From 9757080821369234d6a68f7b6084b6487af35bef Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 5 Jan 2026 04:25:28 +0000
Subject: [PATCH 1/2] chore(deps): update backend python dependencies
 (minor/patch)

---
 backend/pyproject.toml |  4 ++--
 backend/uv.lock        | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 3579760..4bbe5e6 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -5,13 +5,13 @@ description = "A collaborative music queue for road trips. Submit song via LINE
 readme = "README.md"
 requires-python = ">=3.13"
 dependencies = [
-    "fastapi~=0.124.4",
+    "fastapi~=0.128.0",
     "httpx~=0.28.1",
     "line-bot-sdk~=3.21.0",
     "pydantic~=2.12.3",
     "pyyaml~=6.0.2",
     "requests~=2.32.4",
-    "uvicorn~=0.38.0",
+    "uvicorn~=0.40.0",
     "websockets~=15.0.1",
     "yt-dlp==2025.12.8",
 ]
diff --git a/backend/uv.lock b/backend/uv.lock
index a21829d..8c4a3ff 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -123,13 +123,13 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "fastapi", specifier = "~=0.124.4" },
+    { name = "fastapi", specifier = "~=0.128.0" },
     { name = "httpx", specifier = "~=0.28.1" },
     { name = "line-bot-sdk", specifier = "~=3.21.0" },
     { name = "pydantic", specifier = "~=2.12.3" },
     { name = "pyyaml", specifier = "~=6.0.2" },
     { name = "requests", specifier = "~=2.32.4" },
-    { name = "uvicorn", specifier = "~=0.38.0" },
+    { name = "uvicorn", specifier = "~=0.40.0" },
     { name = "websockets", specifier = "~=15.0.1" },
     { name = "yt-dlp", specifier = "==2025.12.8" },
 ]
@@ -200,7 +200,7 @@ wheels = [
 
 [[package]]
 name = "fastapi"
-version = "0.124.4"
+version = "0.128.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
@@ -208,9 +208,9 @@ dependencies = [
     { name = "starlette" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/cd/21/ade3ff6745a82ea8ad88552b4139d27941549e4f19125879f848ac8f3c3d/fastapi-0.124.4.tar.gz", hash = "sha256:0e9422e8d6b797515f33f500309f6e1c98ee4e85563ba0f2debb282df6343763", size = 378460, upload-time = "2025-12-12T15:00:43.891Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/52/08/8c8508db6c7b9aae8f7175046af41baad690771c9bcde676419965e338c7/fastapi-0.128.0.tar.gz", hash = "sha256:1cc179e1cef10a6be60ffe429f79b829dce99d8de32d7acb7e6c8dfdf7f2645a", size = 365682, upload-time = "2025-12-27T15:21:13.714Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3e/57/aa70121b5008f44031be645a61a7c4abc24e0e888ad3fc8fda916f4d188e/fastapi-0.124.4-py3-none-any.whl", hash = "sha256:6d1e703698443ccb89e50abe4893f3c84d9d6689c0cf1ca4fad6d3c15cf69f15", size = 113281, upload-time = "2025-12-12T15:00:42.44Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/05/5cbb59154b093548acd0f4c7c474a118eda06da25aa75c616b72d8fcd92a/fastapi-0.128.0-py3-none-any.whl", hash = "sha256:aebd93f9716ee3b4f4fcfe13ffb7cf308d99c9f3ab5622d8877441072561582d", size = 103094, upload-time = "2025-12-27T15:21:12.154Z" },
 ]
 
 [[package]]
@@ -586,15 +586,15 @@ wheels = [
 
 [[package]]
 name = "uvicorn"
-version = "0.38.0"
+version = "0.40.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click" },
     { name = "h11" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/cb/ce/f06b84e2697fef4688ca63bdb2fdf113ca0a3be33f94488f2cadb690b0cf/uvicorn-0.38.0.tar.gz", hash = "sha256:fd97093bdd120a2609fc0d3afe931d4d4ad688b6e75f0f929fde1bc36fe0e91d", size = 80605, upload-time = "2025-10-18T13:46:44.63Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/d1/8f3c683c9561a4e6689dd3b1d345c815f10f86acd044ee1fb9a4dcd0b8c5/uvicorn-0.40.0.tar.gz", hash = "sha256:839676675e87e73694518b5574fd0f24c9d97b46bea16df7b8c05ea1a51071ea", size = 81761, upload-time = "2025-12-21T14:16:22.45Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ee/d9/d88e73ca598f4f6ff671fb5fde8a32925c2e08a637303a1d12883c7305fa/uvicorn-0.38.0-py3-none-any.whl", hash = "sha256:48c0afd214ceb59340075b4a052ea1ee91c16fbc2a9b1469cca0e54566977b02", size = 68109, upload-time = "2025-10-18T13:46:42.958Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/d8/2083a1daa7439a66f3a48589a57d576aa117726762618f6bb09fe3798796/uvicorn-0.40.0-py3-none-any.whl", hash = "sha256:c6c8f55bc8bf13eb6fa9ff87ad62308bbbc33d0b67f84293151efe87e0d5f2ee", size = 68502, upload-time = "2025-12-21T14:16:21.041Z" },
 ]
 
 [[package]]

From 025f84b3b4704eac92a355616d715ccf2fe5d73d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 5 Jan 2026 04:25:41 +0000
Subject: [PATCH 2/2] chore(deps): sync backend requirements.txt with uv.lock

Auto-generated by GitHub Actions from uv export
---
 backend/requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index c549f11..7ed8a8c 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -31,7 +31,7 @@ colorama==0.4.6 ; sys_platform == 'win32'
     # via click
 deprecated==1.2.18
     # via line-bot-sdk
-fastapi==0.124.4
+fastapi==0.128.0
     # via cartunes
 frozenlist==1.7.0
     # via
@@ -96,7 +96,7 @@ urllib3==2.5.0
     # via
     #   line-bot-sdk
     #   requests
-uvicorn==0.38.0
+uvicorn==0.40.0
     # via cartunes
 websockets==15.0.1
     # via cartunes