build(deps): bump the production-dependency-patches group across 4 directories with 15 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the production-dependency-patches group with 14 updates in the / directory:

Package	From	To
cryptography	50.0.0	50.0.1
granian	2.8.1	2.8.2
annotated-doc	0.0.4	0.0.5
anyio	4.14.1	4.14.2
cffi	2.1.0	2.1.1
google-resumable-media	2.10.0	2.10.2
googleapis-common-protos	1.75.0	1.75.2
greenlet	3.5.3	3.5.5
imagesize	2.0.0	2.0.1
proto-plus	1.28.0	1.28.4
python-dotenv	1.2.2	1.2.3
sqlalchemy	2.0.51	2.0.52
typing-inspection	0.4.2	0.4.4
webob	1.8.10	1.8.11

Bumps the production-dependency-patches group with 5 updates in the /browser-tests directory:

Package	From	To
cryptography	50.0.0	50.0.1
cffi	2.1.0	2.1.1
greenlet	3.5.3	3.5.5
webob	1.8.10	1.8.11
yarl	1.24.2	1.24.5

Bumps the production-dependency-patches group with 5 updates in the /cronjobs directory:

Package	From	To
cryptography	50.0.0	50.0.1
cffi	2.1.0	2.1.1
google-resumable-media	2.10.0	2.10.2
googleapis-common-protos	1.75.0	1.75.2
proto-plus	1.28.0	1.28.4

Bumps the production-dependency-patches group with 6 updates in the /git-reader directory:

Package	From	To
granian	2.8.1	2.8.2
annotated-doc	0.0.4	0.0.5
anyio	4.14.1	4.14.2
cffi	2.1.0	2.1.1
python-dotenv	1.2.2	1.2.3
typing-inspection	0.4.2	0.4.4

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates granian from 2.8.1 to 2.8.2

Release notes

Sourced from granian's releases.

Granian 2.8.2

Patch release

Changes since 2.8.1:

• Fix a regression bug causing issues with multiprocessing and fork_server method
• Fix a lost-wakeup race in workers shutdown
• Set wsgi.input_terminated in WSGI environ
  • This fixes an issue with Werkzeug and chunked requests
• Bump dependencies

Commits

• 39879e2 Set wsgi.input_terminated in environ (close #909)
• 596c068 Bump dependencies
• 05e00aa Switch from Notify to SetOnce for acceptor shutdown signal (#910)
• 7c33a93 Always patch multiprocessing spawn method (close #905)
• 3e51c00 Bump version to 2.8.2
• See full diff in compare view

Updates annotated-doc from 0.0.4 to 0.0.5

Release notes

Sourced from annotated-doc's releases.

0.0.5

Breaking Changes

• ➖ Drop support for Python 3.8. PR #36 by @​svlandeg.

Upgrades

• ⬆ Bump ruff from 0.14.3 to 0.14.10. PR #31 by @​dependabot[bot].

Docs

• 📝 Update security policy. PR #63 by @​tiangolo.

Internal

• ⬆️ Upgrade latest-changes to 0.7.1. PR #92 by @​tiangolo.
• ⬆ Bump the github-actions group across 1 directory with 3 updates. PR #91 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 3 updates. PR #90 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #89 by @​tiangolo.
• 👷 Add GH workflow to bump pre-commit hook versions. PR #81 by @​YuriiMotov.
• 🔧 Set Dependabot schedule interval to "monthly". PR #82 by @​YuriiMotov.
• 👷 Fix latest-changes checkout target. PR #85 by @​tiangolo.
• ⬆️ Update issue-manager to 0.8.1. PR #84 by @​tiangolo.
• ⬆️ Update latest-changes to 0.6.1. PR #83 by @​tiangolo.
• ⬆ Bump the python-packages group across 1 directory with 3 updates. PR #72 by @​dependabot[bot].
• ⬆ Bump the github-actions group across 1 directory with 3 updates. PR #80 by @​dependabot[bot].
• ⬆ Bump https://github.com/crate-ci/typos from v1.46.0 to 1.47.2 in the pre-commit group across 1 directory. PR #76 by @​dependabot[bot].
• 👷 Simplify pull request workflow triggers. PR #79 by @​tiangolo.
• 👷 Update issue-manager to 0.7.1. PR #78 by @​tiangolo.
• ⬆️ Update issue-manager to 0.7.0. PR #77 by @​tiangolo.
• 🔒️ Update zizmor workflow security checks. PR #75 by @​tiangolo.
• 👷 Fix alls-green test dependency. PR #74 by @​tiangolo.
• 👷 Add pre-commit hook to catch typos. PR #68 by @​YuriiMotov.
• ⬆ Bump the python-packages group with 3 updates. PR #70 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 2 updates. PR #71 by @​dependabot[bot].
• 👷 Automate release preparation. PR #69 by @​tiangolo.
• 👷 Configure Dependabot to group updates and update weekly. PR #62 by @​YuriiMotov.
• 🔥 Remove config files now in central GitHub repo. PR #65 by @​tiangolo.
• 👷 Fix branch name in guard-dependencies.yml. PR #61 by @​svlandeg.
• 🔒️ Only allow team members to modify dependencies. PR #60 by @​svlandeg.
• ⬆ Bump ty from 0.0.33 to 0.0.34. PR #58 by @​dependabot[bot].
• ⬆ Bump prek from 0.3.11 to 0.3.13. PR #59 by @​dependabot[bot].
• 🔒️ Add zizmor and fix audit findings. PR #50 by @​YuriiMotov.
• ⬆️ Bump the lower bound of ty to 0.0.25. PR #57 by @​svlandeg.
• 👷 Configure ty to exit with error code on warnings. PR #56 by @​svlandeg.
• ⬆ Bump actions/add-to-project from 1.0.2 to 2.0.0. PR #54 by @​dependabot[bot].
• ⬆ Bump actions/labeler from 6.0.1 to 6.1.0. PR #55 by @​dependabot[bot].
• ⬆ Bump ruff from 0.15.8 to 0.15.12. PR #51 by @​dependabot[bot].
• ⬆ Bump prek from 0.3.8 to 0.3.11. PR #53 by @​dependabot[bot].
• ⬆ Bump ty from 0.0.27 to 0.0.33. PR #52 by @​dependabot[bot].

... (truncated)

Changelog

Sourced from annotated-doc's changelog.

0.0.5 (2026-07-28)

Breaking Changes

• ➖ Drop support for Python 3.8. PR #36 by @​svlandeg.

Upgrades

• ⬆ Bump ruff from 0.14.3 to 0.14.10. PR #31 by @​dependabot[bot].

Docs

• 📝 Update security policy. PR #63 by @​tiangolo.

Internal

• ⬆️ Upgrade latest-changes to 0.7.1. PR #92 by @​tiangolo.
• ⬆ Bump the github-actions group across 1 directory with 3 updates. PR #91 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 3 updates. PR #90 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #89 by @​tiangolo.
• 👷 Add GH workflow to bump pre-commit hook versions. PR #81 by @​YuriiMotov.
• 🔧 Set Dependabot schedule interval to "monthly". PR #82 by @​YuriiMotov.
• 👷 Fix latest-changes checkout target. PR #85 by @​tiangolo.
• ⬆️ Update issue-manager to 0.8.1. PR #84 by @​tiangolo.
• ⬆️ Update latest-changes to 0.6.1. PR #83 by @​tiangolo.
• ⬆ Bump the python-packages group across 1 directory with 3 updates. PR #72 by @​dependabot[bot].
• ⬆ Bump the github-actions group across 1 directory with 3 updates. PR #80 by @​dependabot[bot].
• ⬆ Bump https://github.com/crate-ci/typos from v1.46.0 to 1.47.2 in the pre-commit group across 1 directory. PR #76 by @​dependabot[bot].
• 👷 Simplify pull request workflow triggers. PR #79 by @​tiangolo.
• 👷 Update issue-manager to 0.7.1. PR #78 by @​tiangolo.
• ⬆️ Update issue-manager to 0.7.0. PR #77 by @​tiangolo.
• 🔒️ Update zizmor workflow security checks. PR #75 by @​tiangolo.
• 👷 Fix alls-green test dependency. PR #74 by @​tiangolo.
• 👷 Add pre-commit hook to catch typos. PR #68 by @​YuriiMotov.
• ⬆ Bump the python-packages group with 3 updates. PR #70 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 2 updates. PR #71 by @​dependabot[bot].
• 👷 Automate release preparation. PR #69 by @​tiangolo.
• 👷 Configure Dependabot to group updates and update weekly. PR #62 by @​YuriiMotov.
• 🔥 Remove config files now in central GitHub repo. PR #65 by @​tiangolo.
• 👷 Fix branch name in guard-dependencies.yml. PR #61 by @​svlandeg.
• 🔒️ Only allow team members to modify dependencies. PR #60 by @​svlandeg.
• ⬆ Bump ty from 0.0.33 to 0.0.34. PR #58 by @​dependabot[bot].
• ⬆ Bump prek from 0.3.11 to 0.3.13. PR #59 by @​dependabot[bot].
• 🔒️ Add zizmor and fix audit findings. PR #50 by @​YuriiMotov.
• ⬆️ Bump the lower bound of ty to 0.0.25. PR #57 by @​svlandeg.
• 👷 Configure ty to exit with error code on warnings. PR #56 by @​svlandeg.
• ⬆ Bump actions/add-to-project from 1.0.2 to 2.0.0. PR #54 by @​dependabot[bot].
• ⬆ Bump actions/labeler from 6.0.1 to 6.1.0. PR #55 by @​dependabot[bot].
• ⬆ Bump ruff from 0.15.8 to 0.15.12. PR #51 by @​dependabot[bot].
• ⬆ Bump prek from 0.3.8 to 0.3.11. PR #53 by @​dependabot[bot].

... (truncated)

Commits

• ef48d6a 🔖 Release version 0.0.5 (#93)
• c628000 📝 Update release notes
• e0b4579 ➖ Drop support for Python 3.8 (#36)
• ef956b4 📝 Update release notes
• 84bf1e5 ⬆️ Upgrade latest-changes to 0.7.1 (#92)
• cf773e1 📝 Update release notes
• 1375d6e ⬆ Bump the github-actions group across 1 directory with 3 updates (#91)
• cd37365 📝 Update release notes
• f9f3b69 ⬆ Bump the python-packages group across 1 directory with 3 updates (#90)
• 8420844 📝 Update release notes
• Additional commits viewable in compare view

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

• Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
• Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
• Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
• Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
• Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
• Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
• Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
• Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

Commits

• c384f99 Bumped up the version
• dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
• 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
• 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
• be24b04 Relaxed timeouts to fix test flakiness
• 8113506 Fix test flakiness caused by slow callback duration logging
• 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
• 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
• f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
• 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
• Additional commits viewable in compare view

Updates cffi from 2.1.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

Commits

• fd33e77 New release 2.1.1
• 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
• See full diff in compare view

Updates google-resumable-media from 2.10.0 to 2.10.2

Release notes

Sourced from google-resumable-media's releases.

google-resumable-media: v2.10.2

2.10.2 (2026-08-21)

Documentation

• handwritten: centralize CONTRIBUTING.rst pointers (#17642) (23b9499)

google-resumable-media: v2.10.1

2.10.1 (2026-08-06)

Bug Fixes

• require Protobuf 6.33.5+ (#17743) (d267342)

Changelog

Sourced from google-resumable-media's changelog.

Changelog

PyPI History

3.15.0 (2026-06-02)

Features

• regenerate google-cloud-d packages (#17092) (d49a2b9412b4ee9105125db36104a3e18344e0ad)

3.14.0 (2026-04-02)

Features

• Update comments for proto fields (c36aa6169035fdb14bf84b0e56e4f81291600b5a)
• Added a fields for image and table annotation output (c36aa6169035fdb14bf84b0e56e4f81291600b5a)

3.13.0 (2026-03-26)

Features

• Allow Protobuf 7.x (1eb7c268482e55971966e284dac2cbeb903adcbb)

Bug Fixes

• Require Python 3.9 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Require google-api-core >= 2.11.0 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Improve type checking (1eb7c268482e55971966e284dac2cbeb903adcbb)

3.12.0 (2026-03-23)

Features

• Add a field for upgrading previous processor version when fine tuning (ee7dd7dc168ecf943440cef38efff348e8eff095)

3.11.0 (2026-03-05)

Features

• Added a field for enabling image and table annotation for layout parser processor (6120fb0db084f5e8d1502fb1bb37594ac9976f6e)

3.10.0 (2026-02-12)

... (truncated)

Commits

• 3e29682 chore: release main (#18013)
• b4d9717 feat: check python and dependency versions in spanner packages (#18177)
• 66794a0 chore(bigtable): Rerouted legacy client row filters to data client row filter...
• b42122e Revert "fix(auth): parse hostname for mTLS and PSC endpoint certifica… (#18189)
• e20796a fix(google-auth-oauthlib): prevent port re-use on windows (#18166)
• b642373 fix(auth): parse hostname for mTLS and PSC endpoint certificate rotat… (#18153)
• 5bc3899 feat(spanner): add DataBoost and auto_partition_mode support to DBAPI driver ...
• 2b056ab docs(django-spanner, common-protos): centralize CONTRIBUTING.rst pointers (#1...
• 91d5e2a chore(bigtable): added warning to MutationsBatcher (#18176)
• 23b9499 docs(handwritten): centralize CONTRIBUTING.rst pointers (#17642)
• Additional commits viewable in compare view

Updates googleapis-common-protos from 1.75.0 to 1.75.2

Release notes

Sourced from googleapis-common-protos's releases.

googleapis-common-protos: v1.75.2

1.75.2 (2026-08-21)

Documentation

• django-spanner, common-protos: centralize CONTRIBUTING.rst pointers (#18041) (2b056ab)

googleapis-common-protos: v1.75.1

1.75.1 (2026-08-06)

Bug Fixes

• bump grpcio to 1.59.0; require Python 3.10+ (#17351) (a53487a)
• require Protobuf 6.33.5+ (#17743) (d267342)

Commits

• 3e29682 chore: release main (#18013)
• b4d9717 feat: check python and dependency versions in spanner packages (#18177)
• 66794a0 chore(bigtable): Rerouted legacy client row filters to data client row filter...
• b42122e Revert "fix(auth): parse hostname for mTLS and PSC endpoint certifica… (#18189)
• e20796a fix(google-auth-oauthlib): prevent port re-use on windows (#18166)
• b642373 fix(auth): parse hostname for mTLS and PSC endpoint certificate rotat… (#18153)
• 5bc3899 feat(spanner): add DataBoost and auto_partition_mode support to DBAPI driver ...
• 2b056ab docs(django-spanner, common-protos): centralize CONTRIBUTING.rst pointers (#1...
• 91d5e2a chore(bigtable): added warning to MutationsBatcher (#18176)
• 23b9499 docs(handwritten): centralize CONTRIBUTING.rst pointers (#17642)
• Additional commits viewable in compare view

Updates greenlet from 3.5.3 to 3.5.5

Changelog

Sourced from greenlet's changelog.

3.5.5 (2026-08-10)

• Link the C++ runtime statically into the Windows wheels again, as the Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported MSVCP140.dll, which no Windows CPython distribution ships, so importing greenlet failed on machines without the Visual C++ redistributable. See issue 525 <https://github.com/python-greenlet/greenlet/issues/525>_. Issue and pull request by Daniel Sticker.

.. note:: Binary 3.15 wheels are now built with 3.15.0rc1. This should be compatible with future 3.15 releases and is believed compatible with 3.15b4 as well (but not earlier versions).

3.5.4 (2026-07-22)

• Fix a crash (segfault) on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet that was started from a non-empty C-stack-reference state is active. See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

• Fix a potential use-after-free on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet is suspended holding a _PyCStackRef (for example, mid attribute resolution). See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

• Fix a deadlock on free-threaded builds when a greenlet switch happened while a PyCriticalSection was held -- for example inside asyncio's Task.__step, which holds one on the running task for the duration of the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>. Thanks to ddorian and Kumar Aditya.

.. note:: Binary 3.15 wheels are now built with Python 3.15b4. These may not be compatible with earlier or later versions of 3.15. Binary 3.15 wheels of greenlet from previous releases (e.g., 3.5.3) may not be compatible with Python 3.15b4.

Commits

• ddb1453 Preparing release 3.5.5
• 7de515c Update CHANGES: Credit for issue 525 and note about 3.15 binary wheels [skip ci]
• f3746aa Merge pull request #526 from stickerdaniel/windows-static-runtime
• f1ce3ca Restore static linking of the C++ runtime for Windows wheels
• b6690a5 Merge pull request #523 from python-greenlet/dependabot/github_actions/github...
• 726cc38 Bump the github-actions group with 3 updates
• e5c5f4c Merge pull request #522 from ddorian/c-stack-refs-test-detection
• be55a59 Check that the suspended greenlet is what keeps the class alive
• e9c01dd Back to development: 3.5.5
• 384be88 Preparing release 3.5.4
• Additional commits viewable in compare view

Updates imagesize from 2.0.0 to 2.0.1

Release notes

Sourced from imagesize's releases.

Bug fix

• Optimize metadata parsing and HTTP range reads.
• Fix JPEG2000 box parsing.
• Accept single-quoted SVG dimensions.
• Return positive heights for top-down BMP images.
• Remove the upper Python version cap, migrate packaging to pyproject.toml, and add Python 3.15 CI coverage.
• Bump the package version to 2.0.1 and add recent feedback contributors to the README.

Related issues: shibukawa/imagesize_py#64 shibukawa/imagesize_py#83 shibukawa/imagesize_py#84

Related pull requests: shibukawa/imagesize_py#86 shibukawa/imagesize_py#87 shibukawa/imagesize_py#88 shibukawa/imagesize_py#89 shibukawa/imagesize_py#90 shibukawa/imagesize_py#91 shibukawa/imagesize_py#92

Commits

• cf87fc0 Prepare release 2.0.1
• 24992f6 Merge pull request #92 from shibukawa/feature/add-test-python315
• cda8b07 Add Python 3.15 test coverage
• a42d408 Merge pull request #91 from shibukawa/feature/fix-issue83
• a83b14f Merge remote-tracking branch 'origin/master' into feature/fix-issue84
• a1374b1 Optimize metadata parsing and HTTP range reads
• d088634 Merge pull request #90 from shibukawa/feature/fix-issue84
• fde3b5e Fix JPEG2000 box parsing for issue 84
• 7d5c748 Merge pull request #87 from stephenfin/pyproject
• efe3db1 Merge pull request #89 from jdillard/fix-64-svg-single-quotes
• Additional commits viewable in compare view

Updates proto-plus from 1.28.0 to 1.28.4

Release notes

Sourced from proto-plus's releases.

proto-plus: v1.28.4

1.28.4 (2026-08-21)

Documentation

• handwritten: centralize CONTRIBUTING.rst pointers (#17642) (23b9499)

proto-plus: v1.28.3

1.28.3 (2026-08-06)

Bug Fixes

• bump grpcio to 1.59.0; require Python 3.10+ (#17351) (a53487a)
• proto-plus: add context to TypeErrors during message manipulation (#17682) (08f21a6)
• require Protobuf 6.33.5+ (#17743) (d267342)

Commits

• 3e29682 chore: release main (#18013)
• b4d9717 feat: check python and dependency versions in spanner packages (#18177)
• 66794a0 chore(bigtable): Rerouted legacy client row filters to data client row filter...
• 199aabd chore: improve sharded CI merge base detection (#18174)
• b42122e Revert "fix(auth): parse hostname for mTLS and PSC endpoint certifica… (#18189)
• b02d467 chore(tests): improve unit test output (#18123)
• e20796a fix(google-auth-oauthlib): prevent port re-use on windows (#18166)
• b642373 fix(auth): parse hostname for mTLS and PSC endpoint certificate rotat… (#18153)
• 5bc3899 feat(spanner): add DataBoost and auto_partition_mode support to DBAPI driver ...
• 07f5cfb ci: move docfx job to post-submit job (#18182)
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush()...

  Description has been truncated