From 9146f3e593056f0e461d88bac30fc0016cf4291c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 28 Mar 2026 19:36:12 +0000
Subject: [PATCH] build(deps): bump the web-api group with 4 updates

Bumps the web-api group with 4 updates: [pydantic](https://github.com/pydantic/pydantic), [fastapi](https://github.com/fastapi/fastapi), [uvicorn](https://github.com/Kludex/uvicorn) and [starlette](https://github.com/Kludex/starlette).


Updates `pydantic` from 2.12.4 to 2.12.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/compare/v2.12.4...v2.12.5)

Updates `fastapi` from 0.124.2 to 0.135.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.124.2...0.135.2)

Updates `uvicorn` from 0.37.0 to 0.42.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.37.0...0.42.0)

Updates `starlette` from 0.50.0 to 1.0.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.50.0...1.0.0)

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.12.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-api
- dependency-name: fastapi
  dependency-version: 0.135.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-api
- dependency-name: uvicorn
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-api
- dependency-name: starlette
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: web-api
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 constraints/security.txt       | 2 +-
 sbom/combined-requirements.txt | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/constraints/security.txt b/constraints/security.txt
index 6b38c973..e1b4b4fc 100644
--- a/constraints/security.txt
+++ b/constraints/security.txt
@@ -50,7 +50,7 @@ SQLAlchemy==2.0.44
 
 # pydantic: Data validation, critical for API input validation
 # Security fixes for ReDoS and validation bypass
-pydantic==2.12.4
+pydantic==2.12.5
 pydantic-settings==2.12.0
 
 # pandera: DataFrame validation, data quality and security
diff --git a/sbom/combined-requirements.txt b/sbom/combined-requirements.txt
index b72a6730..7d16dcbf 100644
--- a/sbom/combined-requirements.txt
+++ b/sbom/combined-requirements.txt
@@ -32,7 +32,7 @@ cryptography==46.0.3
 deap==1.4.3
 exchange-calendars==4.11.1
 extra-streamlit-components==0.1.81
-fastapi==0.124.2
+fastapi==0.135.2
 filelock==3.20.1
 frozenlist==1.8.0
 fsspec==2025.12.0
@@ -101,7 +101,7 @@ psycopg-binary==3.2.11
 pyarrow==21.0.0
 pycares==4.11.0
 pycparser==2.23
-pydantic==2.12.4
+pydantic==2.12.5
 pydantic-core==2.41.5
 pydantic-settings==2.12.0
 pydeck==0.9.1
@@ -122,7 +122,7 @@ six==1.17.0
 smmap==5.0.2
 sniffio==1.3.1
 sqlalchemy==2.0.44
-starlette==0.50.0
+starlette==1.0.0
 strawberry-graphql==0.287.2
 streamlit==1.50.0
 streamlit-authenticator==0.4.2
@@ -141,7 +141,7 @@ typing-inspect==0.9.0
 typing-inspection==0.4.2
 tzdata==2025.2
 urllib3==2.6.0
-uvicorn==0.37.0
+uvicorn==0.42.0
 watchdog==6.0.0
 websockets==15.0.1
 yarl==1.22.0