chore(deps): bump the all-dependencies group across 1 directory with 3 updates

[dependabot]

Updates the requirements on fastapi, asyncpg and pydantic to permit the latest version.
Updates fastapi to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

• 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

Commits

• f5c6e9b 🔖 Release version 0.143.0 (#16477)
• 182c8b8 📝 Update release notes
• af889e4 💥 Require opt-in for automatic OpenTelemetry exporter setup (#16476)
• 9269f17 🔖 Release version 0.142.4 (#16471)
• 78ede01 📝 Update release notes
• 4e31a07 🐛 Isolate FastAPI telemetry for excluded requests (#16470)
• cb8dabc 🔖 Release version 0.142.3 (#16469)
• 787dc56 📝 Update release notes
• 6eae2f3 🐛 Cache OpenTelemetry tracers to preserve warning deduplication (#16468)
• 94918c1 📝 Update release notes
• Additional commits viewable in compare view

Updates asyncpg to 0.32.0

Release notes

Sourced from asyncpg's releases.

v0.32.0

Improvements

• Support Python 3.15 (#1367, #1378) (by @​elprans in 1b118464 and 58c0c595)

• Support PostgreSQL 19 (#1379) (by @​elprans in 8d2a5aed)

• Make pool min_size a maintained connection floor and add init_size to control the number of connections opened at startup (#1323). Idle connections at or below min_size are retained, and closed connections are replaced in the background. init_size defaults to min_size. To preserve the previous behavior, where the pool could drain to zero, replace min_size=N with init_size=N, min_size=0. (by @​shatilov-diman in 67a1cbc5)

• Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#1359) (by @​twelfthlabor in 00319a9b)

• Use the statement cache for copy_records_to_table() introspection (#1360) (by @​matemax in dd058652)

Fixes

• Clean up connections rejected by target_session_attrs immediately so an unresponsive rejected host cannot delay the selected connection, and cleanup tasks cannot outlive the event loop. Rejected connections are aborted without waiting for a graceful disconnect; servers may log "unexpected EOF on client connection" if the Terminate message is not delivered before the transport closes.

• Fix a connection pool deadlock when releasing a connection after a protocol abort (#1324) (by @​pchaseh in 4a83cc2f)

• Honor Connection.close(timeout=...) while waiting for a pending cancellation (#1361) (by @​gyanu2507 in c06bcb4d)

• Prevent stuck cancellation from blocking connection teardown or pool release by bounding cancellation with the command or release timeout (#1370) (by @​elprans in 4cf02203)

• Preserve the server error when the connection closes mid-operation (#1369) (by @​RitiGrover in 6c8f1a7a)

• Fix COPY cleanup when a records generator raises, preserving the original exception and avoiding protocol desynchronization and stalled rollback (#1358) (by @​CodingCossack in fdc6bc8f)

... (truncated)

Commits

• d701e11 asyncpg v0.32.0
• b04f8f2 Bump to macOS 26 in runners, set deployment target to 11 (#1384)
• 3934d77 tests: Capture expected pool retry warnings during role changes (#1383)
• 2c37501 tests: Avoid DeprecationWarning when settings up uvloop (#1382)
• b7eea79 Test pool min_size backoff on target attribute mismatch (#1381)
• 46dda91 Terminate rejected target_session_attrs candidates before returning (#1380)
• 8d2a5ae Support PostgreSQL 19 (#1379)
• 58c0c59 Bump uvloop (#1378)
• 67a1cbc Make pool min_size a maintained connection floor (#1323)
• 25aaaf5 fix: allow cursors in external transactions (#1350)
• Additional commits viewable in compare view

Updates pydantic to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

• fcdefa7 Correct v2.14.0 release date (#13952)
• c821eac Revert "Respect config in TypeAdapter.json_schemas() (#13890)" (#13951)
• a656b75 Prepare release v2.14.0 (#13948)
• b4028f9 Avoid validating URL prefix multiple times in multi host URLs (#13945)
• 69ed168 Reject large exponents in Fraction validation (#13944)
• 895c0c2 Fix datetime parsing in custom validator examples (#13931)
• d2cbaaa Bump virtualenv from 20.36.1 to 21.7.13 (#13943)
• 3fbc25a Bump pydantic-core dependencies (#13942)
• 027b5c7 Rebuild incomplete types during serialization inference (#13922)
• 2706d1f Handle exceptions during Decimal validation (#13940)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e8433af3-0972-467b-8cab-5647e3058018

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

This is not a request to defer this PR. The actual limit is the open-PR cap (AUTOBOT_OPEN_PR_CAP, default 40), enforced at pre-push against NEW branches only -- pushing more commits to this PR's own branch is never blocked by it.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• chore(deps): bump the all-dependencies group across 1 directory with 10 updates #18437 chore(deps): bump the all-dependencies group across 1 directory with 10 updates
• chore(deps): bump the all-dependencies group across 1 directory with 6 updates #18435 chore(deps): bump the all-dependencies group across 1 directory with 6 updates
• chore(deps): bump the all-dependencies group across 1 directory with 3 updates #18434 chore(deps): bump the all-dependencies group across 1 directory with 3 updates
• chore(deps): bump the all-dependencies group across 1 directory with 3 updates #18433 chore(deps): bump the all-dependencies group across 1 directory with 3 updates
• fix(egress): guard the integrations under SSOT policies, tenant-configured URLs public-only, websockets refuse redirects (#17576) #18429 fix(egress): guard the integrations under SSOT policies, tenant-configured URLs public-only, websockets refuse redirects (security(egress): rule 8's only enforcement is a five-file literal, and four connectors beside it call tracked_request unguarded #17576)
• feat(backup): ciphertext-only secrets-store backup through the SLM backup service, and one fail-closed verify_backup (#18281) #18425 feat(backup): ciphertext-only secrets-store backup through the SLM backup service, and one fail-closed verify_backup (feat(backup): the secrets store has no backup mechanism, so destructive secrets proposals cannot verify a backup_reference #18281)
• feat(slm): node-major post-sync plan with a durable per-action record, sudo -n restarts and a node sync endpoint (#17455) #18423 feat(slm): node-major post-sync plan with a durable per-action record, sudo -n restarts and a node sync endpoint (feat(sync): post-sync actions need a durable record and a node-level plan in the orchestrator #17455)
• refactor(rag): de-fork graph retrieval — one neighbour contract, one graph blend, shared config (#18139, #18141) #18421 refactor(rag): de-fork graph retrieval — one neighbour contract, one graph blend, shared config (bug(rag): PPR is wired with the mesh adapter whose get_neighbors signature differs — mesh retrieval raises TypeError on first use #18139, tech-debt(rag): graph-blended retrieval paths fork the score blend, config, reranker weights and stale filter #18141)
• refactor(captcha): one CaptchaType in autobot_shared (#18131) #18418 refactor(captcha): one CaptchaType in autobot_shared (tech-debt(captcha): two captcha_solver modules whose CaptchaType enums disagree — a kind one can classify is UNKNOWN to the other #18131)
• fix(memory): host context calls get_related_entities, the canonical graph traversal (#18140) #18416 fix(memory): host context calls get_related_entities, the canonical graph traversal (bug(memory): security memory integration calls traverse_relations, which the memory graph does not have #18140)
• feat(guard): a kit component cannot be forked in either app, and kit stories render in both Storybooks (#14776) #18409 feat(guard): a kit component cannot be forked in either app, and kit stories render in both Storybooks (Retire the local Base* component forks in autobot-frontend into the shared kit #14776)
• feat(agents): read-only agent-ledger APIs for Company OS and the SLM (#18391) #18408 feat(agents): read-only agent-ledger APIs for Company OS and the SLM (feat(agents): a GUI for the agent ledger — who is working on what, per company and install-wide in the SLM #18391)
• fix(kb): add_document chunks, partial-success ingest, stable upload rejection codes (#17830) #18405 fix(kb): add_document chunks, partial-success ingest, stable upload rejection codes (bug(kb): add_document never chunks — a whole transcript or PDF becomes one embedding, against its own docstring #17830)
• feat(approvals): one approval record, shared RiskTier, pending inbox query (#13421 S1) #18404 feat(approvals): one approval record, shared RiskTier, pending inbox query (ui(approvals): five approval surfaces with no shared record or component — build one approval inbox #13421 S1)
• feat(llm): needs_reauth registry skip + typed error, header headroom harvest, pre-dispatch headroom routing (#15022, #15026, #15028) #18403 feat(llm): needs_reauth registry skip + typed error, header headroom harvest, pre-dispatch headroom routing (llm: degradation store cannot distinguish a dead credential from a transient failure — dead tokens retry every TTL forever #15022, llm: harvest provider rate-limit response headers into a cross-worker quota headroom store (the missing quota monitor) #15026, llm: route on observed headroom before dispatch instead of on a 429 after it; reconcile guessed RPM buckets with observed limits #15028)
• fix(slm-auth): SSO callbacks redirect with a one-time code, not the session JWT (#18394) #18399 fix(slm-auth): SSO callbacks redirect with a one-time code, not the session JWT (security(sso): SSO callbacks redirect with the session JWT in the query string — now live after #18322 #18394)
• refactor(api): the main app's raw fetch tail goes through fetchWithAuth, and ApiClient gains an opt-in circuit breaker for polled dashboards (#12363) #18398 refactor(api): the main app's raw fetch tail goes through fetchWithAuth, and ApiClient gains an opt-in circuit breaker for polled dashboards (canonical(frontend): no single backend contract — 8 independent HTTP clients (2 generic) + 22 raw fetch sites, and generated api.ts is bypassed (4 importers vs 74 hand-typed responses) and stale (2424 vs 2152 paths) #12363)
• fix(guards): mypy resolves autobot_shared so enum aliases stay types; the embedding-literal guard covers namespaced ids and the infra builders (#18345) #18393 fix(guards): mypy resolves autobot_shared so enum aliases stay types; the embedding-literal guard covers namespaced ids and the infra builders (types: an enum alias of the canonical Severity used as an annotation is 'not valid as a type' in the backend mypy run (6 instances) #18345)
• test(tools): differential test of the tool-approval planes (#13416) #18387 test(tools): differential test of the tool-approval planes (test(security): the two tool-approval planes are never compared — add a differential assertion #13416)
• refactor(infra): classify 43 more infra scripts by runtime, repair 3 validators (#18289) #18380 refactor(infra): classify 43 more infra scripts by runtime, repair 3 validators (infra: 98 more infrastructure modules import backend-only packages — classify each as shared, backend tool or dead (#18288 follow-up) #18289)
• feat(shell): Refined UI step 2: top nav and icon cluster, Minimal/Full mode, Appearance settings, one brand mark (#18240) #18373 feat(shell): Refined UI step 2: top nav and icon cluster, Minimal/Full mode, Appearance settings, one brand mark (Refined UI step 2 · shell: top nav, UI mode, profile appearance #18240)
• security(api): RUM split into admin, user and bounded-open routes, and Prometheus metrics behind an SLM-issued scrape token (#16375) #18372 security(api): RUM split into admin, user and bounded-open routes, and Prometheus metrics behind an SLM-issued scrape token (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• refactor(config): the #18094 de-fork remainder — one key reader, one feature flag, one language detector, and image-gen keys vault-first through an origin-bound resolver (#18094) #18371 refactor(config): the tech-debt: forked env defaults, shadowed constants and same-name functions — the remainder after #17419/#16177/#18093 #18094 de-fork remainder — one key reader, one feature flag, one language detector, and image-gen keys vault-first through an origin-bound resolver (tech-debt: forked env defaults, shadowed constants and same-name functions — the remainder after #17419/#16177/#18093 #18094)
• fix(codebase-analytics): honest scan outcomes, duplication detectors wired, and forks shown from the one CI detector (#18013, #18067, #17982) #18362 fix(codebase-analytics): honest scan outcomes, duplication detectors wired, and forks shown from the one CI detector (bug(codebase-analytics): /duplicates returns a fabricated "timed out after 120s" in 0.2s — the single-flight lock is never released #18013, Codebase analytics reports 18,200 problems and zero duplication, while the fork detector finds 365 clusters in the same tree #18067, bug(codebase-analytics): duplicate detection reports 'nothing scanned' as a completed scan — the one tool the dedup programme needs returns nothing for AutoBot's own codebase #17982)
• refactor(audit): audit_logs is the one system of record, Redis its projection — three stores retired, one write path, one retention table (#17225) #18343 refactor(audit): audit_logs is the one system of record, Redis its projection — three stores retired, one write path, one retention table (tech-debt(audit): #6475 closed on three parallel audit systems — there are now six #17225)
• security(auth): DB role permissions work, one strict-union permission gate for both services, MFA-pending tokens refused, SSO mints from the real user (#18259, #18321, #18322) #18338 security(auth): DB role permissions work, one strict-union permission gate for both services, MFA-pending tokens refused, SSO mints from the real user (security(rbac): UserService.get_user_permissions reads role.Permission, which does not exist — the DB-backed permission path raises and the middleware denies #18259, security(slm): get_current_user accepts MFA-pending temp tokens as full sessions (#17049 fixed only the backend) #18321, fix(slm-sso): SSO login passes a stand-in user without is_platform_admin to create_token_response, which raises #18322)
• chore(deps): bump the all-dependencies group across 1 directory with 15 updates #18273 chore(deps): bump the all-dependencies group across 1 directory with 15 updates
• fix(sandbox): execution and pooled containers run fully hardened, and no caller can widen their reach (#17267) #18232 fix(sandbox): execution and pooled containers run fully hardened, and no caller can widen their reach (refactor(sandbox): container hardening is copy-pasted across three Docker clients, with a docstring as the only thing preventing drift #17267)
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 in the all-dependencies group #18175 chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 in the all-dependencies group

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.