fix(deps): update all dependencies (!169) · Merge requests · Information Services / DevOps / Boilerplate Web Application

This MR contains the following updates:

Package	Change	Type	Update
coverage	`==7.13.2` → `==7.13.3`		patch
debugpy (source)	`==1.8.19` → `==1.8.20`		patch
externalsettings	`==2.0.4` → `==2.0.10`		patch
faker (changelog)	`==40.1.2` → `==40.4.0`		minor
gunicorn (changelog)	`==24.1.1` → `==25.0.3`		major
ipython	`==9.9.0` → `==9.10.0`		minor
mkdocstrings (changelog)	`==1.0.2` → `==1.0.3`		patch
poetry (changelog)	`==2.3.1` → `==2.3.2`		patch
poetry-core	`==2.3.0` → `==2.3.1`		patch
postgres	`5773fe7` → `1090bc3`	service-image	digest
python-poetry/poetry	`2.3.1` → `2.3.2`	repository	patch
uis/devops/continuous-delivery/ci-templates	`v7.25.15` → `v7.27.8`	repository	minor

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

coveragepy/coveragepy (coverage)

`v7.13.3`

Compare Source

Fix: in some situations, third-party code was measured when it shouldn't have been, slowing down test execution. This happened with layered virtual environments such as uv sometimes makes. The problem is fixed, closing issue 2082_. Now any directory on sys.path that is inside a virtualenv is considered third-party code.

.. _issue 2082: #2082

.. _changes_7-13-2:

microsoft/debugpy (debugpy)

`v1.8.20`: debugpy v1.8.20

Compare Source

Fixes for:

annotate in 3.14 causing exceptions: #1971

Enhancements:

Use remote_exec if available: c7e86a1
Support more architectures: 1bbecdf

Infrastructure work:

Support devcontainers for development: 7dbc229

Thanks to @rameshvarun, @Xeonacid, and @pdepetro for the commits

joke2k/faker (faker)

`v40.4.0`

Compare Source

Add passport and cie for it_IT. Thanks @ElektroDuck.

`v40.3.0`

Compare Source

Add major Greek banks to el_GR bank provider. Thanks @bon12-gr.

`v40.2.0`

Compare Source

Update internet pt_bR provider (domains, tlds, slugify). Thanks @MorganaSilva.

`v40.1.3`

Compare Source

fix pyfloat TypeError when combining positive=True with max_value. Thanks @odrigobnogueira.

benoitc/gunicorn (gunicorn)

`v25.0.3`

Compare Source

What's Changed

Bug Fixes

Fix RuntimeError when StopIteration raised in ASGI coroutine (#3484)
Fix passing maxsplit in re.split() as positional argument (deprecated in Python 3.13)

Documentation

Updated sponsorship section and homepage

Full Changelog: https://github.com/benoitc/gunicorn/compare/25.0.2...25.0.3

`v25.0.2`

Compare Source

What's Changed

Bug Fixes

Fix ASGI concurrent request failures through nginx proxy
Graceful disconnect handling for ASGI worker
Lazy import dirty module for gevent compatibility

Other

Increase CI timeout for signal tests on PyPy
Remove trailing blank line in instrument/init.py

Full Changelog: https://github.com/benoitc/gunicorn/compare/25.0.1...25.0.2

`v25.0.1`

Compare Source

Bug Fixes

Fix ASGI streaming responses (SSE) hanging: add chunked transfer encoding for HTTP/1.1 responses without Content-Length header. Without chunked encoding, clients wait for connection close to determine end-of-response.

Changes

Update celery_alternative example to use FastAPI with native ASGI worker and uvloop for async task execution

Testing

Add ASGI compliance test suite with Docker-based integration tests covering HTTP, WebSocket, streaming, lifespan, framework integration (Starlette, FastAPI), HTTP/2, and concurrency scenarios

`v25.0.0`: Gunicorn 25.0.0

Compare Source

New Features

Dirty Arbiters: Separate process pool for executing long-running, blocking operations (AI model loading, heavy computation) without blocking HTTP workers (MR #3460)
- Inspired by Erlang's dirty schedulers
- Asyncio-based with Unix socket IPC
- Stateful workers that persist loaded resources
- New settings: --dirty-app, --dirty-workers, --dirty-timeout, --dirty-threads, --dirty-graceful-timeout
- Lifecycle hooks: on_dirty_starting, dirty_post_fork, dirty_worker_init, dirty_worker_exit
Per-App Worker Allocation for Dirty Arbiters: Control how many dirty workers load each app for memory optimization with heavy models (MR #3473)
- Set workers class attribute on DirtyApp (e.g., workers = 2)
- Or use config format module:class:N (e.g., myapp:HeavyModel:2)
- Requests automatically routed to workers with the target app
- New exception DirtyNoWorkersAvailableError for graceful error handling
- Example: 8 workers × 10GB model = 80GB → with workers=2: 20GB (75% savings)
HTTP/2 Support (Beta): Native HTTP/2 (RFC 7540) support for improved performance with modern clients (MR #3468)
- Multiplexed streams over a single connection
- Header compression (HPACK)
- Flow control and stream prioritization
- Works with gthread, gevent, and ASGI workers
- New settings: --http-protocols, --http2-max-concurrent-streams, --http2-initial-window-size, --http2-max-frame-size, --http2-max-header-list-size
- Requires SSL/TLS and h2 library: pip install gunicorn[http2]
- New example: examples/http2_gevent/ with Docker and tests
HTTP 103 Early Hints: Support for RFC 8297 Early Hints to enable browsers to preload resources before the final response (MR #3468)
- WSGI: environ['wsgi.early_hints'](headers) callback
- ASGI: http.response.informational message type
- Works with both HTTP/1.1 and HTTP/2
uWSGI Protocol for ASGI Worker: The ASGI worker now supports receiving requests via the uWSGI binary protocol from nginx (MR #3467)

Bug Fixes

Fix HTTP/2 ALPN negotiation for gevent and eventlet workers when do_handshake_on_connect is False (the default). The TLS handshake is now explicitly performed before checking selected_alpn_protocol().
Fix setproctitle initialization with systemd socket activation (#3465)
Fix Expect: 100-continue handling: ignore the header for HTTP/1.0 requests since 100-continue is only valid for HTTP/1.1+ (MR #3463)
Fix missing _expected_100_continue attribute in UWSGIRequest
Disable setproctitle on macOS to prevent segfaults during process title updates
Publish full exception traceback when the application fails to load (#3462)
Fix ASGI: quick shutdown on SIGINT/SIGQUIT, graceful on SIGTERM

Deprecations

Eventlet Worker: The eventlet worker is deprecated and will be removed in Gunicorn 26.0. Eventlet itself is no longer actively maintained. Please migrate to gevent, gthread, or another supported worker type.

Changes

Remove obsolete Makefile targets (MR #3471)
Replace RST with markdown documentation format

ipython/ipython (ipython)

`v9.10.0`

Compare Source

mkdocstrings/mkdocstrings (mkdocstrings)

`v1.0.3`

Compare Source

Compare with 1.0.2

Bug Fixes

Forward extension instances directly passed from Zensical (65b27ec by Timothée Mazzucotelli).
Propagate Zensical's zrelpath processor (dbf263d by Timothée Mazzucotelli).

python-poetry/poetry (poetry)