backend: bump the backend-dependencies group across 1 directory with 5 updates - #105

Takes the five backend bumps from Dependabot #93 and regenerates backend/requirements.lock, which #93 did not do — without the lock, CI's drift gate fails. #93 can be closed once this lands.

What changed

Runtime: fastapi 0.139.0 → 0.140.0 · pydantic-settings 2.7.1 → 2.14.2 · alembic 1.14.0 → 1.18.5
Dev-only: pytest 9.0.3 → 9.1.1 · black 26.3.1 → 26.5.1

The lock

Regenerated with the pinned command from CONTRIBUTING.md § Backend dependency lock, using the same uv version CI pins (0.8.17):

uv pip compile pyproject.toml --group build --generate-hashes --python-version 3.14 --output-file requirements.lock

The diff is 10 lines: the three bumped runtime packages plus one new # via pydantic-settings edge on typing-inspection (already in the closure via fastapi/pydantic). No new distribution enters the lock.

The two large jumps

pydantic-settings and alembic are the ones worth checking, so they were checked by running them rather than by reading release notes alone. A CPython 3.14.6 interpreter was installed, the regenerated lock installed with pip install --require-hashes, and the suite run against it.

pydantic-settings 2.7.1 → 2.14.2. The API surface this repo uses is small — BaseSettings, SettingsConfigDict(env_prefix/env_file/env_file_encoding/extra), and NoDecode on the two comma-separated list fields. Almost everything in those 159 upstream commits is CliSettingsSource, which is unused here. The one change that could have mattered is #688, which pins source precedence to init > env > dotenv > secrets > defaults; verified directly that an env var still beats a .env entry, that an init kwarg still beats both, and that SCRYE_FILESYSTEM_SCAN_ROOTS=/a,/b still parses through the NoDecode validator into ['/a', '/b']. Regenerating .env.example from the Settings model produces no diff, so the model renders identically.

alembic 1.14.0 → 1.18.5. alembic upgrade head runs all eight migrations clean, and alembic downgrade base unwinds them clean.

black 26.3.1 → 26.5.1 is the other bump with churn potential — a formatter bump that reformats is a large diff. It doesn't: black --check reports 169 files unchanged. target-version stays py313 for the PEP 758 reason documented in pyproject.toml.

Verification (CPython 3.14.6, against the regenerated lock)

• pytest — 580 passed, 3 skipped
• ruff check — clean
• black --check — clean, 169 files unchanged
• alembic upgrade head / downgrade base — both clean
• scripts/gen_env_example.py — no diff

The 18 warnings are pre-existing StarletteDeprecationWarnings for HTTP_422_UNPROCESSABLE_ENTITY, which this repo uses in 44 places. starlette is unchanged at 1.3.1 here, so these are not introduced by this PR — noted as a separate cleanup.