chore(deps): Bump uvicorn from 0.49.0 to 0.50.0 in /cirrus/server

[dependabot]

Bumps uvicorn from 0.49.0 to 0.50.0.

Release notes

Sourced from uvicorn's releases.

Version 0.50.0

What's Changed

• Memoize trusted host checks to avoid re-parsing the client IP per request by @​Kludex in Kludex/uvicorn#2970
• Cache the asgi scope sub-dict per connection by @​Kludex in Kludex/uvicorn#2976
• Build a fresh asgi scope dict per request by @​Kludex in Kludex/uvicorn#2977
• Replace click.style with an internal ANSI style helper by @​Kludex in Kludex/uvicorn#2981
• Avoid copying single-frame WebSocket payloads in websockets-sansio by @​Kludex in Kludex/uvicorn#2983
• Deprecate the legacy websockets implementation and default auto to websockets-sansio by @​Kludex in Kludex/uvicorn#2985
• Exit with a dedicated code on startup failure and stop the supervisor when a worker can't boot by @​Kludex in Kludex/uvicorn#3001
• Skip the eager app import in the parent when spawning workers by @​Kludex in Kludex/uvicorn#3012

Full Changelog: Kludex/uvicorn@0.49.0...0.50.0

Changelog

Sourced from uvicorn's changelog.

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

• Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)
• Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)
• Default --ws auto to websockets-sansio when websockets is installed (#2985)
• Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)
• Build a fresh asgi scope dict per request (#2977)
• Cache the asgi scope sub-dict per connection (#2976)
• Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)
• Memoize trusted host checks in ProxyHeadersMiddleware (#2970)
• Replace click.style with an internal ANSI style helper (#2981)

Deprecated

• Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

Commits

• 21d2c16 Version 0.50.0 (#3013)
• 6c42e8d Skip the eager app import in the parent when spawning workers (#3012)
• 56a4631 Exit with a dedicated code on startup failure and stop the supervisor when a ...
• 3314dfc chore(deps): bump the github-actions group with 4 updates (#3007)
• e8a31bc chore(deps): bump the python-packages group across 1 directory with 9 updates...
• 8d088b1 Deprecate the legacy websockets implementation and default auto to websocke...
• 5b08cf6 Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)
• bf3f60c Replace click.style with an internal ANSI style helper (#2981)
• eea1bcc Build a fresh asgi scope dict per request (#2977)
• afed211 Cache the asgi scope sub-dict per connection (#2976)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)