deps(pip): bump fastapi from 0.135.2 to 0.135.3

[dependabot]

Bumps fastapi from 0.135.2 to 0.135.3.

Release notes

Sourced from fastapi's releases.

0.135.3

Features

• ✨ Add support for @app.vibe(). PR #15280 by @​tiangolo.
  • New docs: Vibe Coding.

Docs

• ✏️ Fix typo for client_secret in OAuth2 form docstrings. PR #14946 by @​bysiber.

Internal

• 👥 Update FastAPI People - Experts. PR #15279 by @​tiangolo.
• ⬆ Bump orjson from 3.11.7 to 3.11.8. PR #15276 by @​dependabot[bot].
• ⬆ Bump ruff from 0.15.0 to 0.15.8. PR #15277 by @​dependabot[bot].
• 👥 Update FastAPI GitHub topic repositories. PR #15274 by @​tiangolo.
• ⬆ Bump fastmcp from 2.14.5 to 3.2.0. PR #15267 by @​dependabot[bot].
• 👥 Update FastAPI People - Contributors and Translators. PR #15270 by @​tiangolo.
• ⬆ Bump requests from 2.32.5 to 2.33.0. PR #15228 by @​dependabot[bot].
• 👷 Add ty check to lint.sh. PR #15136 by @​svlandeg.

Commits

• 1f442c4 🔖 Release version 0.135.3
• 8f5d157 📝 Update release notes
• 428452a 📝 Update release notes
• 70580da ✨ Add support for @app.vibe() (#15280)
• 6ee8747 📝 Update release notes
• 3e72c09 👥 Update FastAPI People - Experts (#15279)
• 96df35f 📝 Update release notes
• 6c81125 ⬆ Bump orjson from 3.11.7 to 3.11.8 (#15276)
• 428f82c 📝 Update release notes
• 5599c59 ⬆ Bump ruff from 0.15.0 to 0.15.8 (#15277)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[jmanzanog]

CI is currently failing because the base workflow runs pip-audit against a transitive vulnerability in curl_cffi 0.13.0 pulled by yfinance==1.2.0, not because of this dependency bump itself.

I opened #60 to unblock the queue by scoping the audit to requirements.txt and temporarily ignoring CVE-2026-33752 until upstream relaxes the yfinance constraint.

[jmanzanog]

CI está fallando por un bloqueo mecánico ajeno a este bump: pip-audit marca curl_cffi 0.13.0 (CVE-2026-33752), pero yfinance==1.2.0 todavía exige curl_cffi<0.14.

Fix temporal ya abierto en #60 para desbloquear estas PRs sin tocar lógica de negocio. Cuando #60 entre a main, esta PR debería quedar mergeable con checks verdes.

[jmanzanog]

Heads-up: #61 now contains a cleaner root-cause fix for this CI failure.

The current failure is still the pip-audit finding on curl_cffi 0.13.0 / CVE-2026-33752, caused by yfinance 1.2.0 constraining curl_cffi<0.14.

PR #61 bumps yfinance to 1.2.1, which allows curl_cffi>=0.15 and should remove the blocker once merged and branches are updated.