chore(deps): bump the all-dependencies group with 5 updates

[dependabot]

Updates the requirements on uvicorn[standard], orjson, ruff, mypy and boto3-stubs[s3] to permit the latest version.
Updates uvicorn[standard] to 0.52.3

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Changelog

Sourced from uvicorn[standard]'s changelog.

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

... (truncated)

Commits

• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• 2a5ff18 Version 0.52.2 (#3066)
• 1920297 Update zttp to 0.0.22 (#3063)
• 5c560da chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3061)
• See full diff in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Commits

• 6737895 3.12.0
• c2a6e8f JsonWriter, iterators
• 6a2d7a7 yyjson 1ea2fb0
• 97bf170 build update
• See full diff in compare view

Updates ruff from 0.16.2 to 0.16.3

Release notes

Sourced from ruff's releases.

0.16.3

Release Notes

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
• [pylint] Allow continue in finally on Python 3.8 (#27626)
• [pylint] Fix PLE1307 false positive with bools (#27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#27570)
• Enable PGO for Linux ARM64 Ruff releases (#27574)
• Enable PGO for Windows x86-64 Ruff releases (#27573)
• Enable PGO for macOS ARM64 Ruff releases (#27572)
• Reduce Expr size to 64 bytes (#27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

• Use mimalloc v3 (#27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.3

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
• [pylint] Allow continue in finally on Python 3.8 (#27626)
• [pylint] Fix PLE1307 false positive with bools (#27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#27570)
• Enable PGO for Linux ARM64 Ruff releases (#27574)
• Enable PGO for Windows x86-64 Ruff releases (#27573)
• Enable PGO for macOS ARM64 Ruff releases (#27572)
• Reduce Expr size to 64 bytes (#27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

• Use mimalloc v3 (#27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh
• @​chirizxc

... (truncated)

Commits

• b0e4702 Bump 0.16.3 (#27723)
• ecdd401 [ty] Separate script and uv modules from project metadata (#27720)
• 1263524 [ty] Simplify display implementations with std::fmt::from_fn (#27718)
• 59196ba [ty] Unify polarity-aware relation construction (#27707)
• b8c5e73 [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (#27706)
• 2b0d210 [ty] Centralize matched argument relations (#27705)
• a9130f3 [pyupgrade] Add rule to replace while 1 with while True (while-one, `...
• c64c7d6 [ty] Model try exception flow with operation checkpoints (#27471)
• 9dea5ef [ty] Avoid deriving sequents for typevars with concrete bounds (#27587)
• 9798e88 [ty] Preserve enum exhaustiveness with custom missing methods (#27700)
• Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• See full diff in compare view

Updates boto3-stubs[s3] to 1.43.72

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions