chore(deps): update python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fastapi (changelog)	==0.129.0 → ==0.133.1
sqlalchemy (changelog)	==2.0.46 → ==2.0.47

---

Release Notes

fastapi/fastapi (fastapi)

v0.133.1

Compare Source

Features

• 🔧 Add FastAPI Agent Skill. PR #​14982 by @​tiangolo.
  • Read more about it in Library Agent Skills.

Internal

• ✅ Fix all tests are skipped on Windows. PR #​14994 by @​YuriiMotov.

v0.133.0

Compare Source

v0.132.1

Compare Source

Refactors

• ♻️ Refactor logic to handle OpenAPI and Swagger UI escaping data. PR #​14986 by @​tiangolo.

Internal

• 👥 Update FastAPI People - Experts. PR #​14972 by @​tiangolo.
• 👷 Allow skipping benchmark job in test workflow. PR #​14974 by @​YuriiMotov.

v0.132.0

Compare Source

Breaking Changes

• 🔒️ Add strict_content_type checking for JSON requests. PR #​14978 by @​tiangolo.
  • Now FastAPI checks, by default, that JSON requests have a Content-Type header with a valid JSON value, like application/json, and rejects requests that don't.
  • If the clients for your app don't send a valid Content-Type header you can disable this with strict_content_type=False.
  • Check the new docs: Strict Content-Type Checking.

Internal

• ⬆ Bump flask from 3.1.2 to 3.1.3. PR #​14949 by @​dependabot[bot].
• ⬆ Update all dependencies to use griffelib instead of griffe. PR #​14973 by @​svlandeg.
• 🔨 Fix FastAPI People workflow. PR #​14951 by @​YuriiMotov.
• 👷 Do not run codspeed with coverage as it's not tracked. PR #​14966 by @​tiangolo.
• 👷 Do not include benchmark tests in coverage to speed up coverage processing. PR #​14965 by @​tiangolo.

v0.131.0

Compare Source

Breaking Changes

• 🗑️ Deprecate ORJSONResponse and UJSONResponse. PR #​14964 by @​tiangolo.

v0.130.0

Compare Source

Features

• ✨ Serialize JSON response with Pydantic (in Rust), when there's a Pydantic return type or response model. PR #​14962 by @​tiangolo.
  • This results in 2x (or more) performance increase for JSON responses.
  • New docs: Custom Response - JSON Performance.

v0.129.2

Compare Source

Internal

• ⬆️ Upgrade pytest. PR #​14959 by @​tiangolo.
• 👷 Fix CI, do not attempt to publish fastapi-slim. PR #​14958 by @​tiangolo.
• ➖ Drop support for fastapi-slim, no more versions will be released, use only "fastapi[standard]" or fastapi. PR #​14957 by @​tiangolo.
• 🔧 Update pyproject.toml, remove unneeded lines. PR #​14956 by @​tiangolo.

v0.129.1

Compare Source

Fixes

• ♻️ Fix JSON Schema for bytes, use "contentMediaType": "application/octet-stream" instead of "format": "binary". PR #​14953 by @​tiangolo.

Docs

• 🔨 Add Kapa.ai widget (AI chatbot). PR #​14938 by @​tiangolo.
• 🔥 Remove Python 3.9 specific files, no longer needed after updating translations. PR #​14931 by @​tiangolo.
• 📝 Update docs for JWT to prevent timing attacks. PR #​14908 by @​tiangolo.

Translations

• ✏️ Fix several typos in ru translations. PR #​14934 by @​argoarsiks.
• 🌐 Update translations for ko (update-all and add-missing). PR #​14923 by @​YuriiMotov.
• 🌐 Update translations for uk (add-missing). PR #​14922 by @​YuriiMotov.
• 🌐 Update translations for zh-hant (update-all and add-missing). PR #​14921 by @​YuriiMotov.
• 🌐 Update translations for fr (update-all and add-missing). PR #​14920 by @​YuriiMotov.
• 🌐 Update translations for de (update-all) . PR #​14910 by @​YuriiMotov.
• 🌐 Update translations for ja (update-all). PR #​14916 by @​YuriiMotov.
• 🌐 Update translations for pt (update-all). PR #​14912 by @​YuriiMotov.
• 🌐 Update translations for es (update-all and add-missing). PR #​14911 by @​YuriiMotov.
• 🌐 Update translations for zh (update-all). PR #​14917 by @​YuriiMotov.
• 🌐 Update translations for uk (update-all). PR #​14914 by @​YuriiMotov.
• 🌐 Update translations for tr (update-all). PR #​14913 by @​YuriiMotov.
• 🌐 Update translations for ru (update-outdated). PR #​14909 by @​YuriiMotov.

Internal

• 👷 Always run tests on push to master branch and when run by scheduler. PR #​14940 by @​YuriiMotov.
• 🎨 Upgrade typing syntax for Python 3.10. PR #​14932 by @​tiangolo.
• ⬆ Bump cryptography from 46.0.4 to 46.0.5. PR #​14892 by @​dependabot[bot].
• ⬆ Bump pillow from 12.1.0 to 12.1.1. PR #​14899 by @​dependabot[bot].

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

backend/requirements.txt

Package	Version	License	Issue Type
fastapi	0.133.1	Null	Unknown License
sqlalchemy	2.0.47	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/fastapi	0.133.1	Unknown	Unknown
pip/sqlalchemy	2.0.47	Unknown	Unknown

Scanned Files

• backend/requirements.txt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.82%. Comparing base (af4e255) to head (a196228).
⚠️ Report is 10 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #211   +/-   ##
=======================================
  Coverage   71.82%   71.82%           
=======================================
  Files          11       11           
  Lines         802      802           
  Branches      124      124           
=======================================
  Hits          576      576           
  Misses        163      163           
  Partials       63       63           

Flag	Coverage Δ
backend	71.82% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.