chore(deps): update all non-major documentation dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
certifi	==2026.6.17 → ==2026.7.22
starlette (changelog)	==1.3.1 → ==1.6.0
uvicorn (changelog)	==0.49.0 → ==0.52.3

---

Release Notes

certifi/python-certifi (certifi)

v2026.7.22

Compare Source

Kludex/starlette (starlette)

v1.6.0: Version 1.6.0

Compare Source

What's Changed

• Add max_body_size to Starlette and route classes by @​Kludex in #​3431
• Expose http.response.debug info via response extensions by @​y2kbugger in #​3130

New Contributors

• @​y2kbugger made their first contribution in #​3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

v1.5.1: Version 1.5.1

Compare Source

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @​nikolauspschuetz in encode#3389
• Limit FileResponse to 100 ranges by @​Kludex in encode#3430

Full Changelog: Kludex/starlette@1.5.0...1.5.1

v1.5.0: Version 1.5.0

Compare Source

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @​Kludex in encode#3418
• Flush GZip output for each streamed chunk by @​Kludex in encode#3419
• Skip compression of partial responses in GZipMiddleware by @​Kludex in encode#3420
• Expand default excluded content types in GZipMiddleware by @​Kludex in encode#3421

Full Changelog: Kludex/starlette@1.4.1...1.5.0

v1.4.1: Version 1.4.1

Compare Source

What's Changed

• Default thread_minimum_size in GZipResponder by @​Kludex in #​3415

Full Changelog: Kludex/starlette@1.4.0...1.4.1

v1.4.0: Version 1.4.0

Compare Source

What's Changed

• Lazily allocate GZipMiddleware compression resources by @​Kludex in #​3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @​Kludex in #​3411
• Offload large GZip compression by @​Kludex in #​3410

New Contributors

• @​benberryallwood made their first contribution in #​3334
• @​lkk7 made their first contribution in #​3359

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Kludex/uvicorn (uvicorn)

v0.52.3: Version 0.52.3

Compare Source

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#​3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

v0.52.2: Version 0.52.2

Compare Source

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#​3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

v0.52.1: Version 0.52.1

Compare Source

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#​3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#​3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#​3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#​3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

v0.52.0: Version 0.52.0

Compare Source

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#​2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#​3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

v0.51.0: Version 0.51.0

Compare Source

What's Changed

• Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @​Kludex in #​3025
• Remove colorama from the standard extra by @​Kludex in #​3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

v0.50.2: Version 0.50.2

Compare Source

What's Changed

• Require websockets>=13.0 for the default sansio implementation by @​Kludex in #​3021

Full Changelog: Kludex/uvicorn@0.50.1...0.50.2

v0.50.1: Version 0.50.1

Compare Source

What's Changed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation by @​Aayush7352 in #​3019

New Contributors

• @​Aayush7352 made their first contribution in #​3019

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

v0.50.0: Version 0.50.0

Compare Source

What's Changed

• Memoize trusted host checks to avoid re-parsing the client IP per request by @​Kludex in #​2970
• Cache the asgi scope sub-dict per connection by @​Kludex in #​2976
• Build a fresh asgi scope dict per request by @​Kludex in #​2977
• Replace click.style with an internal ANSI style helper by @​Kludex in #​2981
• Avoid copying single-frame WebSocket payloads in websockets-sansio by @​Kludex in #​2983
• Deprecate the legacy websockets implementation and default auto to websockets-sansio by @​Kludex in #​2985
• Exit with a dedicated code on startup failure and stop the supervisor when a worker can't boot by @​Kludex in #​3001
• Skip the eager app import in the parent when spawning workers by @​Kludex in #​3012

Full Changelog: Kludex/uvicorn@0.49.0...0.50.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.01% coverage variation

Metric	Results
Coverage variation	✅ +0.01% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (40833fb)	Report Missing	Report Missing	Report Missing
Head commit (91a4a80)	15908 (+0)	8550 (+1)	53.75% (+0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1185)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.