[dependabot]

Bumps the pip-minor-patch group with 2 updates: fastapi and sqlalchemy.

Updates fastapi from 0.143.0 to 0.156.1

Release notes

Sourced from fastapi's releases.

0.156.1

Fixes

• 🐛 Preserve Pydantic field metadata when request options are omitted. PR #16549 by @​tiangolo.

0.156.0

Fixes

• 🐛 Preserve Pydantic Field() attributes in request parameters. PR #16547 by @​tiangolo.

0.155.0

The deprecated **extra keyword arguments have been removed from Path, Query, Header, Cookie, Body, Form, and File. Unknown keyword arguments now raise TypeError. For additional JSON Schema properties, replace, for example, Query(custom="value") with Query(json_schema_extra={"custom": "value"}).

Breaking Changes

• 🔥 Remove deprecated **extra from request parameters. PR #16545 by @​tiangolo.

0.154.0

Features

• ✨ Add Pydantic validation options to request parameters. PR #16542 by @​tiangolo.

0.153.0

Unions of form models now apply the same browser form handling as individual models. Empty scalar fields use defaults or produce missing-field errors, empty list items are preserved, omitted boolean fields become False, and unselected files are treated as missing. JSON request bodies are unchanged.

Fixes

• 🐛 Apply browser form handling to unions of Pydantic models. PR #16540 by @​tiangolo.

0.152.0

Validation errors for header parameter models now report the HTTP header name, such as int-val, instead of the Python field name, int_val. Explicit aliases, Header(convert_underscores=False), and Pydantic models with loc_by_alias=False keep their existing behavior.

Fixes

• 🐛 Fix header model validation errors to report HTTP header names. PR #16538 by @​tiangolo.

0.151.0

JSON request bodies now distinguish an explicit null from an omitted value. For individual Body parameters, null is validated as None: nullable types accept it, and non-nullable types reject it even when a default is defined. Defaults and default factories apply only when the value is omitted. This applies both to parameters inside JSON objects and to parameters representing the entire body. Clients that used null to request a default should omit the value instead.

When a JSON object is expected because of Body(embed=True) or multiple body parameters, sending null as the entire body now returns a validation error.

Breaking Changes

• 🐛 Distinguish JSON null from omitted body values. PR #16536 by @​tiangolo.

0.150.0

When no file is selected, browsers submit a file part with an empty filename and empty content. FastAPI now treats this as missing: required file fields return a validation error, and fields with defaults or default factories use them. Unselected inputs are ignored in lists of files. Named zero-byte files are still accepted.

Breaking Changes

... (truncated)

Commits

• f6ce798 🔖 Release version 0.156.1 (#16550)
• 2d144cb 📝 Update release notes
• 0a8c3fa 🐛 Preserve Pydantic field metadata when request options are omitted (#16549)
• 51f1a6c 🔖 Release version 0.156.0 (#16548)
• 6f054b4 📝 Update release notes
• f8cba10 🐛 Preserve Pydantic Field() attributes in request parameters (#16547)
• d76f69b 🔖 Release version 0.155.0 (#16546)
• 89e5e23 📝 Update release notes
• 34b1783 🔥 Remove deprecated **extra from request parameters (#16545)
• 6f28852 🔖 Release version 0.154.0 (#16544)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.1.4 to 2.1.5

Release notes

Sourced from sqlalchemy's releases.

2.1.5

Released: October 16, 2026

orm

• [orm] [feature] Added the _orm.Unmapped annotation and the _orm.unmapped_column() construct, providing a declarative-compatible approach to having "excluded" columns in a Declarative model, that is, columns that are part of the _schema.Table but are not mapped, replacing the use of _orm.Mapper.exclude_properties for this purpose when using a Declarative mapping.

  References: #13650

• [orm] [bug] [regression] Fixed regression caused by #11917 in version 2.0.36 where an ORM enabled _sql.update() using WHERE criteria which matched more than one object present in the _orm.Session would expire server-side onupdate columns, as well as columns that were SET to a SQL expression, on only one of the matched objects, leaving the remaining objects with stale values for those attributes. The columns are now expired for all matched objects.

  This change is also backported to: 2.0.55

  References: #13675

• [orm] [deprecated] Using the _orm.Mapper.exclude_properties or _orm.Mapper.include_properties parameters on a Declarative mapping to exclude attributes that are declared on the class, such as with _orm.mapped_column(), is deprecated and now emits a deprecation warning. This use was never supported, and depending on the arguments passed to _orm.mapped_column(), the attribute could remain mapped regardless; in particular, as of 2.1 this includes ORM mapped dataclasses where _orm.mapped_column.default is present. The new _orm.unmapped_column() construct should be used instead. Excluding columns that are present only in the _schema.Table, such as those from __table__, __table_args__ or table reflection, is not affected.

  References: #13650

schema

• [schema] [bug] Fixed issue where dialect-specific keyword arguments established on a ForeignKeyConstraint, ForeignKey or CheckConstraint, such as postgresql_not_valid, were not carried along to the copy of the constraint produced by

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions