ci: bump the python group with 6 updates

[dependabot]

Updates the requirements on clickhouse-connect, numpy, pandas, pytest, httpx and pyyaml to permit the latest version.
Updates clickhouse-connect from 0.8.18 to 1.8.0

Release notes

Sourced from clickhouse-connect's releases.

v1.8.0

clickhouse-connect v1.8.0

This release introduces an experimental Rust codec for faster ClickHouse Native query decoding and insert encoding. It also expands ClickHouse type support and includes several SQLAlchemy, Alembic, Native format, and packaging fixes.

The Rust codec is opt in. The existing Python and Cython codec is still the default.

Highlights

Experimental Rust codec

The new native_codec option covers query, query_np, query_df, their streaming variants, and inserts including insert_df.

client = clickhouse_connect.get_client(
    host="localhost",
    native_codec="rust",
)

native_codec="rust" falls back to Python for unsupported paths. Use native_codec="rust_strict" while evaluating or benchmarking so unsupported paths raise instead.

The Rust codec is currently most useful for:

• Large DataFrame results containing String, LowCardinality, Array, Map, JSON, Decimal, and UUID columns
• Large row and column block streams
• Concurrent query workloads
• Bulk inserts

Small results and flat numeric tables may see less benefit at the moment. Buffered query() calls on very wide or numeric results may also currently be slower. Benchmark your own workload before adopting the codec.

For evaluation, install the Rust codec with PyArrow:

pip install --upgrade "clickhouse-connect[rust,arrow]"

Note that PyArrow is required for Rust NumPy and Pandas output paths in 1.8. Applications using standard Python rows, block streams, and inserts can use the smaller installation:

pip install --upgrade "clickhouse-connect[rust]"

The compiled codec is published separately as clickhouse-connect-core 0.2.0. Existing installations do not install it automatically. The codec, packaging, and dependency set are currently experimental.

Geometry and Native types

• Added Native query and insert support for Geometry and MultiPoint in both codecs. Inserting MultiPoint requires ClickHouse 26.8 or later. #1018
• Added support for all ClickHouse Interval* types.
• Expanded Time64 parsing, reflection, query, and insert support across server-valid precisions.

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.8.0, 2026-09-02

Improvements

• Added native query and insert support for the ClickHouse MultiPoint type in the Python and Rust codecs, including containers and SQLAlchemy reflection. Inserting MultiPoint values requires ClickHouse 26.8 or later. Geometry now supports the MultiPoint member added in ClickHouse 26.8 at Native discriminator 6 while preserving the original discriminators 0 through 5. Geometry also supports the typed query format when selected with the Geometry type key. Variant format settings do not apply to Geometry. The Rust extra now requires clickhouse-connect-core>=0.2.0,<0.3.
• Rust codec setup guidance now recommends pip install "clickhouse-connect[rust,arrow]" for evaluation because its NumPy and Pandas output paths require PyArrow in 1.8. The lean rust extra remains available for standard Python row queries, block streams, and inserts. A missing PyArrow dependency now logs a warning before native_codec="rust" falls back to Python.

Bug Fixes

• SQLAlchemy and Alembic now connect and reflect with native_codec="rust_strict". Dialect metadata statements are marked as driver-internal, so they decode with the Python codec in every codec mode instead of tripping the strict query_formats check. Compatible ordinary statements still use the Rust codec.
• Rust codec streaming queries now honor show_clickhouse_errors. Mid-stream server errors return the generic message when the setting is False and drop the server version trailer when it is "scrub", matching the Python codec on both the sync and async clients.
• Rust codec streams that are discarded without entering their context now close their response and stop the read-ahead thread as soon as the stream is discarded. Previously each abandoned stream retained a thread, socket, and buffered response data for the life of the process.

Compatibility

• The experimental Rust codec targets Python codec parity, with documented differences in some result cell types, insert validation errors, accepted insert conversions, and Dynamic shared-value decoding. See the Rust codec documentation for the full list of known behavior differences.

See the 1.8.0rc1, 1.8.0rc2, and 1.8.0rc3 entries below for the other changes included in 1.8.0.

1.8.0rc3, 2026-08-27

Improvements

• SQLAlchemy JSON typed-path validation now reads ClickHouse type arity and numeric bounds from shared driver metadata. Invalid hints that combine a wrong outer argument count with a malformed surplus nested argument now report the outer arity error instead of the nested parsing error. Accepted hints and canonical type names are unchanged. Closes #990.
• SQLAlchemy JSON columns can now declare ClickHouse typed paths with typed_paths={...} or simple keyword shorthand, plus dynamic path and type limits and plain and regular expression skip rules. JSON arguments use the same canonical ordering as server reflection. Alembic autogeneration renders configured JSON types as valid Python and round-trips them without a follow-up type migration. Closes #981.
• Driver JSON type names now use the server's canonical argument ordering, omit explicit default limits, and expose decoded skip_paths and skip_regexps. This changes the .name and skips values reflected to all driver users.
• Time64 now accepts every server-valid precision from 0 through 9 for parsing, reflection, native queries, and DataFrame inserts. NumPy and Pandas queries remain limited to precisions 0, 3, 6, and 9 and raise ProgrammingError otherwise.
• Dynamic type names now preserve the max_types argument.
• Generic Enum definitions are accepted and canonicalized to Enum8 or Enum16 by value range.
• Type name parsing now handles double quoted identifiers and quoted string literals uniformly. Some type names that previously failed to parse now parse.

Bug Fixes

• Rust codec NumPy and Pandas queries now support Time64(0) with second resolution, including typed JSON paths. Unsupported statically declared Time64 scales, including nullable, container, Nested, Variant, and typed JSON types, now raise the same ProgrammingError as the Python codec instead of leaking a KeyError. The remaining Dynamic(Time64) cell type and validation limitations are documented.
• Empty Tuple() definitions no longer parse as if they contain a phantom element, and their columns now consume and emit the Native format's per-row marker bytes. Root, nested, named, array-wrapped, and nullable empty tuples now query and insert without misaligning adjacent columns, corrupting values, or failing insert block sizing. Closes #971.
• Alembic autogenerate now emits valid Python for SimpleAggregateFunction and AggregateFunction columns, including aggregate names that collide with Python builtins and arguments containing named Tuple types. Closes #992.
• SQLAlchemy can now reflect standalone Variant columns, and Alembic autogeneration can compare and round-trip them. Closes #989.
• Alembic autogenerate now emits valid, lossless Python for Nested and named Tuple columns, including when they are inside another container. Generated upgrades preserve field names and no longer produce repeated type migrations. Closes #988.
• Source builds no longer swallow unrelated packaging errors and retry them as a pure Python build. The extensions are now declared optional so setuptools handles the fallback, and a new CLICKHOUSE_CONNECT_REQUIRE_C=1 makes an extension build failure fatal for CI and redistributable wheels. The default fallback now covers only compiler and linker failures, and a missing Cython outside skip mode fails the build. A default-mode fallback wheel keeps its platform and interpreter tags instead of being tagged py3-none-any. CLICKHOUSE_CONNECT_SKIP_CYTHON=1 still skips the extensions entirely, and setting both flags is an error. Closes #994.
• The client now sorts and deduplicates Variant members to the server's canonical order. Previously a client-declared Variant type with non-canonical member order wrote native insert data under the wrong member types.
• Time64 negative timedelta inserts previously stored incorrect values. Time64 NumPy timedelta inserts previously stored wrong magnitudes. Both now store correct tick values, and out-of-range NumPy values are rejected instead of incorrectly wrapping.
• Pandas Timedelta values in Time and Time64 row inserts now convert like timedelta. Nullable timedelta DataFrame columns now insert missing values as NULL on Pandas 3 instead of raising TypeError.
• SQLAlchemy column DDL now compiles TypeDecorator and with_variant() types through the active ClickHouse dialect. Dialect-aware types such as a decorator that selects DateTime64(6, 'UTC') no longer fall back to generic DATETIME in CREATE TABLE and related column DDL. Closes #984.
• IPv6 hosts are now bracketed when building the connection URI, so get_client(host="2001:db8::1") connects instead of producing an unusable URI where the first colon of the address reads as the port separator. Applies to both the sync and async clients. Closes #998.

Compatibility

• SQLAlchemy: the alembic extra now requires alembic>=1.18. Earlier versions satisfied the package metadata but failed when importing the ClickHouse Alembic integration because the priority-dispatch API it uses was added in Alembic 1.18. See #983.

1.8.0rc2, 2026-08-20

... (truncated)

Commits

• eeb8530 Release/1.8.0 (#1017)
• 16ac666 ci: refresh ClickHouse server version matrix (drop 25.8 + 26.5, add 26.8) (#1...
• 9822f95 Bracket IPv6 hosts when building the connection URI (#1002)
• ccbf29a fix empty Tuple parsing and serialization (#1010)
• 5a72a99 fix: require explicit pure-Python source builds (#995)
• ee03571 fix Alembic aggregate function rendering (#1007)
• 33eaa8c centralize ClickHouse type argument metadata (#1006)
• 95f8936 fix sqa variant reflection (#1000)
• 3700e3c fix Alembic named container rendering (#993)
• 842e413 add SQLAlchemy JSON type hints and canonical driver type names (#991)
• Additional commits viewable in compare view

Updates numpy from 2.4.6 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

• Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

  (gh-32296)

• MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

  (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Charles Harris
• Iason Krommydas
• James Davies +
• Joren Hammudoglu
• Maanas Arora
• Matti Picus
• Nathan Goldbaum
• Shikhar Goel +
• Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

• #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits

• dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
• edcac6a REL: Prepare for the NumPy 2.5.3 release
• fd4d908 Merge pull request #32509 from charris/backport-32496
• 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
• 294956e Merge pull request #32506 from charris/backport-32503
• 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
• 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
• 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
• 8972f70 Merge pull request #32478 from charris/backport-32466
• ab1b589 Merge pull request #32477 from charris/backport-32423
• Additional commits viewable in compare view

Updates pandas from 2.3.2 to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.3

We are pleased to announce the release of pandas 3.0.3. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

... (truncated)

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• 8188eb1 RLS: 3.0.4 (#66079)
• bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
• 6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
• 70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
• 57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
• f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates httpx to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

0.27.2 (27th August, 2024)

Fixed

• Reintroduced supposedly-private URLTypes shortcut. (#2673)

0.27.1 (27th August, 2024)

Added

• Support for zstd content decoding using the python zstandard package is added. Installable using httpx[zstd]. (#3139)

Fixed

• Improved error messaging for InvalidURL exceptions. (#3250)
• Fix app type signature in ASGITransport. (#3109)

0.27.0 (21st February, 2024)

... (truncated)

Commits

• 26d48e0 Version 0.28.1 (#3445)
• 89599a9 Fix verify=False, cert=... case. (#3442)
• 8ecb86f Add test for request params behavior changes (#3364) (#3440)
• 0cb7e5a Bump the python-packages group with 11 updates (#3434)
• 15e21e9 Updating deprecated docstring Client() class (#3426)
• 80960fa Version 0.28.0. (#3419)
• a33c878 Fix extensions type annotation. (#3380)
• ce7e14d Error on verify as str. (#3418)
• 47f4a96 Handle empty zstd responses (#3412)
• 189fc4b Update CHANGELOG.md, fix typo(s) (#3406)
• Additional commits viewable in compare view

Updates pyyaml to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

6.0.2 (2024-08-06)

• yaml/pyyaml#808 -- Support for Cython 3.x and Python 3.13

6.0.1 (2023-07-18)

• yaml/pyyaml#702 -- pin Cython build dep to < 3.0

6.0 (2021-10-13)

• yaml/pyyaml#327 -- Change README format to Markdown
• yaml/pyyaml#483 -- Add a test for YAML 1.1 types
• yaml/pyyaml#497 -- fix float resolver to ignore . and ._
• yaml/pyyaml#550 -- drop Python 2.7
• yaml/pyyaml#553 -- Fix spelling of “hexadecimal”
• yaml/pyyaml#556 -- fix representation of Enum subclasses
• yaml/pyyaml#557 -- fix libyaml extension compiler warnings
• yaml/pyyaml#560 -- fix ResourceWarning on leaked file descriptors
• yaml/pyyaml#561 -- always require Loader arg to yaml.load()
• yaml/pyyaml#564 -- remove remaining direct distutils usage

5.4.1 (2021-01-20)

• yaml/pyyaml#480 -- Fix stub compat with older pyyaml versions that may unwittingly load it

5.4 (2021-01-19)

• yaml/pyyaml#407 -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA
• yaml/pyyaml#472 -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
• yaml/pyyaml#441 -- Fix memory leak in implicit resolver setup
• yaml/pyyaml#392 -- Fix py2 copy support for timezone objects
• yaml/pyyaml#378 -- Fix compatibility with Jython

5.3.1 (2020-03-18)

• yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor

5.3 (2020-01-06)

• yaml/pyyaml#290 -- Use is instead of equality for comparing with None
• yaml/pyyaml#270 -- Fix typos and stylistic nit
• yaml/pyyaml#309 -- Fix up small typo
• yaml/pyyaml#161 -- Fix handling of slots
• yaml/pyyaml#358 -- Allow calling add_multi_constructor with None
• yaml/pyyaml#285 -- Add use of safe_load() function in README
• yaml/pyyaml#351 -- Fix reader for Unicode code points over 0xFFFF

... (truncated)

Commits

• 49790e7 Release 6.0.3 (#889)
• 41309b0 Release 6.0.2 (#819)
• dd9f0e1 6.0.2rc1 (#809)
• f5527a2 disable CI trigger on PR edits
• b4d80a7 Python 3.12 + musllinux_1_1_x86_64 wheel support
• c42fa3b 6.0.1 release
• ae08bdc block Cython 3.0+ as a build dep (#702)
• f873cfe Add python 3.11 support (#663)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.