Bump uvicorn from 0.38.0 to 0.40.0 in /backend (#1486)

Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.38.0 to
0.40.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/releases">uvicorn's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.40.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Drop Python 3.9 by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2772">Kludex/uvicorn#2772</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/uvicorn/compare/0.39.0...0.40.0">https://github.com/Kludex/uvicorn/compare/0.39.0...0.40.0</a></p>
<h2>Version 0.39.0</h2>
<h2>What's Changed</h2>
<ul>
<li>explicitly start ASGI run with empty context by <a
href="https://github.com/pmeier"><code>@​pmeier</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2742">Kludex/uvicorn#2742</a></li>
<li>fix(websockets): Send close frame on ASGI return by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2769">Kludex/uvicorn#2769</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/pmeier"><code>@​pmeier</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/uvicorn/pull/2742">Kludex/uvicorn#2742</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/uvicorn/compare/0.38.0...0.39.0">https://github.com/Kludex/uvicorn/compare/0.38.0...0.39.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's
changelog</a>.</em></p>
<blockquote>
<h2>0.40.0 (December 21, 2025)</h2>
<h3>Remove</h3>
<ul>
<li>Drop support for Python 3.9 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2772">#2772</a>)</li>
</ul>
<h2>0.39.0 (December 21, 2025)</h2>
<h3>Fixed</h3>
<ul>
<li>Send close frame on ASGI return for WebSockets (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2769">#2769</a>)</li>
<li>Explicitly start ASGI run with empty context (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2742">#2742</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/uvicorn/commit/9ff60042a53cd1bbfd5580ab0a91ea2d1d8f2f8c"><code>9ff6004</code></a>
Version 0.40.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2773">#2773</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/19df042c54c1562f058daf021d6f7bd1d5ed621c"><code>19df042</code></a>
Drop Python 3.9 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2772">#2772</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/865ce7c0b4329a384273a6628eceb8d597989521"><code>865ce7c</code></a>
Run strict mypy on test suite (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2771">#2771</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/4f40b8495772eb3a1ab3613ffd7be5156f8e1389"><code>4f40b84</code></a>
Version 0.39.0 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2770">#2770</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/5692dfc416f9e65aee5028e55d119313d8d3ab0f"><code>5692dfc</code></a>
fix(websockets): Send close frame on ASGI return (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2769">#2769</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/4194764a26824e5d8ddd1fa673df78dff82966e0"><code>4194764</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2763">#2763</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/d94bf28743de545d2d4b150f022203a5178cb705"><code>d94bf28</code></a>
explicitly start ASGI run with empty context (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2742">#2742</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/8ae0bcbecb0a655789abf0c2dd4200848fc68a30"><code>8ae0bcb</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2748">#2748</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/4744ff9a1a4888c76ea160328cc9dcc2680c2c71"><code>4744ff9</code></a>
Add groups configuration for GitHub Actions (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2747">#2747</a>)</li>
<li><a
href="https://github.com/Kludex/uvicorn/commit/0391372376c264604a0475b0864bcbf3a8705352"><code>0391372</code></a>
chore(deps): bump astral-sh/setup-uv from 6.8.0 to 7.1.2 (<a
href="https://redirect.github.com/Kludex/uvicorn/issues/2746">#2746</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/uvicorn/compare/0.38.0...0.40.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uvicorn&package-manager=uv&previous-version=0.38.0&new-version=0.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

backend/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "types-aiofiles==25.1.0.20251011",
     "types-passlib==1.7.7.20241221",
     "types-simplejson==3.20.0.20250218",
-    "uvicorn==0.38.0",
+    "uvicorn==0.40.0",
 ]
 
 [tool.pytest.ini_options]