Bump uvicorn from 0.52.4 to 0.53.0

[dependabot]

Bumps uvicorn from 0.52.4 to 0.53.0.

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs dependabot/uv/dev/uvicorn-0.53.0 (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	2.29ms	2.28ms	-0.0% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	9.01ms	8.54ms	-5.2% ⚪	✅
Large Closest Match Lookup	192.96ms	197.20ms	+2.2% ⚪	✅
Realistic Closest Match Workload	107.36ms	105.20ms	-2.0% ⚪	✅
Event Memory Medium Scan	1402 B/event	1402 B/event	+0.0% ⚪	✅
Event Memory Large Scan	1527 B/event	1527 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	231.20ms	229.37ms	-0.8% ⚪	✅
Event Validation Full Scan Startup Large Batch	309.24ms	298.41ms	-3.5% ⚪	✅
Make Event Autodetection Small	12.87ms	12.82ms	-0.3% ⚪	✅
Make Event Autodetection Large	130.26ms	128.83ms	-1.1% ⚪	✅
Make Event Explicit Types	5.67ms	5.44ms	-4.1% ⚪	✅
Excavate Single Thread Small	2.717s	2.498s	-8.0% ⚪	✅
Excavate Single Thread Large	6.094s	5.735s	-5.9% ⚪	✅
Excavate Parallel Tasks Small	2.691s	2.581s	-4.1% ⚪	✅
Excavate Parallel Tasks Large	3.990s	3.909s	-2.0% ⚪	✅
Intercept Throughput Small	649.39ms	667.58ms	+2.8% ⚪	✅
Intercept Throughput Medium	653.62ms	664.46ms	+1.7% ⚪	✅
Dns Throughput Quiet	1.433s	1.525s	+6.4% ⚪	✅
Dns Throughput Loaded	990.42ms	1.053s	+6.4% ⚪	✅
Dns Throughput Inherited	1.285s	1.405s	+9.3% ⚪	✅
Is Ip Performance	1.38ms	1.36ms	-1.3% ⚪	✅
Make Ip Type Performance	121.74µs	111.87µs	-8.1% ⚪	✅
Mixed Ip Operations	1.43ms	1.41ms	-0.8% ⚪	✅
Memory Use Web Crawl	1.0 MB	1.0 MB	+0.0% ⚪	✅
Memory Use Subdomain Enum	28.3 MB	28.4 MB	+0.1% ⚪	✅
Memory Use Deep Chain	5.0 MB	5.0 MB	+0.0% ⚪	✅
Memory Use Parallel Chains	12.0 MB	13.2 MB	+9.6% ⚪	✅
Scan Throughput 100	1.750s	1.850s	+5.7% ⚪	✅
Scan Throughput 1000	10.067s	11.255s	+11.8% 🟡🟡	⚠️
Typical Queue Shuffle	3.00µs	3.04µs	+1.5% ⚪	✅
Priority Queue Shuffle	15.05µs	15.14µs	+0.6% ⚪	✅

🎯 Performance Summary

! 1 regression ⚠️
  30 unchanged ✅

🔍 Significant Changes (>10%)

• Scan Throughput 1000: 11.8% 🐌 slower

---

🐍 Python Version 3.11.16