deps: bump the minor-and-patch group with 3 updates

[dependabot]

Bumps the minor-and-patch group with 3 updates: uvicorn, ruff and tzdata.

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Updates tzdata from 2026.3 to 2026.4

Release notes

Sourced from tzdata's releases.

2026.4: Release of upstream tzdata 2026d

Version 2026.4

Upstream version 2026d released 2026-09-11T22:21:07+00:00

Briefly:

Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. Fix security, performance and porting bugs in zic and localtime.

Changes to future timestamps

Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on -06 year-round, matching Alberta’s recent change. Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c.

Changes to past timestamps

Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.

Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)

The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now conform better to POSIX. For example, EST5EDT now always uses the abbreviation "EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight saving time, whereas it formerly had different UT offsets before standard time was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all contrary to POSIX. Also, though not required by POSIX these names now use US federal rules rather than rules of places like New York, reverting to 2024a behavior. This change affects only timestamps before 1966-10-30 at 01:00 standard time.

Other data changes

The temporary hacks used for North American timekeeping changes now work around a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug 124851. This data change does not affect TZif files or timestamps. The change does not work around the related but less serious GCC bugs 116110 and 124513. These GCC bugs are all fixed in GCC 16.2.

Changes to documentation

URLs for release tarballs in tz-link.html have been updated to reflect their new canonical URLs on data.iana.org.

Changelog

Sourced from tzdata's changelog.

Version 2026.4

Upstream version 2026d released 2026-09-11T22:21:07+00:00

Briefly:

Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. Fix security, performance and porting bugs in zic and localtime.

Changes to future timestamps

Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on -06 year-round, matching Alberta’s recent change. Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c.

Changes to past timestamps

Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.

Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)

The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now conform better to POSIX. For example, EST5EDT now always uses the abbreviation "EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight saving time, whereas it formerly had different UT offsets before standard time was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all contrary to POSIX. Also, though not required by POSIX these names now use US federal rules rather than rules of places like New York, reverting to 2024a behavior. This change affects only timestamps before 1966-10-30 at 01:00 standard time.

Other data changes

The temporary hacks used for North American timekeeping changes now work around a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug 124851. This data change does not affect TZif files or timestamps. The change does not work around the related but less serious GCC bugs 116110 and 124513. These GCC bugs are all fixed in GCC 16.2.

Changes to documentation

URLs for release tarballs in tz-link.html have been updated to reflect their new canonical URLs on data.iana.org.

---

Commits

• b4d2086 Update tzdata to version 2026d (#153)
• 91a9022 Switch keyserver used for tarball GPG verification (#152)
• c97164f Bump the actions group with 3 updates (#150)
• 6c7fa78 Stop testing 3.8 and 3.9, test 3.15 and PyPy3 (#148)
• d165386 Bump the Actions group with 2 updates (#149)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: GeiserX/CashPilot/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e095654d-5f6d-470d-ac13-5b800e91eaef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.81%. Comparing base (e73d63d) to head (b46ae53).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #374      +/-   ##
==========================================
- Coverage   95.83%   95.81%   -0.02%     
==========================================
  Files          52       52              
  Lines        7439     7439              
==========================================
- Hits         7129     7128       -1     
- Misses        310      311       +1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.