Skip to content
This repository was archived by the owner on Aug 17, 2026. It is now read-only.

Bump the python-packages group across 1 directory with 8 updates - #375

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packages-9eb0ceeef2
Open

Bump the python-packages group across 1 directory with 8 updates#375
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packages-9eb0ceeef2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 8 updates in the / directory:

Package From To
requests 2.32.5 2.33.1
lxml 6.0.2 6.0.4
pandas 3.0.1 3.0.2
sqlalchemy 2.0.48 2.0.49
numpy 2.4.3 2.4.4
packaging 26.0 26.1
mkdocs-material 9.7.5 9.7.6
pymdown-extensions 10.21 10.21.2

Updates requests from 2.32.5 to 2.33.1

Release notes

Sourced from requests's releases.

v2.33.1

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.
Commits

Updates lxml from 6.0.2 to 6.0.4

Changelog

Sourced from lxml's changelog.

6.0.4 (2026-04-12)

Bugs fixed

  • LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

  • Several out of memory error cases now raise MemoryError that were not handled before.

  • Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

  • LP#2125399: Some failing tests were fixed or disabled in PyPy.

  • LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

  • Memory leak in case of a memory allocation failure when copying document subtrees.

  • When mapping an XPath result to Python failed, the result memory could leak.

  • When preparing an XSLT transform failed, the XSLT parameter memory could leak.

Other changes

  • Built using Cython 3.2.4.

  • Binary wheels use zlib 1.3.2.

Commits
  • 1fd1d6b Fix release date.
  • 5154859 CI: Include all library versions in libs cache key to asssure updated on vers...
  • 6a606f3 Add "doesn't crash" tests for LP#2148019.
  • f488f16 Prepare release of 6.0.4.
  • 1255d98 LP#2148019: Prevent spurious MemoryError during namespace cleanup.
  • 03b0c4a Remove dead type check.
  • a6f833c Fix release date.
  • 973d059 Update changelog.
  • 9044a52 Build: Downgrade libiconv to 1.18 since 1.19 does not build reliably.
  • a34dfdd Build: Upgrade libiconv to 1.19.
  • Additional commits viewable in compare view

Updates pandas from 3.0.1 to 3.0.2

Release notes

Sourced from pandas's releases.

pandas 3.0.2

We are pleased to announce the release of pandas 3.0.2. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • ab90747 RLS: 3.0.2 (#64934)
  • 6f27013 Backport PR #64931 on branch 3.0.x (DOC/BLD: temporary disable upload of docs...
  • 48ddc60 Backport PR #64664 on branch 3.0.x (BUG: DataFrame.sum() crashes on empty Dat...
  • 8774488 [backport 3.0.x] PERF: fix slow python loop in validation for ArrowStringArra...
  • 33af6cc Backport PR #64133 on branch 3.0.x (BUG: str.find returns byte offset instead...
  • 4ef49d8 [backport 3.0.x] BUG: fix convert_dtypes dropping values from sliced mixed-dt...
  • 0668f34 [backport 3.0.x] BUG: Fix HDFStore.put with StringDtype columns and compressi...
  • 23f2f44 [backport 3.0.x] BUG: Suppress unnecessary RuntimeWarning in to_datetime with...
  • 83ba804 Backport PR #64886: BUG: Compute Variance of Complex Numbers Correctly (#64892)
  • bb5ca1a Backport PR #64386 on branch 3.0.x (BUG: fix sort_index AssertionError with R...
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.48 to 2.0.49

Release notes

Sourced from sqlalchemy's releases.

2.0.49

Released: April 3, 2026

orm

  • [orm] [bug] Fixed issue where _orm.Session.get() would bypass the identity map and emit unnecessary SQL when with_for_update=False was passed, rather than treating it equivalently to the default of None. Pull request courtesy of Joshua Swanson.

    References: #13176

  • [orm] [bug] Fixed issue where chained _orm.joinedload() options would not be applied correctly when the final relationship in the chain is declared on a base mapper and accessed through a subclass mapper in a _orm.with_polymorphic() query. The path registry now correctly computes the natural path when a property declared on a base class is accessed through a path containing a subclass mapper, ensuring the loader option can be located during query compilation.

    References: #13193

  • [orm] [bug] [inheritance] Fixed issue where using _orm.Load.options() to apply a chained loader option such as _orm.joinedload() or _orm.selectinload() with _orm.PropComparator.of_type() for a polymorphic relationship would not generate the necessary clauses for the polymorphic subclasses. The polymorphic loading strategy is now correctly propagated when using a call such as joinedload(A.b).options(joinedload(B.c.of_type(poly))) to match the behavior of direct chaining e.g. joinedload(A.b).joinedload(B.c.of_type(poly)).

    References: #13202

  • [orm] [bug] [inheritance] Fixed issue where using chained loader options such as _orm.selectinload() after _orm.joinedload() with _orm.PropComparator.of_type() for a polymorphic relationship would not properly apply the chained loader option. The loader option is now correctly applied when using a call such as joinedload(A.b.of_type(poly)).selectinload(poly.SubClass.c) to eagerly load related objects.

    References: #13209

typing

  • [typing] [bug] Fixed a typing issue where the typed members of :data:.func would return the appropriate class of the same name, however this creates an issue for

... (truncated)

Commits

Updates numpy from 2.4.3 to 2.4.4

Release notes

Sourced from numpy's releases.

2.4.4 (Mar 29, 2026)

NumPy 2.4.4 Release Notes

The NumPy 2.4.4 is a patch release that fixes bugs discovered after the 2.4.3 release. It should finally close issue #30816, the OpenBLAS threading problem on ARM.

This release supports Python versions 3.11-3.14

Contributors

A total of 8 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Daniel Haag +
  • Denis Prokopenko +
  • Harshith J +
  • Koki Watanabe
  • Marten van Kerkwijk
  • Matti Picus
  • Nathan Goldbaum

Pull requests merged

A total of 7 pull requests were merged for this release.

  • #30978: MAINT: Prepare 2.4.x for further development
  • #31049: BUG: Add test to reproduce problem described in #30816 (#30818)
  • #31052: BUG: fix FNV-1a 64-bit selection by using NPY_SIZEOF_UINTP (#31035)
  • #31053: BUG: avoid warning on ufunc with where=True and no output
  • #31058: DOC: document caveats of ndarray.resize on 3.14 and newer
  • #31079: TST: fix POWER VSX feature mapping (#30801)
  • #31084: MAINT: numpy.i: Replace deprecated sprintf with snprintf...
Commits
  • be93fe2 Merge pull request #31090 from charris/prepare-2.4.4
  • f5245dc REL: Prepare for the NumPy 2.4.4 release
  • 02e838b Merge pull request #31084 from charris/backport-31056
  • fa74b2d MAINT: numpy.i: Replace deprecated sprintf with snprintf (#31056)
  • 533a6db Merge pull request #31079 from charris/backport-20801
  • 9e496cb TST: fix POWER VSX feature mapping (#30801)
  • 8052c4b Merge pull request #31058 from charris/backport-31021
  • 7f13b5a MAINT: Skip test on PyPy.
  • 4c5fdd6 MAINT: Remove unused import of tracemalloc.
  • a3ca5ed Update numpy/_core/src/multiarray/shape.c
  • Additional commits viewable in compare view

Updates packaging from 26.0 to 26.1

Release notes

Sourced from packaging's releases.

26.1

Features:

Behavior adaptations:

Pylock (PEP 751) updates:

Fixes:

Performance:

... (truncated)

Changelog

Sourced from packaging's changelog.

26.1 - 2026-04-14


Features:

    

  • PEP 783: add handling for Emscripten wheel tags in (:pull:804)
    • 

  • PEP 803: add handling for the abi3.abi3t free-threading tag in (:pull:1099)
    • 

  • PEP 723: add packaging.dependency_groups module, based on the dependency-groups package in (:pull:1065)
    • 

  • Add the packaging.direct_url module in (:pull:944)
    • 

  • Add the packaging.errors module in (:pull:1071)
    • 

  • Add SpecifierSet.is_unsatisfiable using ranges (new internals that will be expanded in future versions) in (:pull:1119)
    • 

  • Add create_compatible_tags_selector to select compatible tags in (:pull:1110)
    • 

  • Add a key argument to SpecifierSet.filter() in (:pull:1068)
    • 

  • Support & and | for Marker's in (:pull:1146)
    • 

  • Normalize Version.__replace__ and add Version.from_parts in (:pull:1078)
    • 

  • Add an option to validate compressed tag set sort order in parse_wheel_filename in (:pull:1150)
    • 



Behavior adaptations:


    

  • Narrow exclusion of pre-releases for <V.postN to match spec in (:pull:1140)
    • 

  • Narrow exclusion of post-releases for >V to match spec in (:pull:1141)
    • 

  • Rename format_full_version to _format_full_version to make it visibly private in (:pull:1125)
    • 

  • Restrict local version to ASCII in (:pull:1102)
    • 



Pylock (PEP 751) updates:


    

  • Add pylock select function in (:pull:1092)
    • 

  • Document pylock select() method and PylockSelectError in (:pull:1153)
    • 

  • Add filename property to PackageSdist and PackageWheel, more validation in (:pull:1095)
    • 

  • Give preference to path over url in (:pull:1128)
    • 

  • Validate name/version consistency in file names in (:pull:1114)
    • 



Fixes:


    

  • Fix > comparison for versions with dev+local segments in (:pull:1097)
    • 

  • Fix incorrect self-comparison for InfinityType and NegativeInfinityType in (:pull:1093)
    • 

  • Canonicalize when deduplicating specifiers in SpecifierSet in (:pull:1109)
    • 

  • Fix charset error message formatting in (:pull:1121)
    • 

  • Handle the key parameter in SpecifierSet.filter when specifiers are empty and prerelease is False in (:pull:1096)
    • 

  • Standardize inner components of repr output in (:pull:1090)
    • 

  • Specifier's === uses original string, not normalized, when available in (:pull:1124)
    • 

  • Propagate int-max-str-digits ValueError in (:pull:1155)
    • 



Performance:


    

  • Add fast path for parsing simple versions (digits and dots only) in (:pull:1082)
    • 

  • Add fast path for Version to Version comparison by skipping _key property in (:pull:1083)
    • 

  • Cache Version hash value in dedicated slot in (:pull:1118)
    • 

  • Overhaul _cmpkey to remove use of custom objects in (:pull:1116)
    • 

  • Skip __replace__ in Specifier comparison if not needed in (:pull:1081)
    
</tr></table>

... (truncated)

Commits
  • c1a88a3 Bump for release
  • 702c25e docs: update changelog for 26.1 (#1156)
  • 3f4f5d4 Implement is_unsatisfiable on SpecifierSet using ranges (#1119)
  • 06c6555 Propagate int-max-str-digits ValueError (#1155)
  • 905c90c feat: option to validate compressed tag set sort order in `parse_wheel_filena...
  • af0026c docs(pylock): document select() method and PylockSelectError (#1153)
  • 668da86 Rename format_full_version to _format_full_version to make it visibly private...
  • f294d52 tests: do not reload the tags module (#1152)
  • 2c6c7df feat: add handling for Emscripten wheels tags per PEP 783 (#804)
  • 6762eea docs(markers): document & and | operators for combining Marker objects (#1151)
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.7.5 to 9.7.6

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.6

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

Changes

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs
Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.6 (2026-03-19)

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

  • Limited version range of mkdocs to <2
  • Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

  • Hardened social cards plugin by switching to sandboxed environment
  • Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

  • Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

  • Opened up version ranges of optional dependencies for forward-compatibility
  • Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

  • Updated requests to 2.30+ to mitigate CVE in urllib
  • Fixed privacy plugin not picking up protocol-relative URLs
  • Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved unsustainable to maintain and represent architectural dead ends. They are provided as-is without ongoing support.

Changes:

... (truncated)

Commits

Updates pymdown-extensions from 10.21 to 10.21.2

Release notes

Sourced from pymdown-extensions's releases.

10.21. 2

10.21.2

  • FIX: Highlight: Latest Pygments versions cannot handle a "filename" for code block titles of None.

10.20.1

  • FIX: Quotes: Ensure the first class for callouts (the alert type) is always rendered lowercase.
Commits
  • a4fdd73 Skip tag 10.21.1 has we accidentally already used it
  • 8afb4cd Docs: Update JS deps
  • 7bf5b29 Pygments needs a non-None value for code block title (#2863)
  • 20b11eb Fix some spelling and formatting
  • c9edba3 Docs: strengthen Snippets warning and add security considerations
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-packages group across 1 directory with 8 updates
098c372 
Bumps the python-packages group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.1` |
| [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.0.4` |
| [pandas](https://github.com/pandas-dev/pandas) | `3.0.1` | `3.0.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.48` | `2.0.49` |
| [numpy](https://github.com/numpy/numpy) | `2.4.3` | `2.4.4` |
| [packaging](https://github.com/pypa/packaging) | `26.0` | `26.1` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.5` | `9.7.6` |
| [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) | `10.21` | `10.21.2` |



Updates `requests` from 2.32.5 to 2.33.1
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.5...v2.33.1)

Updates `lxml` from 6.0.2 to 6.0.4
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.2...lxml-6.0.4)

Updates `pandas` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.1...v3.0.2)

Updates `sqlalchemy` from 2.0.48 to 2.0.49
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `numpy` from 2.4.3 to 2.4.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.3...v2.4.4)

Updates `packaging` from 26.0 to 26.1
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.0...26.1)

Updates `mkdocs-material` from 9.7.5 to 9.7.6
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.5...9.7.6)

Updates `pymdown-extensions` from 10.21 to 10.21.2
- [Release notes](https://github.com/facelessuser/pymdown-extensions/releases)
- [Commits](facelessuser/pymdown-extensions@10.21...10.21.2)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: lxml
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: pandas
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: sqlalchemy
  dependency-version: 2.0.49
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: numpy
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: packaging
  dependency-version: '26.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: mkdocs-material
  dependency-version: 9.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: pymdown-extensions
  dependency-version: 10.21.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 15, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 15, 2026

This branch has not been deployed

No deployments
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@0x41424142 0x41424142 Awaiting requested review from 0x41424142 0x41424142 is a code owner
@jake-lindsay-tfs jake-lindsay-tfs Awaiting requested review from jake-lindsay-tfs jake-lindsay-tfs is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants