You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
0.52.3 (August 13, 2026)
Changed
Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)
0.52.2 (August 13, 2026)
Fixed
Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
0.52.1 (August 1, 2026)
Fixed
Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)
0.52.0 (July 29, 2026)
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.
Added
Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)
Fixed
Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
0.51.0 (July 8, 2026)
Added
Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)
[orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements
where synchronize_session="fetch" is in use, either explicitly or
because the statement uses constructs such as CTEs that implicitly select
for it. Columns in rows returned by .returning() could be returned
under incorrect keys (e.g. row[SomeClass.a] returning the value of
a different column), a problem most likely to manifest under concurrent
workloads. ORM DELETE statements were not affected.
[orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(),
_orm.Session.bulk_update_mappings() or
_orm.Session.bulk_save_objects() call could leave the
_orm.Session permanently in a "flushing" state, such as when the
transaction could not be begun because a previous flush had left it
needing a rollback. Unlike _orm.Session.flush(), the bulk methods
set the internal flushing flag and began the transaction outside of the
try/finally block that resets it, so that neither
_orm.Session.rollback() nor _orm.Session.close() would clear
it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.
[orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader
options making use of wildcard tokens, such as _orm.load_only() or
_orm.raiseload() with "*", would fail with KeyError or
IndexError if the process doing the unpickling had not yet constructed
a loader path making use of that same token. This would typically be
observed when the object were unpickled in a separate process, such as
with the spawn or forkserver multiprocessing start methods, the
latter of which became the default on POSIX platforms as of Python 3.14.
The internal collection of these tokens is now established up front, so
that it is identical in every process.
[bug] [autogenerate] Fixed bug in the check constraint detection implemented in #508
that failed to take into account column bound check constraints,
leading to wrong autogenerate detections.
- Trove classifiers now include Python 3.15 which is now part of CI
integration
Python 3.14 is also added to trove classifiers which had been previously
omitted
Implemented PEP 604 style unions in type annotations
feature
[feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK
constraints, as part of the default autogenerate behavior. Detection is
name-based only; a constraint whose name is unchanged is presumed
equivalent regardless of its expression text, as reliably normalizing
SQL expressions across backends for comparison purposes is not generally
feasible. This behavior is implemented as a plugin named
alembic.autogenerate.checkconstraint_byname, and may be disabled if not
desired by excluding it from the
EnvironmentContext.configure.autogenerate_plugins list.
Pull request courtesy Francois van Kempen.
Fixed sub-minute interval jobs stalling for the duration of a DST spring-forward gap when the scheduler was configured with a ZoneInfo time zone, caused by the wakeup delay being computed from the naive wall-clock difference instead of the actual UTC difference (#1103)
Fixed imported jobs missing their scheduler and job store links (#1119)
Remove <Assistant> noun from <Connect> verb as part of the AI Assistants deprecation (breaking change)
Add passports attribute to <Dial> verb for SHAKEN/STIR passport passthrough
Accounts
Add SuppressEmailNotification parameter to the Secondary Auth Token and Auth Token promotion endpoints. Set it to true to suppress the email notification sent to account owners and administrators. Defaults to false, preserving existing behavior.
Add SMS Pumping Protection GET and POST API
Ai
Removing ai workbench apis
Api
Add missing uri property to the twiml_session resource
Data-ingress
2026-08-07
Removed 1 API path:
/v1/DataQuery (Realtime DataQuery)
2026-07-07
Added 1 new API path (data plane):
/v1/DataQuery (Realtime DataQuery)
2026-06-17
Content updates:
Added properties to OAuthJWTBearerCredentials: privateKey, privateKeyPassphrase
Remove <Assistant> noun from <Connect> verb as part of the AI Assistants deprecation (breaking change)
Add passports attribute to <Dial> verb for SHAKEN/STIR passport passthrough
Accounts
Add SuppressEmailNotification parameter to the Secondary Auth Token and Auth Token promotion endpoints. Set it to true to suppress the email notification sent to account owners and administrators. Defaults to false, preserving existing behavior.
Add SMS Pumping Protection GET and POST API
Ai
Removing ai workbench apis
Api
Add missing uri property to the twiml_session resource
Data-ingress
2026-08-07
Removed 1 API path:
/v1/DataQuery (Realtime DataQuery)
2026-07-07
Added 1 new API path (data plane):
/v1/DataQuery (Realtime DataQuery)
2026-06-17
Content updates:
Added properties to OAuthJWTBearerCredentials: privateKey, privateKeyPassphrase
case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
Fix AliasPath on nested model fields not JSON-decoding env values (#898).
Fix case-insensitive matching for optional nested models (#905).
Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@h1whelan] in #640
set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@dchaudhari7177] in #680
dotenv run now prints a friendly error instead of a traceback when no command is given by [@bbc2] in #606
Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@ReinerBRO] in #638
Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@h1whelan] in #640
set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@dchaudhari7177] in #680
dotenv run now prints a friendly error instead of a traceback when no command is given by [@bbc2] in #606
Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@ReinerBRO] in #638
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:
50.0.0 - 2026-07-31
SECURITY ISSUE:
:func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der
and its PEM and S/MIME variants no longer expose distinguishable errors or
timing when unwrapping a RecipientInfo's encryptedKey, which could
act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
A random key is now substituted on failure, as described in :rfc:3218.
Credit to @X1AOxiang for reporting the issue. CVE-2026-69247
Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
Added xof() class methods to
:class:~cryptography.hazmat.primitives.hashes.SHAKE128 and
:class:~cryptography.hazmat.primitives.hashes.SHAKE256 for constructing
algorithm instances configured for use with
:class:~cryptography.hazmat.primitives.hashes.XOFHash.
The :mod:X.509 verification <cryptography.x509.verification> APIs are now
considered stable and are subject to our API stability policy.
Added the :doc:/cobblestone recipe, an implementation of the
Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>_ for streaming authenticated
encryption of large messages.
Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead of
silently ignoring them.
Added support for using :class:~cryptography.x509.Name as a field type in
the :doc:/hazmat/asn1/index module.
Loading a public key or an EC private key now rejects DER where the
subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero
number of unused bits, instead of silently ignoring it.
Parsing a CRL entry's InvalidityDate extension now rejects a
GeneralizedTime that carries fractional seconds or another non-DER form,
matching the strict encoding already required for every other X.509 time
field.
:func:~cryptography.x509.ocsp.load_der_ocsp_request and
:func:~cryptography.x509.ocsp.load_der_ocsp_response now reject a request
or response whose version field is not v1, the only version defined
by RFC 6960, matching the version validation already performed when loading
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR updates 21 Python dependencies, most notably addressing a critical security vulnerability in the cryptography library (CVE-2026-69247). While the updates are necessary, the PR introduces two major version jumps—cryptography (48.x to 50.x) and isort (9.0.0)—which carry high risks of breaking changes.
Specifically, the isort update is likely to cause CI linting failures if the codebase is not re-formatted, and the cryptography update may impact sensitive encryption/decryption paths. Since these are bundled with 19 other updates, isolating regressions will be difficult. It is recommended to verify these major updates individually or execute the suggested re-formatting prompts before merging.
About this PR
This PR bundles 21 dependency updates, including major version jumps for cryptography and isort. Bundling major releases with a large number of minor/patch updates increases the risk of regression and complicates the identification of the root cause if the CI pipeline or production environment fails.
Test suggestions
Verify application startup and basic request routing with FastAPI 0.141.1 and Uvicorn 0.52.4.
Confirm database migration and ORM compatibility with SQLAlchemy 2.0.52 and Alembic 1.19.1.
Validate at-rest encryption and decryption functionality using the updated cryptography 50.0.1 library.
Execute static analysis and linting (MyPy, Pylint, isort) to ensure compatibility with updated dev tool versions.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify application startup and basic request routing with FastAPI 0.141.1 and Uvicorn 0.52.4.
2. Confirm database migration and ORM compatibility with SQLAlchemy 2.0.52 and Alembic 1.19.1.
3. Validate at-rest encryption and decryption functionality using the updated cryptography 50.0.1 library.
4. Execute static analysis and linting (MyPy, Pylint, isort) to ensure compatibility with updated dev tool versions.
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
This update performs a major version jump for cryptography (48.x to 50.x), skipping version 49. Major releases in this library can introduce breaking changes or deprecate ciphers. It is safer to update this package separately and verify that the Twilio auth token encryption/decryption logic remains functional. Try running the following prompt in your coding agent: > Review the cryptography 50.x release notes for breaking changes related to Fernet and PBKDF2, then run the test suite to verify Twilio token encryption/decryption.
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
Suggestion: Bumping to a new major version of isort (9.0.0) often introduces changes to sorting logic. If the codebase has not been re-formatted with this new version, linting checks in CI are likely to fail. Try running the following prompt in your coding agent: > Re-format the entire codebase using isort 9.0.0 and black 26.5.1 to ensure compliance with the updated rules and verify CI passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filepythonPull requests that update python code
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Updates the requirements on fastapi, uvicorn, sqlalchemy, alembic, apscheduler, pytz, twilio, pydantic-settings, python-dotenv, cryptography, python-json-logger, pytest, coverage, isort, mypy, pylint, ipython, pre-commit, mkdocs-material, faker and responses to permit the latest version.
Updates
fastapifrom 0.136.3 to 0.141.1Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
95f8322🔖 Release version 0.141.1 (#16106)f137944📝 Update release notesd623544🐛 Fix support for background tasks and headers from dependencies in `app.fron...1d211b9📝 Update release notes8a1f876📝 DocumentFASTAPI_ENVin FastAPI CLI guide (#16104)c7e7b65🔖 Release version 0.141.0 (#16103)6bceb84📝 Update release notes5429fed✨ Addapp.frontend(check_dir="auto"), to make local development more conven...628663f🔖 Release version 0.140.13 (#16096)0b54fd0📝 Update release notesUpdates
uvicornfrom 0.49.0 to 0.52.4Release notes
Sourced from uvicorn's releases.
... (truncated)
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
8988c23Stabilize macOS Python 3.13 signal shutdown tests (#3084)898ddcaUpdate PyPI publish action to version 1.14.2 (#3083)3869f8aRestore Mermaid diagram rendering (#3080)64148a9Version 0.52.4 (#3079)9e9e569docs: correct release example PR number (#3072)b783dacRemove duplicate Date header from SansIO WebSocket handshakes (#3078)27019b2chore(deps): bump the python-packages group across 1 directory with 11 update...1b64273Fix a typo in index.md (#3006)a68da60Version 0.52.3 (#3068)6e3bb4cUse zttp 0.0.24 fast receive path (#3067)Updates
sqlalchemyfrom 2.0.50 to 2.0.52Release notes
Sourced from sqlalchemy's releases.
... (truncated)
Commits
Updates
alembicfrom 1.18.4 to 1.19.1Release notes
Sourced from alembic's releases.
... (truncated)
Commits
Updates
apschedulerfrom 3.11.2 to 3.11.3Release notes
Sourced from apscheduler's releases.
Commits
4308ec9Added the release versionff68780Added a note about weekday numbers in CronTrigger.from_crontab()36936e9Updated actionsc0ff7e4Fixed Pyside6 tests failing on Python 3.9 and 3.81b782c9Fixed fixturecoreappnot founddc3dde4Test against PySide6 on all Python versions18a6f6bFixed imported jobs missing their scheduler and job store links1693db4Fix interval jobs stalling across DST spring-forward with ZoneInfo (#1114)0636bf4Added Python 3.14 to the test matrix3eb3de8Fixed bad use of pytest.raises()Updates
pytzfrom 2026.2 to 2026.3.post1Commits
661bca9Bump version numbers to 2026.3.post1 for python2 fix1e31a16Log python version running tests, force python2b3ca7c3Unix line endingsb55039aReplace non-ASCII character in comment to fix build with Python 25420ee2Replace non-ASCII character in comment2c139e8Merge branch 'fix/localize-overflow-at-datetime-extremes' of https://github.c...c843864Run zdump tests quietly518500cReduce noise when collecting zdump info dumps081f935Merge branch 'kytta-fix-dst' into 2026c8c9d69bMerge branch 'master' into 2026cUpdates
twiliofrom 9.10.9 to 9.11.0Release notes
Sourced from twilio's releases.
... (truncated)
Changelog
Sourced from twilio's changelog.
... (truncated)
Commits
306691eFix tag validation regex in deploy.yml (#954)a7c1450Update Python version matrix in deploy.yml (#953)eba3466[Librarian] Regenerated @ f443c9dfa233e41d0e61c9ed6ca2b162467a08b5 89762bc866...fbdfe4eUpdate deployment trigger to all tags (#950)3a5e24dComment out docs generation verification step (#952)89689b2handle-blank-response-202 (#949)3b82ae1Remove assistant apis cluster test (#948)184b583fix: updates to release process (#941)becbfc5removed oauth beta maturity from readme (#943)ecf51acAdd test and release gate workflow (#940)Updates
pydantic-settingsfrom 2.14.1 to 2.15.0Release notes
Sourced from pydantic-settings's releases.
... (truncated)
Commits
f725ca1Prepare release 2.15.0 (#930)28f35c2Bump the python-packages group with 4 updates (#929)9056db0test: move function-local imports to the top of test modules (#927)f077e3afix: raise ValidationError for non-JSON env values on strict fields (#926)ae25d70fix: treat Secret subclasses as non-complex fields (#716) (#920)798dceaBump the python-packages group with 4 updates (#924)a190041Bump the github-actions group with 4 updates (#925)5d93332Bump the python-packages group with 4 updates (#921)d2fdedafix: read secret files as UTF-8 instead of the locale encoding (#917)2256a4eBump the python-packages group with 3 updates (#915)Updates
python-dotenvfrom 1.2.2 to 1.2.3Release notes
Sourced from python-dotenv's releases.
Changelog
Sourced from python-dotenv's changelog.
Commits
49515afBump version: 1.2.2 → 1.2.38ac846fchore: add release runbook (RELEASING.md) and make release targetbb31c94docs: add 1.2.3 release notes (#606, #638, #680)f7b18d9fix: round-trip backslashes through set_key (#680)751f8c1ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...f1937b6chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...45b9372chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)72896e9docs: fix broken mkdocs link in CONTRIBUTING.md (#636)72754a1ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...078325eci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...Updates
cryptographyto 50.0.1Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
ffde75abump for 50.0.1 + changelog (#15520)dcb7050Prepare for 50.0.0 release (#15372)53fccd9Don't leak how PKCS#7 encryptedKey decryption failed (#15369)d472f97Addfrom __future__ import annotationsto all src/ Python files (#15371)908773dBump downstream dependencies in CI (#15368)2cc07ccBump BoringSSL, OpenSSL, AWS-LC in CI (#15367)c94ede9chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)67a8308chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)95018ffRelease the GIL in one-shot AEAD encrypt/decrypt (#15361)6954733Release the GIL during DH and DSA parameter generation (#15364)Updates
python-json-loggerfrom 4.1.0 to 4.2.0Release notes
Sourced from python-json-logger's releases.
Changelog
Sourced from python-json-logger's changelog.
Commits
806dba9Release 4.2.0010b730[core] Fixup doc-strings, remove outdated commentsb865bd3Description has been truncated