chore(deps): bump the all group across 1 directory with 4 updates

[dependabot]

Bumps the all group with 4 updates in the / directory: starlette, morecantile, geojson-pydantic and httpx2.

Updates starlette from 1.6.0 to 1.7.0

Release notes

Sourced from starlette's releases.

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Changelog

Sourced from starlette's changelog.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Commits

• 2269e9a Version 1.7.0 (#3575)
• 4fe55eb Preserve FileResponse status for range requests (#3568)
• 1f08daf Mark OpenTelemetryMiddleware as experimental (#3574)
• 57de5fa Support HTTP response trailers in TestClient (#3563)
• 03f12b7 Allow HTTPException to use non-standard status codes (#3545)
• 76fd00f Reject WebSocket requests to StaticFiles (#3532)
• f03f65c docs: fix 'its not available' and 'This ensure' wording (#3526)
• 485aca4 docs: the test client is built on httpx2, not httpx (#3525)
• fd662b1 Implement identity on SimpleUser and UnauthenticatedUser (#3271)
• 41db6a7 Stabilize CodSpeed upload buffer allocations (#3524)
• Additional commits viewable in compare view

Updates morecantile from 7.0.3 to 7.1.0

Release notes

Sourced from morecantile's releases.

7.1.0

What's Changed

• Do not use strict equality for bouning boxes comparison by @​avalentino in developmentseed/morecantile#247
• Feat/add matrix to geojson by @​vincentsarago in developmentseed/morecantile#249

Full Changelog: developmentseed/morecantile@7.0.3...7.1.0

Changelog

Sourced from morecantile's changelog.

7.1.0 (2026-09-16)

• add matrix_to_geojson method to TileMatrixSet class

Commits

• 0e76c09 Bump version: 7.0.3 → 7.1.0
• 6c7c582 Merge pull request #249 from developmentseed/feat/add-matrix-to-geojson
• a198bed chore: update pre-commit config
• 05761e6 feat: add matrix-to-geojson method
• c78dd10 Merge pull request #248 from developmentseed/dependabot/github_actions/all-25...
• 90a006b Bump astral-sh/setup-uv in the all group across 1 directory
• 8f65c56 ci: refactor actions
• cee4d38 chore: update pre-commit and lockfile
• 4a27e68 Merge pull request #242 from developmentseed/dependabot/github_actions/all-bf...
• 672ae89 Merge pull request #247 from avalentino/bugfix/no-strict-equality
• Additional commits viewable in compare view

Updates geojson-pydantic from 2.1.2 to 2.2.0

Release notes

Sourced from geojson-pydantic's releases.

2.2.0

What's Changed

• Fix validation of numeric feature identifiers by @​bensynapse in developmentseed/geojson-pydantic#205

New Contributors

• @​bensynapse made their first contribution in developmentseed/geojson-pydantic#205

Full Changelog: developmentseed/geojson-pydantic@2.1.2...2.2.0

Changelog

Sourced from geojson-pydantic's changelog.

[2.2.0] - 2026-09-21

• Accept finite floating-point Feature IDs while preserving integer and string IDs. (author @​bensynapse, developmentseed/geojson-pydantic#205)

Commits

• 4a6ea0b Bump version: 2.1.2 → 2.2.0
• 0112880 chore: fix changelog
• a127ab4 chore: update changelog
• 50e217e chore: update lockfile and pre-commit config
• 401ceaf Merge pull request #203 from developmentseed/dependabot/github_actions/all-7a...
• edc5c44 Merge pull request #205 from bensynapse/fix-feature-numeric-ids
• 7b4d1ce Fix validation of numeric feature identifiers
• 5a8be88 Bump the all group across 1 directory with 2 updates
• 56796cd ci: bumb gh-action-pypi-publish to allow metadata 2.5
• d211149 chore: fix changelog
• See full diff in compare view

Updates httpx2 from 2.13.0 to 2.13.1

Release notes

Sourced from httpx2's releases.

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

🔐 Reliable proxy TLS and HTTP/2 negotiation

TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).

🧹 Clean WebSocket shutdown

The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).

httpx2

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2

Fixed

• Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).
• Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: pydantic/httpx2@v2.13.0...v2.13.1

Changelog

Sourced from httpx2's changelog.

2.13.1 (September 23rd, 2026)

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position. (#1214)
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown. (#1228)

Commits

• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• 62a607d Prepare version 2.14.0 (#1227)
• df9783d Respect file cursor positions when calculating raw content length (#1214)
• 04d152b docs: correct stale URL.query example (#1222)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'TiPg Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.30.

Benchmark suite	Current: e1faee6	Previous: 18ac437	Ratio
tests/benchmarks.py::test_benchmark_tilematrixset_endpoints[/collections/public.landsat_wrs/tiles]	58.89895818933959 iter/sec (stddev: 0.025068820692373265)	80.94010583928005 iter/sec (stddev: 0.00032003827055541897)	1.37

This comment was automatically generated by workflow using github-action-benchmark.