chore(deps): update python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
grpcio	1.83.1 → 1.84.0
grpcio-health-checking	1.83.1 → 1.84.0
grpcio-tools	1.83.1 → 1.84.0
pyjwt	2.13.0 → 2.14.0
ruff (source, changelog)	0.16.6 → 0.16.7
uvicorn (changelog)	0.52.4 → 0.53.0

---

Release Notes

grpc/grpc (grpcio)

v1.84.0

Compare Source

This is release 1.84.0 (gimbal) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [promise_based_filter] enable v2_non_owning_waker_implementation experiment. (#​43253)
• [xDS] allow server listener address to match wildcard port. (#​43247)
• [WRR] remove env var guard for custom backend metrics. (#​43198)
• [subchannel] enable connection scaling service config fields. (#​43116)
• [subchannel] add metrics as per A94. (#​43140)
• Fix incorrect hostname suffix matching in no_proxy handling (prevents proxy bypass). (#​41915)

C#

• [C# Grpc.Tools] Add native macOS ARM64 support via universal binaries. (#​41222)

Python

• [Python] Fix -Werror=unused-result error triggered by Cythonized code. (#​43313)
• [Python] Release Python 3.15 wheels publicly. (#​43259)
• [Python][AsyncIO] Fixed reference cycles. (#​43121)
• [Python] fix: remove ghost key in grpc.aio.Metadata.delitem when last value is deleted. (#​42974)
• [Python] Fix the StatusCode Enums to be int. (#​43167)
• [Python] Fixed the parenthesis placement. (#​43111)
• [Python] Removed UsageError exception from registered method. (#​43086)
• [Python] Added registered methods support in AsyncIO stack . (#​41796)
• [Python] AIO Part 4 - Typehints fixes and add Pyright for aio/_channel.py. (#​42736)
• [Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#​43000)
• [Python] Observability plugin fixes. (#​42785)
• [Python] Pyright strict mode. (#​42845)

Ruby

• [Ruby] Fix: Addressed Array of strings passed as metadata. (#​42827)

jpadilla/pyjwt (pyjwt)

v2.14.0

Compare Source

astral-sh/ruff (ruff)

v0.16.7

Compare Source

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#​26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#​28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#​28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#​27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#​26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#​28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#​28444)
• Recognize slice and frozendict generics (#​28477)
• Stop defining __cached__ for Python 3.15 (#​28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#​28475)

Performance

• Reuse parser name lookups when interning (#​28399)
• Speed up inherited configuration resolution (#​28299)

Documentation

• Fix line-length path in --config example (#​28392)
• Remove the "Who’s Using Ruff?" list (#​28455)

Other changes

• Embed archive checksums in the shell installer (#​28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879
• @​jonathandung
• @​jogo-openai

Kludex/uvicorn (uvicorn)

v0.53.0: Version 0.53.0

Compare Source

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#​2982, #​3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#​3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#​3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#​3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#​3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.