chore(deps): update all non-major documentation dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
certifi	==2025.10.5 → ==2025.11.12
docutils (changelog)	==0.21.2 → ==0.22.4
requests (changelog)	==2.33.0 → ==2.34.2
sphinx-rtd-theme	==3.0.2 → ==3.1.0
sphinxcontrib-bibtex	==2.6.5 → ==2.7.0
starlette (changelog)	==0.50.0 → ==0.52.1
uvicorn (changelog)	==0.38.0 → ==0.48.0
zipp	==3.23.0 → ==3.23.1

---

Release Notes

certifi/python-certifi (certifi)

v2025.11.12

Compare Source

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

v2.33.1

Compare Source

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
  files in the tmp directory. (#​7305)
• Fixed Content-Type header parsing for malformed values. (#​7309)
• Improved error consistency for malformed header values. (#​7308)

readthedocs/sphinx_rtd_theme (sphinx-rtd-theme)

v3.1.0

Compare Source

mcmtroffaes/sphinxcontrib-bibtex (sphinxcontrib-bibtex)

v2.7.0

Compare Source

• BACKWARD INCOMPATIBLE
  A new warning category, duplicate_local_citation, has been introduced.
  It is triggered when a duplicate citation appears within the same document.
  The existing duplicate_citation warning continues to report duplicates but now only across different documents.

  In many cases, users maintain a separate bibliography for each document (often using a docname in docnames filter).
  In such setups, duplicate citations across documents are usually acceptable, while duplicates within a single document are not.
  This distinction allows users to suppress duplicate_citation warnings while still receiving duplicate_local_citation warnings.

• When there are duplicate citations,
  resolve locally first
  (reported by drbenvincent, see issue #​385).

• The usage section of the documentation now starts with in-depth general considerations
  to guide users towards best practice for the most common use cases.

• Citation reference wrapper nodes now have a bibtex-citation CSS class,
  to enable Sphinx themes to style citation elements separately from other content
  (contributed by mmcky, see pull request #​383).

• Increase required pybtex-docutils version to 1.0.2
  (reported by ego-thales).

• Fix test suite for docutils 0.22
  (fixed by mitya57, see pull request #​377).

• Dropped Python 3.9 support (EOL), added Python 3.14 support.

• Fixed various deprecation warnings in Sphinx and docutils.

• Improved header parsing.

• Minimum required Sphinx version increased to 7.4.

• Minimum required Docutils version increased to 0.20.

Kludex/starlette (starlette)

v0.52.1: Version 0.52.1

Compare Source

What's Changed

• Only use typing_extensions in older Python versions by @​Kludex in #​3109

---

Full Changelog: Kludex/starlette@0.52.0...0.52.1

v0.52.0: Version 0.52.0

Compare Source

In this release, State can be accessed using dictionary-style syntax for improved type safety (#​3036).

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from typing import TypedDict

import httpx

from starlette.applications import Starlette
from starlette.requests import Request

class State(TypedDict):
    http_client: httpx.AsyncClient

@​asynccontextmanager
async def lifespan(app: Starlette) -> AsyncIterator[State]:
    async with httpx.AsyncClient() as client:
        yield {"http_client": client}

async def homepage(request: Request[State]):
    client = request.state["http_client"]
    # If you run the below line with mypy or pyright, it will reveal the correct type.
    reveal_type(client)  # Revealed type is 'httpx.AsyncClient'

See Accessing State for more details.

---

Full Changelog: Kludex/starlette@0.51.0...0.52.0

v0.51.0: Version 0.51.0

Compare Source

Added

• Add allow_private_network in CORSMiddleware #​3065.

Changed

• Increase warning stacklevel on DeprecationWarning for wsgi module #​3082.

---

New Contributors

• @​santibreo made their first contribution in #​3082
• @​iddqd888 made their first contribution in #​3083

Full Changelog: Kludex/starlette@0.50.0...0.51.0

Kludex/uvicorn (uvicorn)

v0.48.0: Version 0.48.0

Compare Source

What's Changed

• Default ssl_ciphers to None and use OpenSSL defaults by @​Kludex in #​2940
• Ignore duplicate forwarding headers in ProxyHeadersMiddleware by @​Kludex in #​2944

Full Changelog: Kludex/uvicorn@0.47.0...0.48.0

v0.47.0: Version 0.47.0

Compare Source

What's Changed

• Eagerly import the ASGI app in the parent process by @​Kludex in #​2919
• Add ssl_context_factory for custom SSLContext configuration by @​Kludex in #​2920
• Treat fd=0 as a valid file descriptor with reload/workers by @​eltoder in #​2927

Full Changelog: Kludex/uvicorn@0.46.0...0.47.0

v0.46.0: Version 0.46.0

Compare Source

What's Changed

• Support ws_max_size in wsproto implementation by @​Kludex in #​2915
• Support ws_ping_interval and ws_ping_timeout in wsproto implementation by @​Kludex in #​2916
• Use bytearray for incoming WebSocket message buffer in websockets-sansio by @​Kludex in #​2917

Full Changelog: Kludex/uvicorn@0.45.0...0.46.0

v0.45.0: Version 0.45.0

Compare Source

What's Changed

• Preserve forwarded client ports in proxy headers middleware by @​Kludex in #​2903
• Accept os.PathLike for log_config by @​Kludex in #​2905
• Accept log_level strings case-insensitively by @​Kludex in #​2907
• Raise helpful ImportError when PyYAML is missing for YAML log config by @​Kludex in #​2906
• Revert empty context for ASGI runs by @​Kludex in #​2911
• Add --reset-contextvars flag to isolate ASGI request context by @​Kludex in #​2912
• Revert "Emit http.disconnect on server shutdown for streaming responses" (#​2829) by @​Kludex in #​2913

New Contributors

• @​Krishnachaitanyakc made their first contribution in #​2870

Full Changelog: Kludex/uvicorn@0.44.0...0.45.0

v0.44.0: Version 0.44.0

Compare Source

What's Changed

• Implement websocket keepalive pings for websockets-sansio by @​Kludex in #​2888

Full Changelog: Kludex/uvicorn@0.43.0...0.44.0

v0.43.0: Version 0.43.0

Compare Source

Changed

• Emit http.disconnect ASGI receive() event on server shutting down for streaming responses (#​2829)
• Use native context parameter for create_task on Python 3.11+ (#​2859)
• Drop cast in ASGI types (#​2875)

---

Full Changelog: Kludex/uvicorn@0.42.0...0.43.0

v0.42.0: Version 0.42.0

Compare Source

Changed

• Use bytearray for request body accumulation to avoid O(n^2) allocation on fragmented bodies (#​2845)

Fixed

• Escape brackets and backslash in httptools HEADER_RE regex (#​2824)
• Fix multiple issues in websockets sans-io implementation (#​2825)

---

New Contributors

• @​bysiber made their first contribution in #​2825

---

Full Changelog: Kludex/uvicorn@0.41.0...0.42.0

v0.41.0: Version 0.41.0

Compare Source

Added

• Add --limit-max-requests-jitter to stagger worker restarts (#​2707)
• Add socket path to scope["server"] (#​2561)

Changed

• Rename LifespanOn.error_occured to error_occurred (#​2776)

Fixed

• Ignore permission denied errors in watchfiles reloader (#​2817)
• Ensure lifespan shutdown runs when should_exit is set during startup (#​2812)
• Reduce the log level of 'request limit exceeded' messages (#​2788)

---

New Contributors

• @​t-kawasumi made their first contribution in #​2776
• @​fardyn made their first contribution in #​2800
• @​ewie made their first contribution in #​2807
• @​shevron made their first contribution in #​2788
• @​jonashaag made their first contribution in #​2707

---

Full Changelog: Kludex/uvicorn@0.40.0...0.41.0

v0.40.0: Version 0.40.0

Compare Source

What's Changed

• Drop Python 3.9 by @​Kludex in #​2772

Full Changelog: Kludex/uvicorn@0.39.0...0.40.0

v0.39.0: Version 0.39.0

Compare Source

What's Changed

• explicitly start ASGI run with empty context by @​pmeier in #​2742
• fix(websockets): Send close frame on ASGI return by @​Kludex in #​2769

New Contributors

• @​pmeier made their first contribution in #​2742

Full Changelog: Kludex/uvicorn@0.38.0...0.39.0

jaraco/zipp (zipp)

v3.23.1

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	✅ 0 (≤ 20 complexity)

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (fc639cc)	10428	4917	47.15%
Head commit (ad6712e)	10428 (+0)	4917 (+0)	47.15% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#893)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.