[dependabot]

Updates the requirements on pydantic, starlette, sqlalchemy, jsonpath-ng, asyncpg, asyncmy, aio-pika, fastapi, granian, openfeature-flagd-core, gitpython, websockets, boto3, azure-storage-blob, opentelemetry-api, opentelemetry-sdk, opentelemetry-instrumentation-starlette, pyjwt, cryptography, uvloop, playwright, coverage, mypy, ruff, opentelemetry-exporter-otlp-proto-http, markdown, pymdown-extensions and pdfplumber to permit the latest version.
Updates pydantic to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates starlette to 1.8.0

Release notes

Sourced from starlette's releases.

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
• Resolve the multipart charset once per request instead of once per field #3618.

Fixed

• Preserve response trailers through GZipMiddleware #3565.
• Stop FileResponse transfers when the client disconnects #3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
• Ignore Range when If-Range contains a weak ETag #3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
• Add Vary: Cookie when Session.pop() removes an existing key #3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
• Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Changelog

Sourced from starlette's changelog.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
• Resolve the multipart charset once per request instead of once per field #3618.

Fixed

• Preserve response trailers through GZipMiddleware #3565.
• Stop FileResponse transfers when the client disconnects #3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
• Ignore Range when If-Range contains a weak ETag #3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
• Add Vary: Cookie when Session.pop() removes an existing key #3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
• Bracket IPv6 hostnames in URL.replace() #3617.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.

... (truncated)

Commits

• 7b2948f Version 1.8.0 (#3660)
• 5b544ce Send response start immediately when GZipMiddleware cannot compress (#3631)
• 96d5023 Emit Max-Age=0 on session cookie when max_age=0 (#3651)
• 0a15da3 Include allowed methods in StaticFiles 405 responses (#3640)
• ff5b4df Close Request.stream() generators with aclosing (#3628)
• 7cb2f09 Mark sessions as accessed when popping existing keys (#3186)
• c67ca4e Add HTTP 103 Early Hints support (#3435)
• 04741d0 Update broken external documentation links (#3621)
• 470f986 Correct the documented WebSocket and Request constructor signatures (#3580)
• b2e8750 Bracket IPv6 hostnames in URL.replace() (#3617)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.1.5

Release notes

Sourced from sqlalchemy's releases.

2.1.5

Released: October 16, 2026

orm

• [orm] [feature] Added the _orm.Unmapped annotation and the _orm.unmapped_column() construct, providing a declarative-compatible approach to having "excluded" columns in a Declarative model, that is, columns that are part of the _schema.Table but are not mapped, replacing the use of _orm.Mapper.exclude_properties for this purpose when using a Declarative mapping.

  References: #13650

• [orm] [bug] [regression] Fixed regression caused by #11917 in version 2.0.36 where an ORM enabled _sql.update() using WHERE criteria which matched more than one object present in the _orm.Session would expire server-side onupdate columns, as well as columns that were SET to a SQL expression, on only one of the matched objects, leaving the remaining objects with stale values for those attributes. The columns are now expired for all matched objects.

  This change is also backported to: 2.0.55

  References: #13675

• [orm] [deprecated] Using the _orm.Mapper.exclude_properties or _orm.Mapper.include_properties parameters on a Declarative mapping to exclude attributes that are declared on the class, such as with _orm.mapped_column(), is deprecated and now emits a deprecation warning. This use was never supported, and depending on the arguments passed to _orm.mapped_column(), the attribute could remain mapped regardless; in particular, as of 2.1 this includes ORM mapped dataclasses where _orm.mapped_column.default is present. The new _orm.unmapped_column() construct should be used instead. Excluding columns that are present only in the _schema.Table, such as those from __table__, __table_args__ or table reflection, is not affected.

  References: #13650

schema

• [schema] [bug] Fixed issue where dialect-specific keyword arguments established on a ForeignKeyConstraint, ForeignKey or CheckConstraint, such as postgresql_not_valid, were not carried along to the copy of the constraint produced by

... (truncated)

Commits

• See full diff in compare view

Updates jsonpath-ng to 1.11.0

Release notes

Sourced from jsonpath-ng's releases.

v1.11.0

Breaking changes

• When applying an index to a string, nothing will be returned.

  Previously, an index applied to a string would "find" individual characters. For example, $[0] applied to "abc" would find "a".

  This change improves RFC 9535 compliance.

• Slices and the [*] wildcard no longer coerce scalars and objects into arrays. (#96)

  Previously, $[*] applied to "abc" or 5 would find the value itself, and $[*] applied to {"a": 1} would find the whole object. This also caused $..[*] to return phantom nodes, such as the root object and a second copy of each string.

  Now, slices like [0:2] find nothing unless they are applied to an array, and [*] finds the member values of an object or the elements of an array and nothing from a scalar value.

  This change improves RFC 9535 compliance.

Fixed

• Fix RecursionError when paths using .. are applied to deeply nested data.

  It is still possible to encounter RecursionError. For example, very long JSONPath expressions can still raise RecursionError.

  Note that cyclic data structures can trigger indefinite execution, as can updating data with a value that the path can match again. Cyclic data structures are impossible to encounter in JSON and can only be constructed programmatically in Python.

• Make Descendants.find() runtimes scale linearly with the depth of the data.

• Fix TypeError when an index like [0] is applied to a scalar value.

  These values now match nothing, as required by RFC 9535.

• Fix ..[*] omitting the member values of objects. (#96)

• Fix * (used as a field) omitting the elements of arrays. (#11, #164)

  $.* and $..* now find array elements as well as object member values.

  update() and filter() now also act on array elements for these wildcards.

... (truncated)

Changelog

Sourced from jsonpath-ng's changelog.

1.11.0 - 2026-10-16

Breaking changes

• When applying an index to a string, nothing will be returned.

  Previously, an index applied to a string would "find" individual characters. For example, $[0] applied to "abc" would find "a".

  This change improves RFC 9535 compliance.

• Slices and the [*] wildcard no longer coerce scalars and objects into arrays. (#96)

  Previously, $[*] applied to "abc" or 5 would find the value itself, and $[*] applied to {"a": 1} would find the whole object. This also caused $..[*] to return phantom nodes, such as the root object and a second copy of each string.

  Now, slices like [0:2] find nothing unless they are applied to an array, and [*] finds the member values of an object or the elements of an array and nothing from a scalar value.

  This change improves RFC 9535 compliance.

Fixed

• Fix RecursionError when paths using .. are applied to deeply nested data.

  It is still possible to encounter RecursionError. For example, very long JSONPath expressions can still raise RecursionError.

  Note that cyclic data structures can trigger indefinite execution, as can updating data with a value that the path can match again. Cyclic data structures are impossible to encounter in JSON and can only be constructed programmatically in Python.

• Make Descendants.find() runtimes scale linearly with the depth of the data.

• Fix TypeError when an index like [0] is applied to a scalar value.

  These values now match nothing, as required by RFC 9535.

• Fix ..[*] omitting the member values of objects. (#96)

• Fix * (used as a field) omitting the elements of arrays. (#11, #164)

  $.* and $..* now find array elements as well as object member values.

... (truncated)

Commits

• 8bb8915 Release v1.11.0 (#294)
• 02851a4 Update project metadata
• 2edf99f Allow true and false as field names; fix bool comparisons (#293)
• a7e78d3 Allow true and false as field names; fix bool comparisons
• 74d89a0 Allow filters to compare against JSON null values (#292)
• 8a11de4 Allow filters to compare against JSON null values
• ee19dfb Fix a parse error when a filter follows .. (#291)
• d867262 Fix a parse error when a filter follows ..
• e927b30 Fix * ignoring the elements of arrays (#290)
• 3ac8593 Fix * ignoring the elements of arrays
• Additional commits viewable in compare view

Updates asyncpg to 0.32.0

Release notes

Sourced from asyncpg's releases.

v0.32.0

Improvements

• Support Python 3.15 (#1367, #1378) (by @​elprans in 1b118464 and 58c0c595)

• Support PostgreSQL 19 (#1379) (by @​elprans in 8d2a5aed)

• Make pool min_size a maintained connection floor and add init_size to control the number of connections opened at startup (#1323). Idle connections at or below min_size are retained, and closed connections are replaced in the background. init_size defaults to min_size. To preserve the previous behavior, where the pool could drain to zero, replace min_size=N with init_size=N, min_size=0. (by @​shatilov-diman in 67a1cbc5)

• Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#1359) (by @​twelfthlabor in 00319a9b)

• Use the statement cache for copy_records_to_table() introspection (#1360) (by @​matemax in dd058652)

Fixes

• Clean up connections rejected by target_session_attrs immediately so an unresponsive rejected host cannot delay the selected connection, and cleanup tasks cannot outlive the event loop. Rejected connections are aborted without waiting for a graceful disconnect; servers may log "unexpected EOF on client connection" if the Terminate message is not delivered before the transport closes.

• Fix a connection pool deadlock when releasing a connection after a protocol abort (#1324) (by @​pchaseh in 4a83cc2f)

• Honor Connection.close(timeout=...) while waiting for a pending cancellation (#1361) (by @​gyanu2507 in c06bcb4d)

• Prevent stuck cancellation from blocking connection teardown or pool release by bounding cancellation with the command or release timeout (#1370) (by @​elprans in 4cf02203)

• Preserve the server error when the connection closes mid-operation (#1369) (by @​RitiGrover in 6c8f1a7a)

• Fix COPY cleanup when a records generator raises, preserving the original exception and avoiding protocol desynchronization and stalled rollback (#1358) (by @​CodingCossack in fdc6bc8f)

... (truncated)

Commits

• d701e11 asyncpg v0.32.0
• b04f8f2 Bump to macOS 26 in runners, set deployment target to 11 (#1384)
• 3934d77 tests: Capture expected pool retry warnings during role changes (#1383)
• 2c37501 tests: Avoid DeprecationWarning when settings up uvloop (#1382)
• b7eea79 Test pool min_size backoff on target attribute mismatch (#1381)
• 46dda91 Terminate rejected target_session_attrs candidates before returning (#1380)
• 8d2a5ae Support PostgreSQL 19 (#1379)
• 58c0c59 Bump uvloop (#1378)
• 67a1cbc Make pool min_size a maintained connection floor (#1323)
• 25aaaf5 fix: allow cursors in external transactions (#1350)
• Additional commits viewable in compare view

Updates asyncmy to 0.2.16

Release notes

Sourced from asyncmy's releases.

v0.2.16

• Make Connection.ensure_closed() tear the connection down locally instead of raising OperationalError(2006) when the server already closed the stream, so pool invalidation of a dead connection (e.g. SQLAlchemy do_terminate) no longer fails.
• Fix SSDictCursor returning tuples instead of dictionaries, and honor custom dict_type subclasses when fetching unbuffered rows (#164).

Full changelog: long2ice/asyncmy@v0.2.15...v0.2.16

Changelog

Sourced from asyncmy's changelog.

0.2.16

• Make Connection.ensure_closed() tear the connection down locally instead of raising OperationalError(2006) when the server already closed the stream, so pool invalidation of a dead connection (e.g. SQLAlchemy do_terminate) no longer fails.
• Fix SSDictCursor returning tuples instead of dictionaries, and honor custom dict_type subclasses when fetching unbuffered rows (#164).

0.2.15

• Fix read_timeout losing data, EOF, or error notifications when the transport callback runs before the read waiter is registered, notably on Python 3.9/3.10 (#155).
• Close the in-flight connection when Pool.wait_closed() is cancelled, and serialize concurrent drainers so shutdown cannot report completion before connections close (#156).
• Raise DBAPI OperationalError for writes to closed transports (including uvloop) so SQLAlchemy's pool_pre_ping can recognize the disconnect and replace the connection (#158).
• Fix Pool.wait_closed() blocking forever when the last connection was released while inside a transaction or after disconnecting, and notify pool waiters when a pool-filling connect() raises (#154).
• Fix Pool.terminate() not notifying wait_closed() waiters parked on the pool's condition, so a wait_closed() call already in flight when terminate() runs would hang forever even though the pool was fully drained (#157).

0.2.14

• Set the PEP 249 module globals apilevel, threadsafety and paramstyle, and export the exception classes from asyncmy (#77).
• Expose the server's SQLSTATE on exceptions as MySQLError.sqlstate; args is unchanged (#138).
• Fix ssl=True silently connecting in plaintext: it now builds a default TLS context, and an ssl argument that is neither True, a dict, nor an ssl.SSLContext raises ValueError instead of disabling TLS (#90).
• Connection.cursor() is now awaitable, so aiomysql's cur = await conn.cursor() spelling works; conn.cursor() and async with conn.cursor() are unaffected (#145).
• Add Gtid.__hash__ / GtidSet.__hash__ — defining __eq__ had made Gtid unhashable, which made GtidSet (and therefore GTID replication) unusable (#59).
• Declare the Cython modules free-threading compatible. Without this, importing asyncmy re-enables the GIL for the whole process on a free-threaded build. Module-level state is built during import and read-only afterwards; this does not make a single Connection/Cursor safe to share between threads. Requires Cython 3.1+, and CI now runs the suite on 3.14t. Thanks @​honglei (#151).
• Read the version from the installed package metadata instead of repeating it in asyncmy/version.py, so pyproject.toml is the single source and the _client_version the server sees cannot drift. Thanks @​waketzheng (#149).
• Ship type information (PEP 561): py.typed plus .pyi stubs for the Cython modules, so mypy and Pylance see real signatures instead of nothing. make stubs regenerates them and make check runs stubtest, which fails on any drift from the compiled modules (#78).
• Add connect(password_creator=...): a callable consulted before every connection attempt, including the ones a pool makes when it recycles or reconnects, so short-lived credentials such as AWS RDS IAM tokens can be refreshed. May return an awaitable. Thanks @​DolevGabay (#139).
• Fix ping(reconnect=True) never actually reconnecting: _connected stayed set when the ping

... (truncated)

Commits

• b5bffd2 chore: bump version to 0.2.16
• 82bba06 fix: honor SSDictCursor row conversion overrides
• 0000bd0 Merge pull request #163 from Instawork/fix/ensure-closed-dead-peer
• 9732254 test: match the ensure_closed tests to the existing write-error matrix
• bfa64f7 docs: mirror the ensure_closed docstring in the generated stub
• 6bb785a fix: do not raise from ensure_closed() when the peer already closed the stream
• e2b8d84 chore: bump version to 0.2.15
• 43c9bb9 Merge pull request #160 from long2ice/fix/connection-lifecycle
• bd81bee fix: handle read races and connection shutdown failures
• 65b674e Merge pull request #159 from RitiGrover/fix/pool-terminate-notify-all-waiters
• Additional commits viewable in compare view

Updates aio-pika to 10.1.1

Release notes

Sourced from aio-pika's releases.

10.1.1

What's Changed

• Include package metadata in PyInstaller bundles by @​mosquito in mosquito/aio-pika#721
• Restore robust consumers after broker cancellation by @​mosquito in mosquito/aio-pika#723

Full Changelog: mosquito/aio-pika@10.1.0...10.1.1

Changelog

Sourced from aio-pika's changelog.

9.6.0

• Fixed callback-based consumers not resuming after connection reconnection #588
• Fixed queue iterators raising StopAsyncIteration on channel reconnection #540
• Added close_called property to AbstractConnection and Connection to distinguish intentional vs. automatic connection closures
• Migrated build tooling from Poetry to UV
• Migrated linting from Pylama to Ruff
• Improved logging: split log.exception calls into error-level message and debug-level traceback #693
• Removed testcontainers dependency from tests

9.5.5

• Replace WeakSet with set for robust channels tracking #666 by shushpanov

9.5.4

• fix: RobustChannel should not reopen after close() call #658

9.5.3

• python3.8-eol #657
• self-hosted docs

9.5.2

• Fix documentation links

9.5.1

• Fix documentation links

9.5.0

• Fix two bugs by adding more type hints to CallbackCollection. @​Darsstar
• Dropped python 3.7 @​Darsstar
• QueueIterator raises StopAsyncIteration when channel is closed. @​Darsstar

9.4.3

• fix: raise ChannelInvalidStateError at exchange.publish with closed channel #637

9.4.2

... (truncated)

Commits

• 39cc074 Merge pull request #723 from mosquito/fix/broker-consumer-cancel
• 7e5adfb Restore robust consumers after broker cancellation
• 4f8b124 Merge pull request #721 from mosquito/fix/pyinstaller-metadata
• 360dd15 Include package metadata in PyInstaller bundles
• 2a41f79 Merge pull request #720 from mosquito/fix/url-connection-options
• d765739 Cover typed connection options with custom connection classes
• aefa7c6 Fix overloads of connect and connect_robust methods
• 301d711 Merge URL connection options and forward client properties
• 6ea7396 Merge pull request #719 from mosquito/test/pool-consumer-recovery
• 41322ff Cover pooled consumer recovery after broker restarts
• Additional commits viewable in compare view

Updates fastapi to 0.143.3

Release notes

Sourced from fastapi's releases.

0.143.3

Fixes

• 🐛 Fix non-finite float serialization in JSONL and SSE streams. PR #16509 by @​tiangolo.

Docs

• 🎨 Update Python format in Markdown with Ruff. PR #16505 by @​tiangolo.

Commits

• bb7f314 🔖 Release version 0.143.3 (#16510)
• c34a14c 📝 Update release notes
• d1fd422 🐛 Fix non-finite float serialization in JSONL and SSE streams (#16509)
• 0b91981 📝 Update release notes
• 64efa4f 🎨 Update Python format in Markdown with Ruff (#16505)
• ba24dc3 🔖 Release version 0.143.2 (#16504)
• 98050ee 📝 Update release notes
• d0282a3 🐛 Fix blocking frontend fallback file checks (#16503)
• db04f5b 📝 Update release notes
• fd0614c 🌐 Update translations for zh-hant (update-outdated) (#16500)
• Additional commits viewable in compare view

Updates granian to 2.8.4

Release notes

Sourced from granian's releases.

Granian 2.8.4

Patch release

Changes since 2.8.3:

• Fix ASGI query-string encoding in access log
• Fix IPv6 formatting in server log
• Notify ASGI/RSGI apps of client disconnection on HTTP/2 stream reset
• Avoid to raise errors in ASGI websockets' send calls
• Bump dependencies

Commits

• 7e783a4 Review tests server start mechanics
• 4fdf330 Avoid to raise errors in ws ASGI send (close #922)
• 22b54de Fix IPv6 formatting in server log (#919)
• ff8a47d Bump dependencies
• e406d50 Refactor disconnection guards (#926)
• 0db87ae Fix query-string encoding in ASGI access log (close #920)
• 8b72ff7 Bump version to 2.8.4
• See full diff in compare view

Updates openfeature-flagd-core to 2.0.0

Release notes

Sourced from openfeature-flagd-core's releases.

openfeature-flagd-core: v2.0.0

2.0.0 (2026-10-15)

⚠ BREAKING CHANGES

• bucket on any context type; (fractional re-assignment) (#415)

✨ New Features

• bucket on any context type; (fractional re-assignment) (#415) (e4681b0)

Commits

• 105fa36 chore(main): release openfeature-flagd-core 2.0.0 (#459)
• b92cb33 chore: remove release-as field from configuration
• e4681b0 feat!: bucket on any context type; (fractional re-assignment) (#415)
• 8416d9d chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.17.0 (#457)
• ac4586c chore(deps): update github/codeql-action action to v4.38.3 (#455)
• 0c6268f chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.16.10 (#444)
• 357ca9d chore(deps): update github/codeql-action action to v4.38.2 (#452)
• d2b1bab chore: standardize/update release please config (#451)
• c3fedd3 chore(deps): update python docker tag to v3.14 (#445)
• ede7f75 chore(deps): update github/codeql-action action to v4.38.1 (#450)
• Additional commits viewable in