[dependabot]

Bumps the production-deps group with 6 updates:

Package	From	To
pydantic-settings	2.16.0	2.16.1
sqlalchemy	2.1.5	2.1.6
alembic	1.20.0	1.20.1
starlette	1.8.0	1.9.0
openai	3.35.0	3.37.0
semgrep	1.181.0	1.182.1

Updates pydantic-settings from 2.16.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

• Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
• A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

• Harden CI by @​Viicos in pydantic/pydantic-settings#1044
• Keep list of dicts CLI values as lists by @​hramezani in pydantic/pydantic-settings#1049
• Keep fixed-length tuple CLI positionals single-valued by @​hramezani in pydantic/pydantic-settings#1069
• Prepare release 2.16.1 by @​hramezani in pydantic/pydantic-settings#1087
• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

Commits

• 4e286e2 Prepare release 2.16.1 (#1087)
• 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
• f651a7a Keep list of dicts CLI values as lists (#1049)
• ecf7d90 Harden CI (#1044)
• See full diff in compare view

Updates sqlalchemy from 2.1.5 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

• [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

  This change is also backported to: 2.0.56

  References: #13711

• [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

  References: #13701

• [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

  References: #13709

orm extensions

• [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

  This change is also backported to: 2.0.56

  References: #13680

... (truncated)

Commits

• See full diff in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Updates starlette from 1.8.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

• 1840c9d Version 1.9.0 (#3676)
• 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
• 414af4f Remove unmaintained packages from the third-party packages page (#3674)
• d4df01a Add adminsite to the third-party packages (#3654)
• 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
• a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
• 6b11cd7 Honor streaming responses in TestClient (#3491)
• b7901fb Use byte length for typed memoryview response bodies (#3622)
• 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
• See full diff in compare view

Updates openai from 3.35.0 to 3.37.0

Release notes

Sourced from openai's releases.

v3.37.0

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

v3.36.1

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

v3.36.0

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)

... (truncated)

Changelog

Sourced from openai's changelog.

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)
• api: add custom voice consent management (#4135) (de6d70d)
• types: prepare native synchronous WebSocket option type (#4118) (90c0bac)

... (truncated)

Commits

• e8a0fd2 release: 3.37.0 (#4154)
• fa9a161 chore(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109)
• 1e45ad1 feat(api): expand Decisions input and question types (#4158)
• 1f76a59 ci: allow time for browser dependency installation (#4159)
• 7db9d88 chore(api): preserve file and video polling helpers (#4155)
• a29dc39 chore(api): preserve upload helpers and Live connection defaults (#4152)
• 49e6757 release: 3.36.1 (#4145)
• 6ed945e chore(api): clarify service-account API key deletion (#4151)
• 7cd7028 refactor: prepare handwritten vector-store polling runtime (#4148)
• d40a5e1 fix(api): honor per-call WebSocket query settings (#4138)
• Additional commits viewable in compare view

Updates semgrep from 1.181.0 to 1.182.1

Release notes

Sourced from semgrep's releases.

Release v1.182.0

1.182.0 - 2026-10-20

### Added

• Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

• c-sharp-pro grammar update (v0.23.1):

  • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
  • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

  (c-sharp-pro-v0.23.1)

• hcl grammar update (v1.2.0):

  • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
  • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
  • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

  (hcl-v1.2.0)

• lua grammar update (v0.5.0):

  • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
  • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
  • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
  • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
  • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

  (lua-v0.5.0)

### Fixed

• Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
• Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

• Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

Changelog

Sourced from semgrep's changelog.

Changelog

1.182.0 - 2026-10-20

### Added

• Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

• c-sharp-pro grammar update (v0.23.1):

  • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
  • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

  (c-sharp-pro-v0.23.1)

• hcl grammar update (v1.2.0):

  • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
  • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
  • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

  (hcl-v1.2.0)

• lua grammar update (v0.5.0):

  • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
  • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
  • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
  • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
  • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

  (lua-v0.5.0)

### Fixed

• Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
• Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

• Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[xzawed]

검토 — 머지 가능 (starlette 마이너만 소스로 확인)

starlette 1.8.0 → 1.9.0 (두 wheel diff -r):

• TestClient 가 응답 본문을 스트리밍한다(client.stream() 이 앱 종료 전에 돌아옴). 일반 요청(client.get/post)은 본문을 끝까지 읽는데, 본문 스트림의 끝(EndOfStream)은 앱 호출이 반환된 뒤(async with body_tx 종료)에만 온다 → BackgroundTask 를 포함한 앱 실행이 끝나야 돌아온다. 테스트가 기대는 «TestClient = BackgroundTask 동기 실행» 은 그대로다.
• request.url 이 경로 속 ?·#·\·앞 // 를 퍼센트 인코딩한다. PRG(src/ui/_helpers.py::def redirect_without_refresh)는 request.scope["path"] 를 직접 quote 하므로 무관. src/ui/error_page.py 의 request.url.path.startswith(...) 는 접두사만 봐서 결과가 같다.
• TrustedHostMiddleware·GZipMiddleware 는 쓰지 않는다. SessionMiddleware 의 Vary 보존은 헤더를 더 남길 뿐이다.

semgrep 1.182.1: mcp==1.29.0 · opentelemetry-api~=1.37.0 핀이 그대로라 pip-audit 예외 2건(CVE-2026-59951 · CVE-2026-114603)은 계속 필요하다 — 이 PR 의 pip-audit 초록과 일치(#1733 갱신).

나머지(pydantic-settings CLI 회귀 수정 · SQLAlchemy 2.1.6 / alembic 1.20.1 버그 수정 · openai Decisions 타입)는 우리 경로 밖이다. CI 13/13 초록 · mergeable_state=clean.

[xzawed]

@dependabot rebase

[xzawed]

⚠️ AI 리뷰가 완전 검증되지 않음 — 기본값이 적용됐습니다(비활성/API 키 없음/빈 diff). AI 배점은 측정값이 아니므로 총점을 부분 점수로 보세요.

🔵 SCAManager 분석 결과

총점: 89/100 (등급 B)

점수 상세

항목	점수	만점
커밋 메시지	13	15
코드 품질	25	25
보안	20	20
구현 방향성 (AI)	21	25
테스트	10	15

[xzawed]

✅ 자동 승인: 점수 89점 (기준: 60점 이상)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud