build(deps): bump the python-minor-patch group with 48 updates

[dependabot]

Bumps the python-minor-patch group with 48 updates:

Package	From	To
torch	2.13.0	2.14.0
sentence-transformers	6.0.0	6.0.1
anthropic	1.2.0	1.3.0
langchain-core	1.5.1	1.6.1
langsmith	0.10.10	0.12.1
fastapi	0.140.0	0.141.1
uvicorn	0.51.0	0.52.4
pydantic	2.13.4	2.13.5
elevenlabs	2.59.0	2.66.0
deepgram-sdk	7.6.0	7.8.1
boto3	1.43.56	1.43.88
azure-keyvault-secrets	4.11.0	4.11.2
onnxruntime	1.28.0	1.29.0
onnxruntime-gpu	1.28.0	1.29.0
grpcio	1.83.0	1.83.1
mujoco	3.10.0	3.12.0
z3-solver	5.0.0.0	5.1.0.0
bitsandbytes	0.50.0	0.50.2
qdrant-client	1.18.0	1.19.0
faiss-cpu	1.14.3	1.15.0
elasticsearch	9.4.1	9.5.0
langgraph	1.2.9	1.2.11
haystack-ai	3.0.0	3.1.1
crewai	1.6.1	1.15.19
litellm	1.93.0	1.99.0
langfuse	4.14.1	4.15.1
gradio	6.20.0	6.26.0
pypdf	6.16.2	6.17.0
google-api-python-client	2.198.0	2.200.0
redis	8.0.1	8.1.0
peft	0.19.1	0.20.0
google-cloud-aiplatform	2.0.1	2.1.0
google-cloud-storage	3.13.0	3.13.1
torchvision	0.28.0	0.29.0
hypothesis	6.161.6	6.167.1
pre-commit	4.6.1	4.6.2
ruff	0.16.0	0.16.6
mypy	2.3.0	2.3.1
maturin	1.14.1	1.15.0
build	1.5.0	1.6.0
charset-normalizer	3.4.7	3.5.1
idna	3.18	3.19
lxml	6.1.1	6.1.3
ml-dtypes	0.5.4	0.6.0
nh3	0.3.6	0.3.7
packaging	26.2	26.3
pygments	2.20.0	2.21.0
semgrep	1.171.0	1.176.0

Updates torch from 2.13.0 to 2.14.0

Release notes

Sourced from torch's releases.

PyTorch 2.14.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Security
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

• torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

  The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

  Before:

  options = torch.nn.LinearCrossEntropyOptions(acc_policy="balanced")
  loss = torch.nn.functional.linear_cross_entropy(
      input, linear_weight, target, options=options
  )

  After:

  options = torch.nn.LinearCrossEntropyOptions(acc_policy="compact")
  loss = torch.nn.functional.linear_cross_entropy(

... (truncated)

Commits

• 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
• 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
• 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
• 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
• ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
• 65890f3 Fix docker-release validate job to use the channel matching the pushed image ...
• 1682388 Fix macOS py3.15 wheel builds: pin Cython < 3.3.0 and bump the cp315 numpy pi...
• 9724418 Fix Windows py3.15 builds: constrain Cython < 3.3.0 and bump the cp315 numpy ...
• f1b7554 [MPS] Fix pin_memory() recycling buffers still in use by the GPU (#194662)
• 9f205f7 [MPS] fail loudly on large reductions (#194661)
• Additional commits viewable in compare view

Updates sentence-transformers from 6.0.0 to 6.0.1

Release notes

Sourced from sentence-transformers's releases.

v6.0.1 - Restore the PyLate prefix on prompted checkpoints, 80 documented multi-vector models

This patch release fixes a multi-vector loading bug: PyLate checkpoints that carry both a [Q]/[D] prefix and a text prompt lost the prefix, so they were encoded without a marker they were trained with. It also grows the documented multi-vector model tables from 51 checkpoints to 80.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==6.0.1
Inference only, use one of:
pip install sentence-transformers==6.0.1
pip install sentence-transformers[onnx-gpu]==6.0.1
pip install sentence-transformers[onnx]==6.0.1
pip install sentence-transformers[openvino]==6.0.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.0.1
pip install sentence-transformers[audio]==6.0.1
pip install sentence-transformers[video]==6.0.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==6.0.1

Compose the PyLate prefix with the saved prompt (#3968)

PyLate supports a prefix as well as prompt text, and Sentence Transformers assumed that these were mutually exclusive. However, the following three checkpoints carry both a prefix and a prompt, and were trained with the prefix prepended to the prompt text:

• lightonai/ColBERT-Zero
• lightonai/ColBERT-Zero-unsupervised
• lightonai/ColBERT-Zero-supervised

PyLate trained these checkpoints on [CLS] [Q] search_query: ... and [CLS] [D] search_document: ..., but Sentence Transformers dropped the prefix and encoded them as [CLS] search_query: ... and [CLS] search_document: .... After the fix, the performance of the ColBERT-Zero model improved from 0.6569 NDCG@10 to 0.6824 on the NanoBEIR benchmark. To my knowledge, only these 3 checkpoints used both a prefix and a prompt, so this is the only case where the bug would have affected you.

Forward task to routed modules in Router.preprocess (#3967)

Router.forward has always passed task down to the routed module, but Router.preprocess did not, so anything a module does with the task at preprocessing time did nothing behind a Router: query_length and document_length caps, query_expansion, and the chat-template task keyword. No released checkpoint combines a Router with those settings, so this is a latent bug rather than one you are likely to have hit. It would have affected anyone building such a model themselves, with no error to indicate it.

Documentation

• The multi-vector pretrained models tables grew from 29 text and 22 visual document retrieval checkpoints to 38 and 42 (#3963, #3969), with revision and trust_remote_code notes refreshed as upstream pull requests merged (#3972).
• Documented which Hub tag to filter on for each model type (#3964), and linked the Multi-Vector Encoder blogposts from the docs (#3966).
• Added MultiVectorEncoder to the Agent Skill README and refreshed the SauerkrautLM scores (#3955).
• Corrected the minimum versions in the README (#3952). It still recommended PyTorch 1.11.0+ and transformers v4.41.0+, where v6.0 requires PyTorch 2.2+ and transformers v5.0+. This is the text rendered as the PyPI project description.

All Changes

• docs: Add MultiVectorEncoder to the skills README, refresh the SauerkrautLM scores by @​tomaarsen in huggingface/sentence-transformers#3955
• Fix the README dependency versions by @​tomaarsen in huggingface/sentence-transformers#3952
• [docs] Add more MultiVectorEncoder models to the pretrained models tables by @​tomaarsen in huggingface/sentence-transformers#3963
• [docs] Clarify which Hub tags to filter on for each model type by @​tomaarsen in huggingface/sentence-transformers#3964
• [docs] Link the Multi-Vector Encoder blogposts by @​tomaarsen in huggingface/sentence-transformers#3966

... (truncated)

Commits

• b0acd1a Update README installation versions
• 9b415ac Release v6.0.1
• cc0669c Add/update revisions for pretrained MVE models (#3972)
• f8390f4 [docs] Refresh the MultiVectorEncoder pretrained models tables (#3969)
• 4b51722 [fix] Compose the PyLate prefix with the saved prompt (#3968)
• e99c4a9 [fix] Forward task to routed modules in Router.preprocess (#3967)
• 5d2ec93 [docs] Link the Multi-Vector Encoder blogposts (#3966)
• 9c5de2a [docs] Clarify which Hub tags to filter on for each model type (#3964)
• 83680bd [docs] Add more MultiVectorEncoder models to the pretrained models tables (#3...
• 1a43278 docs: Add MultiVectorEncoder to the skills README, refresh the SauerkrautLM s...
• See full diff in compare view

Updates anthropic from 1.2.0 to 1.3.0

Release notes

Sourced from anthropic's releases.

v1.3.0

1.3.0 (2026-09-01)

Full Changelog: v1.2.0...v1.3.0

Features

• api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (74080c3)
• api: manual updates (1dc3ce0)
• api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (429e719)

Bug Fixes

• aws: resolve base_url from aws_region under skip_auth and with_options (#564) (b6d1732)
• batches: add results to GA raw/streaming response wrappers (cbf9715)
• ci: don't hard-wrap detect-breaking-changes output (b5be779)
• client: derive multipart filename for file tuples passed without one (a9f3fb4)
• types: remove unused wire aliases from header and path params (dc0a9ab)

Chores

• internal: drop the unused discriminator argument from PropertyInfo (3dae6fd)
• internal: drop the unused distro dependency (a47d85f)

Documentation

• changelog: detail the beta files/skills GA-shape change (#1900) (7c84e13)

Refactors

• types: mark discriminated unions with UnionDiscriminator instead of PropertyInfo (17df0bf)
• types: use UnionDiscriminator for more discriminated unions (b44af2c)

Changelog

Sourced from anthropic's changelog.

1.3.0 (2026-09-01)

Full Changelog: v1.2.0...v1.3.0

Features

• api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (74080c3)
• api: manual updates (1dc3ce0)
• api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (429e719)

Bug Fixes

• aws: resolve base_url from aws_region under skip_auth and with_options (#564) (b6d1732)
• batches: add results to GA raw/streaming response wrappers (cbf9715)
• ci: don't hard-wrap detect-breaking-changes output (b5be779)
• client: derive multipart filename for file tuples passed without one (a9f3fb4)
• types: remove unused wire aliases from header and path params (dc0a9ab)

Chores

• internal: drop the unused discriminator argument from PropertyInfo (3dae6fd)
• internal: drop the unused distro dependency (a47d85f)

Documentation

• changelog: detail the beta files/skills GA-shape change (#1900) (7c84e13)

Refactors

• types: mark discriminated unions with UnionDiscriminator instead of PropertyInfo (17df0bf)
• types: use UnionDiscriminator for more discriminated unions (b44af2c)

Commits

• 370ee92 release: 1.3.0
• b132569 feat(api): manual updates
• 665dae8 fix(types): remove unused wire aliases from header and path params
• 825dbb9 fix(client): derive multipart filename for file tuples passed without one
• 2d81a47 fix(ci): don't hard-wrap detect-breaking-changes output
• 23d68ee feat(api): organization compliance settings, user-profile order_by, memory-st...
• f21982a fix(aws): resolve base_url from aws_region under skip_auth and with_options (...
• e7e0c00 fix(batches): add results to GA raw/streaming response wrappers
• 1280f2c chore(internal): drop the unused discriminator argument from PropertyInfo
• 72cac10 refactor(types): use UnionDiscriminator for more discriminated unions
• Additional commits viewable in compare view

Updates langchain-core from 1.5.1 to 1.6.1

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.1

Changes since langchain-core==1.6.0

revert: release(core): 1.6.2 (#39971) release(core): 1.6.2 (#39967) fix(core): shore up indexing in genai v1 streaming content (#39964) fix(core): make StructuredTool JSON-serializable (#39631) chore(deps): bump minor and patch dependencies (#39869) release(core): 1.6.1 (#39832) feat(core): propagate gateway information on error path (#39829)

langchain-core==1.6.0

Changes since langchain-core==1.5.6

release(core): 1.6.0 (#39760) fix(core): resolve postponed annotations in StructuredTool._injected_args_keys (#39602) feat(core): add standard model exception types (#39538) fix(core): allow deserializing RunnablePick (#39753) fix(core): make convert_to_openai_function handle callables and non-dict mappings (#39750) fix(core): make subprocess and temporary file tests portable on Windows (#39664) fix(core): fail fast when tool schemas can't resolve forward refs during serialization (#39570) test(core): avoid version-dependent runnable snapshots (#39705) fix(core): require all nested properties for strict tool schemas (#39306) fix(core): remove stale sync-stream xfail [closes #39720] (#39723) perf(core): Lazily import transformers (#38037) fix(core): accept non-dict Mapping values in mustache templates (#39680) docs(core): clarify Runnable pipe coercion [closes #39075] (#39707) fix(core): finalize chain-group runs on BaseException (#39699)

langchain-core==1.5.6

Changes since langchain-core==1.5.5

chore(core): release 1.5.6 (#39704) feat(core): incorporate gateway metadata to traces (#39703)

langchain-core==1.5.5

Changes since langchain-core==1.5.4

release(core): 1.5.5 (#39655) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (#39367) fix(core): respect pydantic aliases when validating tool inputs (#39572) fix(core): issues in merging chunks (#39535) fix(core): handle v1 base model validation in async path (#39576) fix(core): handle tool descriptions for infer_schema=False (#39573) fix(core): clear usage metadata callback on exceptions in context manager (#39616) fix(core): handle falsy LLM and chat model caches (#39283) chore(core): add httpx as an explicit dep (#39612) fix(core): preserve non-str/non-dict items in DictPromptTemplate list values (#39588) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (#39142) fix(core): guard malformed Anthropic content blocks (#38670)

... (truncated)

Commits

• 4fe9d30 chore(openai): fix tests (#39972)
• 8fa38dc revert: release(core): 1.6.2 (#39971)
• 122030d release(core): 1.6.2 (#39967)
• 7d4b42b release(langchain): 1.3.18 (#39966)
• 4a66e35 fix(langchain): preserve content-block shape in PIIMiddleware redaction (#39894)
• 38e2113 fix(core): shore up indexing in genai v1 streaming content (#39964)
• 13b1b2f fix(core): make StructuredTool JSON-serializable (#39631)
• 3b3b308 release(anthropic): 1.7.0 (#39963)
• e3f6adf feat(anthropic): support top-level param for skills via container; `updates...
• c253f54 fix(openai): correct reasoning_effort_levels for gpt-5 and gpt-5.1 profiles...
• Additional commits viewable in compare view

Updates langsmith from 0.10.10 to 0.12.1

Release notes

Sourced from langsmith's releases.

v0.12.1

What's Changed

• release(js): 0.10.0 by @​emil-lc in langchain-ai/langsmith-sdk#3474
• fix(py,js): drain the anonymizer walk queue in O(1) [LSDK-412] by @​QuentinBrosse in langchain-ai/langsmith-sdk#3475
• release(py): 0.12.1 by @​QuentinBrosse in langchain-ai/langsmith-sdk#3478

Full Changelog: langchain-ai/langsmith-sdk@v0.12.0...v0.12.1

v0.12.0

What's Changed

• ci: enable CodSpeed flame graphs and pin the benchmarks to one CPU by @​emil-lc in langchain-ai/langsmith-sdk#3449
• fix(py,js)!: make trace sampling deterministic by @​emil-lc in langchain-ai/langsmith-sdk#3183
• fix(py): suppress import-untyped on the optional langsmith_pyo3 import by @​QuentinBrosse in langchain-ai/langsmith-sdk#3462
• chore(py)!: swtich to httpx2 dependency while keeping httpx as a fallback by @​emil-lc in langchain-ai/langsmith-sdk#3406
• fix!: fail-closed when per-function anonymization callables fail by @​emil-lc in langchain-ai/langsmith-sdk#3328
• fix(py): compress replica writes that carry their own credentials by @​emil-lc in langchain-ai/langsmith-sdk#3448
• perf(py): serialize identical replicas once, into one frame by @​emil-lc in langchain-ai/langsmith-sdk#3450
• release(py): 0.12.0 by @​emil-lc in langchain-ai/langsmith-sdk#3472

Full Changelog: langchain-ai/langsmith-sdk@v0.11.2...v0.12.0

v0.11.2

What's Changed

• fix: exclude password and email env vars from run metadata by @​QuentinBrosse in langchain-ai/langsmith-sdk#3417
• feat(js): Avoid redundantly sending inputs up in patch by @​jacoblee93 in langchain-ai/langsmith-sdk#3425
• release(js): 0.9.0 by @​jacoblee93 in langchain-ai/langsmith-sdk#3426
• test(py): continuous benchmarking with CodSpeed by @​emil-lc in langchain-ai/langsmith-sdk#3420
• fix: point migration guide links at their new per-area pages by @​KiewanVillatel in langchain-ai/langsmith-sdk#3421
• fix(js): send langsmith-js User-Agent on generated client calls by @​KiewanVillatel in langchain-ai/langsmith-sdk#3411
• test(py): pin multipart ingest retry matrix and drop warning by @​QuentinBrosse in langchain-ai/langsmith-sdk#3377
• chore: sync langsmith_api by @​langtions-bot[bot] in langchain-ai/langsmith-sdk#3407
• fix(py): handle 64bit+ integers without loss of precision by @​emil-lc in langchain-ai/langsmith-sdk#3409
• fix(py): exclude replica config from the serialized run body by @​emil-lc in langchain-ai/langsmith-sdk#3442
• fix(py,js): consistent (non-v7) UUID rewriting for replicas by @​emil-lc in langchain-ai/langsmith-sdk#3445
• ci: report Python benchmarks to Datadog Test Optimization by @​emil-lc in langchain-ai/langsmith-sdk#3408
• fix(js): close the argument-shape bypass in Anthropic MCP redaction by @​emil-lc in langchain-ai/langsmith-sdk#3378
• feat(livekit): align trace audio with the span timeline by @​carolinedivittorio in langchain-ai/langsmith-sdk#3452
• release(py): 0.11.2 by @​carolinedivittorio in langchain-ai/langsmith-sdk#3457

Full Changelog: langchain-ai/langsmith-sdk@v0.11.1...v0.11.2

v0.11.1

What's Changed

• release(js): 0.8.11 by @​emil-lc in langchain-ai/langsmith-sdk#3401
• chore: sync langsmith_api by @​langtions-bot[bot] in langchain-ai/langsmith-sdk#3340
• fix(sandbox): retry transient WebSocket upgrades in Python and JS by @​ramon-langchain in langchain-ai/langsmith-sdk#3388
• fix: report incomplete pytest suites accurately by @​jkennedyvz in langchain-ai/langsmith-sdk#3398

... (truncated)

Commits

• 1109385 release(py): 0.12.1 (#3478)
• 73ac302 fix(py,js): drain the anonymizer walk queue in O(1) [LSDK-412] (#3475)
• 11f7208 release(js): 0.10.0 (#3474)
• a95cddf release(py): 0.12.0 (#3472)
• 4ddfa24 perf(py): serialize identical replicas once, into one frame (#3450)
• 983e00a fix(py): compress replica writes that carry their own credentials (#3448)
• 3239181 fix!: fail-closed when per-function anonymization callables fail (#3328)
• 0d32567 chore(py)!: swtich to httpx2 dependency while keeping httpx as a fallback (#3...
• 1b64f94 fix(py): suppress import-untyped on the optional langsmith_pyo3 import (#3462)
• e5360c9 fix(py,js)!: make trace sampling deterministic (#3183)
• Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn from 0.51.0 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Commits

• 8988c23 Stabilize macOS Python 3.13 signal shutdown tests (#3084)
• 898ddca Update PyPI publish action to version 1.14.2 (#3083)
• 3869f8a Restore Mermaid diagram rendering (#3080)
• 64148a9 Version 0.52.4 (#3079)
• 9e9e569 docs: correct release example PR number (#3072)
• b783dac Remove duplicate Date header from SansIO WebSocket handshakes (#3078)
• 27019b2 chore(deps): bump the python-packages group across 1 directory with 11 update...
• 1b64273 Fix a typo in index.md (#3006)
• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in