: record traces of playwright.request API contexts (#333)
  • 63a07cd feat: make pytest-base-url an optional dependency (#334)
  • be5238a feat: attach screenshots, videos and traces to test reports (#332)
  • 543216d feat: keep artifacts of each pytest-rerunfailures attempt in its own folder (...
  • 4607d7c fix: keep artifacts when a fixture fails during teardown (#330)
  • cfd68b8 feat: allow per-test browser launch options via indirect parametrization (#329)
  • dc8396a fix: only default to headed under the VS Code debugger when a display is avai...
  • 0356d90 fix: keep multi-browser parametrization when the page fixture is overridden (...
  • 838da8d fix: Make 'browser_name' parameter indirect (#284)
  • 6dfaff3 chore(deps-dev): bump setuptools in /pytest-playwright-asyncio (#327)
  • Additional commits viewable in compare view

Updates playwright from 1.62.0 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🪟 Locate across frames

page.frame_locator() and frame.frame_locator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

# Finds the button in any frame on the page.
page.frame_locator().get_by_role("button").click()

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

page.locator("button").visible.click()

🖼️ Aria and screen snapshots in traces

New aria_snapshots and screen_snapshots options of tracing.start() capture an aria snapshot and a screenshot of the page on every action:

context.tracing.start(snapshots=True, aria_snapshots=True, screen_snapshots=True)

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

Command line

  • playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
  • playwright codegen --http-credentials records against pages behind HTTP authentication.

Announcements

  • ⚠️ Ubuntu 20.04 is not supported anymore.
  • 🐧 On Linux arm64, Playwright now downloads the Chrome for Testing build of Chromium, the same build used on all other platforms.

... (truncated)

Commits
  • 8cb967b cherry-pick(#3200): devops(docker): move docker publishing to Azure Pipelines
  • ab18c77 chore: roll Playwright to 1.63.0 (#3198)
  • 0e66a09 devops(pipeline): resolve pip and npm packages from DevDiv_PublicPackages fee...
  • 010a9cc Pin GitHub Actions to full-length commit SHAs (#3176)
  • 154f67c fix(s...

    Description has been truncated

@dependabot
chore(deps): bump the pip-backend-minors-patch group across 1 directo…
25e9f4f 
…ry with 14 updates

Bumps the pip-backend-minors-patch group with 14 updates in the /dashboard/backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.143.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.52` | `2.1.4` |
| [asyncpg](https://github.com/MagicStack/asyncpg) | `0.31.0` | `0.32.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.14.0` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.19.1` | `1.20.0` |
| [flower](https://github.com/mher/flower) | `2.1.0` | `2.2.0` |
| [pytest-playwright](https://github.com/microsoft/playwright-pytest) | `0.9.0` | `0.10.0` |
| [playwright](https://github.com/microsoft/playwright-python) | `1.62.0` | `1.63.0` |
| [allure-pytest](https://github.com/allure-framework/allure-python) | `2.16.0` | `2.16.2` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.4` |
| [locust](https://github.com/locustio/locust) | `2.46.4` | `2.46.7` |
| [pyotp](https://github.com/pyauth/pyotp) | `2.9.0` | `2.10.0` |



Updates `fastapi` from 0.141.1 to 0.143.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.143.0)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.54.0)

Updates `sqlalchemy` from 2.0.52 to 2.1.4
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `asyncpg` from 0.31.0 to 0.32.0
- [Release notes](https://github.com/MagicStack/asyncpg/releases)
- [Commits](MagicStack/asyncpg@v0.31.0...v0.32.0)

Updates `pydantic` from 2.12.5 to 2.14.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.5...v2.14.0)

Updates `alembic` from 1.19.1 to 1.20.0
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `flower` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/mher/flower/releases)
- [Commits](mher/flower@v2.1.0...v2.2.0)

Updates `pytest-playwright` from 0.9.0 to 0.10.0
- [Release notes](https://github.com/microsoft/playwright-pytest/releases)
- [Commits](microsoft/playwright-pytest@v0.9.0...v0.10.0)

Updates `playwright` from 1.62.0 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright-python/releases)
- [Commits](microsoft/playwright-python@v1.62.0...v1.63.0)

Updates `allure-pytest` from 2.16.0 to 2.16.2
- [Release notes](https://github.com/allure-framework/allure-python/releases)
- [Commits](allure-framework/allure-python@2.16.0...2.16.2)

Updates `psycopg2-binary` from 2.9.12 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `python-dotenv` from 1.2.2 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.4)

Updates `locust` from 2.46.4 to 2.46.7
- [Release notes](https://github.com/locustio/locust/releases)
- [Changelog](https://github.com/locustio/locust/blob/master/CHANGELOG.md)
- [Commits](locustio/locust@2.46.4...2.46.7)

Updates `pyotp` from 2.9.0 to 2.10.0
- [Release notes](https://github.com/pyauth/pyotp/releases)
- [Changelog](https://github.com/pyauth/pyotp/blob/main/Changes.rst)
- [Commits](pyauth/pyotp@v2.9.0...v2.10.0)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: sqlalchemy
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: asyncpg
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: alembic
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: flower
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: pytest-playwright
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
- dependency-name: allure-pytest
  dependency-version: 2.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-backend-minors-patch
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-backend-minors-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-backend-minors-patch
- dependency-name: locust
  dependency-version: 2.46.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-backend-minors-patch
- dependency-name: pyotp
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-backend-minors-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dashboard. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

PR Check Results

✅ Code Formatting: Passed
✅ Linting: Passed
✅ Type Checking: Failed
✅ Tests: Failed

⚠️ Some checks failed. Please review the details above.

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

⚠️ WARN Trivy Security Scan Results

Severity Count
🔴 CRITICAL 0
🟠 HIGH 37
Total 37

Scans performed:

  • 📁 Filesystem (vulnerabilities, secrets, misconfigurations)
  • 🐳 Backend Docker image
  • 🐳 Frontend Docker image
  • 🏗️ IaC misconfiguration detection

⚠️ HIGH vulnerabilities should be addressed. Review required.

📋 View detailed SARIF reports

Download artifacts from this workflow run for full SARIF reports.
Results are also available in the GitHub Security tab.

Trivy v0.71.0 | aquasecurity/trivy

@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 19, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/dashboard/backend/pip-backend-minors-patch-0282d7df45 branch October 19, 2026 05:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants