[dependabot]

Bumps the compatible-updates group with 8 updates in the / directory:

Package	From	To
packaging	26.2	26.3
platformdirs	4.11.0	4.13.5
pydantic	2.13.4	2.14.1
pydantic-settings	2.14.2	2.16.1
pyjwt	2.13.0	2.15.1
sqlalchemy	2.0.51	2.1.6
typer	0.27.0	0.27.3
build	1.5.0	1.6.1

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates platformdirs from 4.11.0 to 4.13.5

Release notes

Sourced from platformdirs's releases.

4.13.5

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. #631

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.4...4.13.5

4.13.4

• Require a complete files path segment when locating Android app directories from sys.path. #621
• Keep root directory tests independent of inherited XDG environment variables. #622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. #624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. #625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. #627
• Correct the contributor guide to name ty as the type checker used by the type environment. #623

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.3...4.13.4

4.13.3

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.2...4.13.3

4.13.2

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. #619

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.1...4.13.2

4.13.1

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. #618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.0...4.13.1

4.13.0

• Detect Homebrew Python for the MacOS site directories under python:-S, which leaves base_prefix on the Cellar keg, and for the python-freethreading formula - by sricharanreddycheruku. #612
• Use Python 3.15 for development and automation. #613

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.13.5 (2026-10-19)

---

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

---

4.13.4 (2026-10-17)

---

• Require a complete files path segment when locating Android app directories from sys.path. :pr:621
• Keep root directory tests independent of inherited XDG environment variables. :pr:622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
• Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

---

4.13.3 (2026-10-16)

---

---

4.13.2 (2026-10-16)

---

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

---

4.13.1 (2026-10-15)

---

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

---

4.13.0 (2026-10-10)

---

... (truncated)

Commits

• 5702904 Release 4.13.5
• 4b2b6a5 🐛 fix(release): trim GitHub release notes (#631)
• 6f7e3e2 👷 ci: collect required checks (#628)
• caa5626 Release 4.13.4
• 9b5c0fd fix(windows): raise when no home directory resolves (#627)
• da72995 fix: require a complete files segment when finding Android app folders (#621)
• da89726 test: isolate root directory checks from inherited XDG settings (#622)
• fb0b1a9 fix: keep root directory accessors consistent during isolation (#625)
• 91f7775 fix(ios): raise when no home directory resolves (#624)
• ed9f25f ci: rerun news check on label changes (#626)
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates pydantic-settings from 2.14.2 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

• Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
• A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

• Harden CI by @​Viicos in pydantic/pydantic-settings#1044
• Keep list of dicts CLI values as lists by @​hramezani in pydantic/pydantic-settings#1049
• Keep fixed-length tuple CLI positionals single-valued by @​hramezani in pydantic/pydantic-settings#1069
• Prepare release 2.16.1 by @​hramezani in pydantic/pydantic-settings#1087
• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

• Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
• python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
• Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
• validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
• CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
• JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
• Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

• Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
• Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
• AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
• env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
• CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits

• 4e286e2 Prepare release 2.16.1 (#1087)
• 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
• f651a7a Keep list of dicts CLI values as lists (#1049)
• ecf7d90 Harden CI (#1044)
• 8c259f4 Prepare release 2.16.0 (#1043)
• 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
• f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
• cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
• 081d39f Fix config file and CLI values being ignored when alias differs from validati...
• c46ebc4 Expand home paths when checking TOML table headers (#1034)
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).
v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__
Security

• Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed

• JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
• PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table> 

... (truncated)

Commits

• 7d5ef55 chore: prepare 2.15.1 release
• 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
• 1d41a64 chore: prepare 2.15.0 release
• 9bc0665 fix: make recursive payload tests deterministic
• 5fde08a fix: normalize recursive JWT payload errors
• 171062d utils: mention bytes in force_bytes type error (#1173)
• c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
• 2763752 Add support for Python 3.15 (#1202)
• 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
• 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

• [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

  This change is also backported to: 2.0.56

  References: #13711

• [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

  References: #13701

• [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

  References: #13709

orm extensions

• [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

  This change is also backported to: 2.0.56

  References: #13680

... (truncated)

Commits

• See full diff in compare view

Updates typer from 0.27.0 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

• 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

• ⬆ Bump pyjwt from 2.13.0 to 2.15.0. PR #1969 by @​dependabot[bot].
• ⬆ Bump urllib3 from 2.7.0 to 2.8.0. PR #1968 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 11.0 to 11.0.1. PR #1924 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 7 updates. PR #1966 by @​dependabot[bot].
• ⬆ Bump cryptography from 48.0.1 to 50.0.2. PR #1920 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1967 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 3 updates. PR #1965 by @​dependabot[bot].
• ⬆ Bump anyio from 4.12.0 to 4.14.2. PR #1959 by @​dependabot[bot].
• ✅ Fix flaky app_dir and launch tutorial tests under xdist. PR #1951 by @​YuriiMotov.
• ⬆ Bump the python-packages group across 1 directory with 8 updates. PR #1948 by @​dependabot[bot].
• ⬆ Bump annotated-doc from 0.0.4 to 0.0.5. PR #1949 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1950 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 4 updates. PR #1947 by @​dependabot[bot].

0.27.2

Refactors

• ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

• 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

• ⬆️ Bump setup-uv action to 10.0.1. PR #1940 by @​YuriiMotov.
• 👷 Migrate automatic labels to Latest Changes. PR #1931 by @​tiangolo.
• 👷 Remove legacy label check. PR #1930 by @​tiangolo.
• 🔐 Use PR Submit for pull requests. PR #1928 by @​tiangolo.
• 👷 Use GitHub CLI for Git authentication. PR #1927 by @​tiangolo.
• 👷 Use PR Push commit identity. PR #1926 by @​tiangolo.
• 🔒 Replace pre-commit PAT with PR Push. PR #1923 by @​tiangolo.
• 👷 Remove Zensical docs cache. PR #1922 by @​tiangolo.
• 🔥 Remove the old Latest Changes workflow. PR #1921 by @​tiangolo.
• ⬆ Bump the python-packages group with 6 updates. PR #1917 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 10.21.3 to 11.0. PR #1910 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 5 updates. PR #1916 by @​dependabot[bot].

0.27.1

Features

• ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

• 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

• ⬆ Bump pyjwt from 2.13.0 to 2.15.0. PR #1969 by @​dependabot[bot].
• ⬆ Bump urllib3 from 2.7.0 to 2.8.0. PR #1968 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 11.0 to 11.0.1. PR #1924 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 7 updates. PR #1966 by @​dependabot[bot].
• ⬆ Bump cryptography from 48.0.1 to 50.0.2. PR #1920 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1967 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 3 updates. PR #1965 by @​dependabot[bot].
• ⬆ Bump anyio from 4.12.0 to 4.14.2. PR #1959 by @​dependabot[bot].
• ✅ Fix flaky app_dir and launch tutorial tests under xdist. PR