build(deps): bump the minor-and-patch group in /backend with 4 updates

[dependabot]

Bumps the minor-and-patch group in /backend with 4 updates: uvicorn, langsmith, sqlglot and pytest.

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• See full diff in compare view

Updates langsmith from 0.14.0 to 0.14.1

Release notes

Sourced from langsmith's releases.

v0.14.1

What's Changed

• release(js): 0.10.5 by @​emil-lc in langchain-ai/langsmith-sdk#3575
• ci: mirror merges to the staging repos by @​thibautlehmann in langchain-ai/langsmith-sdk#3578
• ci: drop the push-based mirror workflow, staging pulls instead by @​thibautlehmann in langchain-ai/langsmith-sdk#3580
• test(py): select s3_urls so list_runs and list_threads return attachments by @​thibautlehmann in langchain-ai/langsmith-sdk#3590
• fix(py): fix missing OTel exports for tool_call_id and tool_definitions by @​emil-lc in langchain-ai/langsmith-sdk#3584
• fix(py): trace ClaudeSDKClient.receive_messages() by @​thibautlehmann in langchain-ai/langsmith-sdk#3576
• feat(sandbox): verify service URL user tokens and proxy callbacks by @​ramon-langchain in langchain-ai/langsmith-sdk#3593
• release(py): 0.14.1 by @​emil-lc in langchain-ai/langsmith-sdk#3595

Full Changelog: langchain-ai/langsmith-sdk@v0.14.0...v0.14.1

Commits

• c51e722 release(py): 0.14.1 (#3595)
• 8bf29ab feat(sandbox): verify service URL user tokens and proxy callbacks (#3593)
• 7401954 fix(py): trace ClaudeSDKClient.receive_messages() (#3576)
• b78314f fix(py): fix missing OTel exports for tool_call_id and tool_definitions (#3584)
• 6cd0d6e fix(py): select s3_urls so list_runs and list_threads return attachments (#3590)
• 9207dfb ci: drop the push-based mirror workflow, staging pulls instead (#3580)
• 1d3e54a ci: mirror merges to the staging repos (#3578)
• ad399f1 release(js): 0.10.5 (#3575)
• See full diff in compare view

Updates sqlglot from 30.19.0 to 30.20.0

Commits

• 8bd7686 feat(optimizer)!: annotate bit_and for duckdb (#8439)
• afd6b69 feat(optimizer)!: annotate bit_or for duckdb (#8438)
• d01e946 fix(optimizer): preserve ordinal ordering with duplicate aliases [CODEX] (#8436)
• d2fbb21 fix(duckdb)!: preserve TIMESTAMP_FROM_PARTS time zones (#8422) (#8434)
• 87b1402 fix(optimizer): preserve grouping when complementing comparisons (#8433)
• 4c11d07 fix(sqlite)!: avoid AUTOINCREMENT without a primary key (#8431)
• 981e492 fix(clickhouse): preserve GLOBAL JOIN after ON conditions fixes #8426
• a313c8b feat(parser): support boolean expressions in update assignments closes #8428
• 8d9f5d0 fix(parser): handle singular ROW in FETCH and OFFSET clauses closes #8429
• b85a8c8 fix(optimizer)!: exponential AST growth prevention in merge_subqueries (#8427)
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions