Skip to content

chore(deps): update uvicorn requirement from <0.49,>=0.32.0 to >=0.32.0,<0.55 - #260

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/pip/uvicorn-gte-0.32.0-and-lt-0.55
Oct 1, 2026
Merged

chore(deps): update uvicorn requirement from <0.49,>=0.32.0 to >=0.32.0,<0.55#260
github-actions[bot] merged 1 commit into
mainfrom
dependabot/pip/uvicorn-gte-0.32.0-and-lt-0.55

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on uvicorn to permit the latest version.

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

@dependabot @github

dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Oct 1, 2026
Closed
@dependabot
chore(deps): update uvicorn requirement
16665eb 
Updates the requirements on [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version.
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.32.0...0.54.0)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/uvicorn-gte-0.32.0-and-lt-0.55 branch from b5a1176 to 16665eb Compare October 1, 2026 12:53
@github-actions
github-actions Bot merged commit 2c4ba27 into main Oct 1, 2026
16 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/uvicorn-gte-0.32.0-and-lt-0.55 branch October 1, 2026 12:53
dev-bot-fusionaize pushed a commit that referenced this pull request Oct 4, 2026
@dependabot André Lange
chore(deps): update uvicorn requirement (#260)
756fb72 
Updates the requirements on [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version.
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.32.0...0.54.0)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dev-bot-fusionaize pushed a commit that referenced this pull request Oct 4, 2026
André Lange
docs(readme): state the repository provenance at both ends
6c03a13 
Adopts the provenance notice from LangeVC/ops-engine, verbatim and in the same
position - after the header block, before the first section - and repeats it in
the Repository & Contributing section at the bottom, so a reader who arrives at
either end learns which side is authoritative.

The surrounding text is corrected while doing it. It called the GitHub copy a
read-only mirror and said a pull request opened there cannot be merged. Both are
false: #259, #260 and #261 were all merged on the mirror's main by Dependabot,
and the Auto-merge workflow is active there. The real constraint is the one that
matters operationally and is now written down - the mirror's main is replaced by
whatever canonical holds, so a change that lands only on the mirror is lost at
the next release push unless it is carried over. Those three had to be carried
over by hand today.
dev-bot-fusionaize pushed a commit that referenced this pull request Oct 4, 2026
André Lange
Merge the repository provenance notice
62572dd 
Adopts the notice from LangeVC/ops-engine at both ends of the README, and
corrects the surrounding claim that the GitHub copy is read-only and its pull
requests cannot be merged - #259, #260 and #261 were all merged there by
Dependabot with auto-merge active. What is written now is the constraint that
actually holds: the mirror's main is replaced by whatever canonical holds, so a
change landing only on the mirror is lost at the next release push.

Documentation only, no version bump and no tag.
dev-bot-fusionaize pushed a commit that referenced this pull request Oct 4, 2026
André Lange
docs(readme): name the canonical home without naming the host
aedaf3c 
Follows Capacium/capacium, which carries the notice at both ends: a NOTE callout
after the badges and prose in the closing section. Neither names the git host or
a clone URL, which is the convention this repository was supposed to follow and
did not - the old closing section named both, and the previous commit copied that
to the top as well. Both are gone.

Two sentences are not taken over verbatim, because they are not true here.
Capacium calls its mirror read-only and says contributions are synchronized
automatically. On this mirror Dependabot opens pull requests and auto-merge is
active, so it is not read-only; and nothing syncs merges back - #259, #260 and
#261 were merged there and had to be carried upstream by hand for 2.10.1. The
closing section says that instead, since it is the part a contributor can be
caught by.

The one remaining langevc.com reference is faigate.langevc.com, a parked product
hostname explained in place, not the git origin.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants