Bump the python-packages group with 8 updates

[dependabot]

Bumps the python-packages group with 8 updates:

Package	From	To
sqlalchemy	2.0.52	2.0.54
uvicorn	0.52.4	0.53.0
httpx2	2.12.0	2.13.0
pytest-rerunfailures	16.6.1	16.7
faker	40.38.0	40.39.0
gevent	26.8.0	26.9.0
ruff	0.16.7	0.16.8
pymdown-extensions	11.0.2	12.0.1

Updates sqlalchemy from 2.0.52 to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

• [platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

• [platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

  References: #13592

2.0.53

Released: September 14, 2026

orm

• [orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

  References: #13560

• [orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an

... (truncated)

Commits

• See full diff in compare view

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpx2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart in pydantic/httpx2#1140 and pydantic/httpx2#1186
• Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

httpcore2

Changed

• Require Trio 0.34.0 or later for the trio extra in pydantic/httpx2#1179

Fixed

• Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Changelog

Sourced from httpx2's changelog.

2.13.0 (September 14th, 2026)

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
• Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)

Commits

• f295185 Prepare version 2.13.0 (#1208)
• 8f215b5 Use portable links in API docstrings (#1202)
• 36d636a Group httpx2.__all__ exports by source module (#1188)
• f1064aa Bump the python-packages group across 1 directory with 11 updates (#1179)
• bc27137 Update uv-dynamic-versioning requirement from >=0.14.0 to >=0.14.1 (#1180)
• 62e0827 Restore --no-verify CLI flag (#1186)
• c9b1d33 Replace --no-verify flag with --verify (#1140)
• e3a87b1 Convert Timeout and Limits to dataclasses (#1167)
• 4c02c4b Fixed a grammatical mistake. (#1154)
• See full diff in compare view

Updates pytest-rerunfailures from 16.6.1 to 16.7

Changelog

Sourced from pytest-rerunfailures's changelog.

16.7 (2026-09-17)

Features ++++++++

• Allow configuring only_rerun regular expressions in pytest.ini files. ([#165](https://github.com/pytest-dev/pytest-rerunfailures/issues/165) <https://github.com/pytest-dev/pytest-rerunfailures/issues/165>_)
• Show each rerun attempt and its final outcome in the rerun test summary info section. ([#191](https://github.com/pytest-dev/pytest-rerunfailures/issues/191) <https://github.com/pytest-dev/pytest-rerunfailures/issues/191>_)
• Allow flaky marker conditions to inspect the exception that caused a failed test phase, including when running with pytest-xdist. ([#230](https://github.com/pytest-dev/pytest-rerunfailures/issues/230) <https://github.com/pytest-dev/pytest-rerunfailures/issues/230>_)

Bug Fixes +++++++++

• Match only_rerun against the full exception chain (__cause__ and __context__), not only the outermost exception. Match rerun_except against explicit __cause__ links only, so implicit except / finally context does not suppress reruns. ([#353](https://github.com/pytest-dev/pytest-rerunfailures/issues/353) <https://github.com/pytest-dev/pytest-rerunfailures/issues/353>_)
• Fix INTERNALERROR when only_rerun or rerun_except is given a bare exception class instead of a list. ([#362](https://github.com/pytest-dev/pytest-rerunfailures/issues/362) <https://github.com/pytest-dev/pytest-rerunfailures/issues/362>_)
• Fix subtest reruns with newer pytest versions that use structured NodeId values internally. ([#363](https://github.com/pytest-dev/pytest-rerunfailures/issues/363) <https://github.com/pytest-dev/pytest-rerunfailures/issues/363>_)
• Mark teardown failures from an attempt that is rerun as reruns, so a later successful attempt is not reported as an error. ([#366](https://github.com/pytest-dev/pytest-rerunfailures/issues/366) <https://github.com/pytest-dev/pytest-rerunfailures/issues/366>_)

Misc ++++

• Keep the test suite passing when pytest-randomly is installed, including when the outer pytest is started with -p no:randomly. ([#218](https://github.com/pytest-dev/pytest-rerunfailures/issues/218) <https://github.com/pytest-dev/pytest-rerunfailures/issues/218>_)
• Test the free-threaded Python 3.14 build in CI, via a new py314t tox environment and a matching workflow job. ([#361](https://github.com/pytest-dev/pytest-rerunfailures/issues/361) <https://github.com/pytest-dev/pytest-rerunfailures/issues/361>_)

Commits

• fead4c6 Preparing release 16.7
• ed62cfc Show each rerun attempt outcome in summary (#370)
• 64687c9 Add pytest.ini support for only_rerun (#369)
• 1997015 Preserve rerun status for teardown failures (#367)
• 4220386 Match only_rerun against wrapped exception causes (#364)
• 87d81b2 Keep nested pytester sessions isolated from pytest-randomly (#368)
• be14a6b Allow flaky conditions to inspect failure exceptions (#365)
• 78561a5 ci: test the free-threaded Python 3.14 build (#361)
• 402afb4 Fix bare exception class in only_rerun / rerun_except causing INTERNALERROR (...
• 87a8b47 Fix subtest reruns with structured NodeId keys (#363)
• Additional commits viewable in compare view

Updates faker from 40.38.0 to 40.39.0

Release notes

Sourced from faker's releases.

Release v40.39.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.39.0 - 2026-09-14

• Fix: compute Norwegian MOD11 check digit so no_NO iban() passes stdnum validation (#2415). Thanks @​CedricConday.

Commits

• 328b648 Bump version: 40.38.0 → 40.39.0
• eb2db2d 📝 Update CHANGELOG.md
• 3648583 fix(no_NO): compute Norwegian MOD11 check digit so iban() passes stdnum valid...
• See full diff in compare view

Updates gevent from 26.8.0 to 26.9.0

Commits

• 003c77a Preparing release 26.9.0
• 725ecc3 Merge pull request #2209 from bojanz/issue2207-resolve-result-on-setup-failure
• a5b68e8 Adjust the ThreadPool after an unexpected worker exit
• 67a7256 Resolve the ThreadResult when worker task setup fails
• a3b307b Add change note for #2211 / #2039 [skip ci]
• b0ec8d3 Merge pull request #2211 from afonsojanu/fix/subprocess-stdin-mode-missing-bi...
• 29b0030 Merge pull request #2210 from Shivakarthikeya23/issue-1946
• 47ea41c Merge pull request #2208 from bojanz/issue2206-skip-missing-hooks
• 0ee0c83 Report the full binary mode string from FileObjectPosix
• 3f3dc57 Fix AsyncResult accumulating traceback frames on repeated get()
• Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Updates pymdown-extensions from 11.0.2 to 12.0.1

Release notes

Sourced from pymdown-extensions's releases.

12.0.1

• FIX: BetterEm: fix a case with new logic.

12.0

• BREAK: BetterEm: Complete rewrite. There may be some subtle differences between legacy behavior and new CommonMark behavior.

  • * and _ emphasis are handled at the same time to provide more natural nesting.
  • More performant.
  • CommonMark compliant.

• BREAK: Tilde, Caret, Mark: Rewritten and now built upon the latest BetterEm logic.

  • When used with BetterEm, Tilde, Caret, and Mark will be added to the same delimiter processor under the hood and will be parsed at the same time as emphasis, allowing for better nesting logic.
  • More performant. Performance issues reported by (@​lexdotdev).
  • Tilde, Caret, Mark: Allow deletion, insertions, and marking mid-word by default. Set smart_delete, smart_insert, or smart_mark, respectively, to enable previous behavior, which prevented mid-word deletion.
  • Tilde, Caret: Add new option no_space to control whether the Pandoc style requirement of "no unescaped spaces" is enabled for subscript and superscript, respectively. no_space is enabled by default.

• NEW: Details, Blocks.Details, Blocks.Admonitions: Allow and handle headers specially in titles.

• NEW: Quotes: Allow and handle headers specially in callout titles.

• NEW: BracketSpan: New extension that allows for the creation of spans using a Pandoc style bracket notation.

• NEW: Arithmatex: Remove deprecated inline_mathjax_preview_format, inline_mathjax_format, and inline_generic_format. Use arithmatex_inline_format instead.

• NEW: Arithmatex: Remove deprecated fence_mathjax_preview_format, fence_mathjax_format, and fence_generic_format. Use arithmatex_fenced_format instead.

• NEW: Emoji: Remove undocumented and deprecated "old style" custom emoji index logic.

• NEW: Slugs: Remove deprecated uslugify, uslugify_encoded, uslugify_cased, uslugify_cased_encoded, gfm, and gfm_encoded. Use the documented slugify method with appropriate arguments instead.

Commits

• 0e0060d Update changelog
• 136d324 Add test for a fixed case in previous commit
• 8087e9b Reduce duplicate code and simplify space accounting in Tilde and Caret
• b613e7f More grammar fixes
• ddcbb1d Fix grammar
• 977b0d4 Add note about performance
• 5912137 Update changelog
• ada9f76 Docs: Update JS deps
• ecd3106 Update development documentation
• bc78aeb Use hatch (#2958)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	5403	654	838	177	87%

report-only-changed-files is enabled. No changed files were found in the coverage report :)