chore(deps): bump uvicorn from 0.51.0 to 0.52.1

[dependabot]

Bumps uvicorn from 0.51.0 to 0.52.1.

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Commits

• ee8e45c Version 0.52.1 (#3056)
• b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
• 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
• 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
• 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
• e148451 Handle connection loss during WebSocket write backpressure (#3050)
• e16a69b Add missing write flow control to websockets-sansio (#3048)
• ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
• 8f1b884 Version 0.52.0 (#3044)
• f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​uvicorn@​0.51.0 ⏵ 0.52.1	+1

View full report

[github-actions]

Dependency audit failed

audit-ci detected high/critical vulnerabilities.

Failing CVEs / advisories

• CVE-2026-14257
• GHSA-22jq-vg5j-6vgg
• GHSA-2m8v-j782-fhvr
• GHSA-4cwx-7wf7-3272
• GHSA-4xrf-jv44-h6hh
• GHSA-6g55-p6wh-862q
• GHSA-8xcm-r25x-g524
• GHSA-fxqj-rqcc-2cmp
• GHSA-jr45-8vmc-qm54
• GHSA-m8rv-5g2x-5cg5
• GHSA-mwp4-54f8-5fhr
• GHSA-rgw5-rvv9-x895
• GHSA-v3r7-h72x-cjcm

[Sam-Aitech]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud