ci: bump the python group across 1 directory with 7 updates

[dependabot]

Updates the requirements on clickhouse-connect, starlette, numpy, pandas, pytest, httpx and pyyaml to permit the latest version.
Updates clickhouse-connect from 0.8.18 to 1.9.0

Release notes

Sourced from clickhouse-connect's releases.

v1.9.0

clickhouse-connect v1.9.0

ClickHouse Connect 1.9.0 adds native async SQLAlchemy support, Rust codec performance improvements, and fixes across client cleanup, SQLAlchemy, Alembic, and inserts. It includes all changes from the three 1.9.0 release candidates.

Highlights

Features

• Native async SQLAlchemy support for SQLAlchemy 2.0.44+. Use clickhousedb+async:// with create_async_engine() for buffered Core and ORM execution, DDL, reflection, and Alembic migrations through run_sync(). Use the native AsyncClient for streaming and bulk inserts. #576
• SQLAlchemy multi-row Insert.values() supports dictionaries, tuples, and SQL expressions, including Pandas to_sql(method="multi"). #1024
• Opt-in Native Map pairs reads preserve duplicate keys and the order returned by the server. Dictionary output remains the default, and inserts still require dictionaries. #949

Performance

• Rust codec responses that fit in one chunk avoid starting a read-ahead thread.
• Rust codec pandas StringDtype results use Arrow buffers directly without first creating Python strings.
• Synchronous HTTP connections use operating-system socket buffer sizing for large uploads. #1044

Bug fixes

• Improved async cancellation, initialization, connection disposal, token-provider cleanup, and pool timeout handling.
• Rust read-ahead threads explicitly close their source iterators, so early cleanup no longer depends on prompt garbage collection.
• Arrow inserts correctly quote table and database identifiers on both clients. #1014
• Comments, quoted identifiers, and escaped strings containing LIMIT 0 no longer cause query results to be discarded. Metadata probes that unexpectedly return rows raise InternalError without replaying the query; use raw_query() for those queries. #925
• Fixed SQLAlchemy DateTime64 precision, Decimal arithmetic, table-engine reflection, Alembic version-table handling, and timezone-aware Date/Date32 inserts.

Compatibility

• Parameterized DB-API executemany() preserves SQL expressions and sends one request per parameter set. Earlier writes remain committed if a later request fails. Use Client.insert() for Native bulk throughput.
• SQLAlchemy DateTime64 declarations must match the server schema.
• Package metadata now uses PEP 639 license fields. Building from source requires setuptools>=77.0.3. #996

Installation

pip install clickhouse-connect

For async SQLAlchemy:

pip install "clickhouse-connect[sqlalchemy-async]"

See the SQLAlchemy guide and full changelog, including the RC1, RC2, and RC3 sections.

v1.9.0rc2

This is the second release candidate for 1.9.0. We're continuing to seek feedback on the native async SQLAlchemy support introduced in RC1. Please try it in your applications and report any issues.

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.9.0, 2026-09-21

This stable release includes all changes from 1.9.0rc1, 1.9.0rc2, and 1.9.0rc3. See those entries below for the full async SQLAlchemy feature set, Rust codec performance improvements, and fixes included in 1.9.0.

Improvements

• Added native async SQLAlchemy support for SQLAlchemy 2.0.44 and later. Install clickhouse-connect[sqlalchemy-async] and use clickhousedb+async:// with create_async_engine(). It supports buffered Core and ORM execution, DDL and reflection through run_sync(), and async Alembic environments. Use the native AsyncClient for streaming and bulk inserts. Closes #576.
• Native Map reads now support the opt-in pairs format, which returns a list of key/value tuples and preserves duplicate keys and the sequence returned by the server. The default remains a dictionary. The format also applies to nested Maps and NumPy/Pandas results. Native Map inserts still require dictionaries and raise DataError for pair lists. Closes #949.

Bug Fixes

• Rust codec read-ahead threads now close their source iterator explicitly when they stop. Early stream cleanup no longer depends on prompt garbage collection, which can delay cleanup on free-threaded Python.
• Arrow insert_arrow / insert_df_arrow now quote table and database identifiers the same way insert() does, so hyphenated and other names that need backquotes work on both the sync and async clients. Closes #1014.
• Queries whose text only appears to end in LIMIT 0 because of // comments, quoted identifiers, or escaped string contents no longer take the columns-only metadata path and discard returned rows. Metadata probes now confirm a real trailing LIMIT 0 against the bound SQL, including chDB, while binary-bound queries use the normal Native path. If a probe still returns rows, as with some UNION, EXCEPT, or EXPLAIN queries, the client raises InternalError after one execution without replaying the query. Use raw_query() to retrieve results for those queries. This addresses the false metadata-probe cases in #925.

Compatibility

• The package now declares its license with the PEP 639 license_expression field, and the deprecated License :: OSI Approved :: Apache Software License classifier has been removed. Built metadata carries License-Expression: Apache-2.0 and License-File: LICENSE. Building from source now requires setuptools>=77.0.3. Closes #996.

1.9.0rc3, 2026-09-11

Bug Fixes

• SQLAlchemy Memory, Log, StripeLog, TinyLog, Null, and Set engines now accept the zero-argument and settings= constructor calls emitted by Alembic. SummingMergeTree engines now accept keyword-only columns and preserve explicit summing columns through reflection and Alembic. Existing positional arguments and engine inheritance remain compatible. Closes #946.
• Synchronous HTTP connections no longer set SO_SNDBUF to 256 KiB, which disabled automatic buffer sizing and could slow large uploads. The operating system now sizes the buffer. The pool manager helpers also honor explicit socket_options instead of replacing them with defaults. Closes #1044.
• Alembic offline SQL generation no longer fails when include_schemas=True and version_table_schema is unset. Offline mode now skips the current database lookup. Online version table updates and deletes also work when version_table_schema="". Closes #1045.

1.9.0rc2, 2026-09-10

Improvements

• The Rust codec no longer starts a read-ahead thread for responses that fit in a single chunk. The first chunk is delivered immediately, and the thread starts only after the consumer requests and receives a second chunk. This removes a per-query cost that made many small concurrent queries slower than the Python codec.
• The Rust codec now builds pandas StringDtype columns for query_df and query_df_stream directly from its Arrow buffers instead of materializing Python strings first. Output values and dtypes are unchanged. String columns that contain invalid UTF-8 keep the existing hex rendering.

1.9.0rc1, 2026-09-09

Improvements

• Added a native async SQLAlchemy dialect for SQLAlchemy 2.0.44 and later. Install clickhouse-connect[sqlalchemy-async] and use clickhousedb+async:// with create_async_engine(). The first release supports buffered Core and ORM execution, inserts, per-query settings and read formats, server-side parameters, DDL and reflection through run_sync(), Alembic online migrations through AsyncConnection.run_sync(), offline Alembic compilation, and direct access to the native AsyncClient. A checked-in async Alembic environment demonstrates both migration paths. Alembic now adds its integration tag to async client User-Agent headers. SQLAlchemy pool pre-ping uses its standard SELECT 1 check. Closed native sessions are invalidated and replaced, while execution-time server and transport errors keep reusable open HTTP sessions. Pooled connections use distinct generated ClickHouse session IDs by default. A fixed session ID requires a single-connection pool or external serialization. Server-side cursors and AsyncConnection.stream() remain unsupported. AsyncSession.stream() returns a buffered result, and the native client provides streaming APIs for large results. Async executemany inserts issue one request per parameter set instead of using the Native bulk insert protocol. For bulk data, borrow the pool-owned driver_connection and call AsyncClient.insert(). Naive datetime values on the executemany path use naive_datetime_binding. Typed SQLAlchemy DateTime64 binds preserve fractional seconds with client-side and server-side parameters; untyped client-side parameters retain their existing formatting.
• SQLAlchemy multi-row Insert.values() statements now compile and execute. Rows can be dictionaries, tuples in table column order, or rows containing SQL expressions, with client-side or server-side bind parameters. This also enables Pandas to_sql(method="multi"). See the SQLAlchemy documentation for column selection rules and the bind parameter ceiling that applies to server-side parameters on ClickHouse 26.4 and newer. Closes #1024.

Bug Fixes

• Failed synchronous client construction now releases its dedicated urllib3 pool manager. Repeated connection or configuration failures no longer leave unused pool managers registered. Caller-supplied and shared pool managers are unchanged.
• Async requests waiting for a free connection no longer fail when the pool wait exceeds connect_timeout. The timeout still covers DNS, TCP, TLS, and proxy connection setup after a pool slot is available. Closes #1013.
• SQLAlchemy SQL-text inserts, comparisons, and literal rendering now preserve fractional seconds for typed DateTime64 values, including nested arrays and tuples. DateTime formatting, timezone handling, and Native bulk inserts retain their existing behavior. SQLAlchemy column types must match the server schema: declaring DateTime64 over a server DateTime column can now raise conversion errors, including in IN comparisons. Closes #1030.
• Native inserts into Date and Date32 columns now accept timezone-aware datetimes and mixed date and datetime values. They preserve each value's calendar date without converting its timezone, including in nullable and nested columns. Low cardinality columns also preserve different calendar dates when their datetime values represent the same instant. Closes #1031.
• SQLAlchemy arithmetic on ClickHouse Decimal columns and aggregates no longer raises an invalid precision or scale error. Expressions preserve configured operand types and existing numeric promotion behavior. Closes #1027.
• DB-API Cursor.executemany() now preserves the supplied INSERT statement and applies each parameter set through the normal SQL binding path. Expressions, literals, reordered or repeated named binds, target modifiers, INSERT SELECT, quoted identifiers, and server-side coercion are no longer discarded by a heuristic Native rewrite. Parameterized DB-API inserts issue one HTTP request per parameter set, so rows written before a later failure remain committed. Use Client.insert() when one Native block and its throughput are required. INSERT row counts now aggregate the server's written_rows summaries and report -1 when no reliable count is available. SQLAlchemy keeps Native bulk inserts for compiler-generated plain INSERT statements, while raw SQL and expression-bearing statements use the SQL path. The established placeholder-less INSERT INTO table (columns) VALUES form also keeps its Native compatibility path. In that form, doubled %% in identifiers follows the pyformat contract and sends a literal % identifier. Closes #930, #932, and #934.
• Multiprocessing workers now reuse one process-local urllib3 PoolManager. Creating and closing clients inside workers no longer retains one unused manager per client. Closes #1016.

... (truncated)

Commits

• a168a1f release prep for v1.9.0 (#1056)
• 5b6d3a5 Add async SQLAlchemy dialect (#1022)
• 9adb2b0 Drop the deprecated license classifier (#1003)
• c399d55 Add opt-in Map pairs reads to preserve duplicate keys (#1053)
• cac7891 Quote identifiers on Arrow insert table names (#1026)
• 5816c19 Fix false LIMIT 0 metadata probes (#1038)
• 2a3cc19 Fix Cloud JSON flake and SQLAlchemy 1.x CI dependencies (#1050)
• ec312d4 Fix table engine constructors and summing column replay (#1048)
• b0c7716 Fix default socket send-buffer sizing (#1047)
• 60d4e3a Fix Alembic version table schema initialization (#1046)
• Additional commits viewable in compare view

Updates starlette from 1.6.0 to 1.7.0

Release notes

Sourced from starlette's releases.

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Changelog

Sourced from starlette's changelog.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Commits

• 2269e9a Version 1.7.0 (#3575)
• 4fe55eb Preserve FileResponse status for range requests (#3568)
• 1f08daf Mark OpenTelemetryMiddleware as experimental (#3574)
• 57de5fa Support HTTP response trailers in TestClient (#3563)
• 03f12b7 Allow HTTPException to use non-standard status codes (#3545)
• 76fd00f Reject WebSocket requests to StaticFiles (#3532)
• f03f65c docs: fix 'its not available' and 'This ensure' wording (#3526)
• 485aca4 docs: the test client is built on httpx2, not httpx (#3525)
• fd662b1 Implement identity on SimpleUser and UnauthenticatedUser (#3271)
• 41db6a7 Stabilize CodSpeed upload buffer allocations (#3524)
• Additional commits viewable in compare view

Updates numpy from 2.4.6 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

• Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

  (gh-32296)

• MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

  (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Charles Harris
• Iason Krommydas
• James Davies +
• Joren Hammudoglu
• Maanas Arora
• Matti Picus
• Nathan Goldbaum
• Shikhar Goel +
• Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

• #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits

• dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
• edcac6a REL: Prepare for the NumPy 2.5.3 release
• fd4d908 Merge pull request #32509 from charris/backport-32496
• 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
• 294956e Merge pull request #32506 from charris/backport-32503
• 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
• 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
• 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
• 8972f70 Merge pull request #32478 from charris/backport-32466
• ab1b589 Merge pull request #32477 from charris/backport-32423
• Additional commits viewable in compare view

Updates pandas from 2.3.2 to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

... (truncated)

Commits

• 2905718 RLS: 3.0.6
• 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
• f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
• 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
• e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
• b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
• bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
• bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
• c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
• 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates httpx to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

0.27.2 (27th August, 2024)

Fixed

• Reintroduced supposedly-private URLTypes shortcut. (#2673)

0.27.1 (27th August, 2024)

Added

• Support for zstd content decoding using the python zstandard package is added. Installable using httpx[zstd]. (#3139)

Fixed

• Improved error messaging for InvalidURL exceptions. (#3250)
• Fix app type signature in ASGITransport. (#3109)

0.27.0 (21st February, 2024)

... (truncated)

Commits

• 26d48e0 Version 0.28.1 (#3445)
• 89599a9 Fix verify=False, cert=... case. (#3442)
• 8ecb86f Add test for request params behavior changes (#3364) (#3440)
• 0cb7e5a Bump the python-packages group with 11 updates (#3434)
• 15e21e9 Updating deprecated docstring Client() class (#3426)
• 80960fa Version 0.28.0. (#3419)
• a33c878 Fix extensions type annotation. (#3380)
• ce7e14d Error on verify as str. (#3418)
• 47f4a96 Handle empty zstd responses (#3412)
• 189fc4b Update CHANGELOG.md, fix typo(s) (#3406)
• Additional commits viewable in compare view

Updates pyyaml to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

6.0.2 (2024-08-06)

• yaml/pyyaml#808 -- Support for Cython 3.x and Python 3.13

6.0.1 (2023-07-18)

• yaml/pyyaml#702 -- pin Cython build dep to < 3.0

6.0 (2021-10-13)

• yaml/pyyaml#327 -- Change README format to Markdown
• yaml/pyyaml#483 -- Add a test for YAML 1.1 types
• yaml/pyyaml#497 -- fix float resolver to ignore . and ._
• yaml/pyyaml#550 -- drop Python 2.7
• yaml/pyyaml#553 -- Fix spelling of “hexadecimal”
• yaml/pyyaml#556 -- fix representation of Enum subclasses
• yaml/pyyaml#557 -- fix libyaml extension compiler warnings
• yaml/pyyaml#560 -- fix ResourceWarning on leaked file descriptors
• yaml/pyyaml#561 -- always require Loader arg to yaml.load()
• yaml/pyyaml#564 -- remove remaining direct distutils usage

5.4.1 (2021-01-20)

• yaml/pyyaml#480 -- Fix stub compat with older pyyaml versions that may unwittingly load it

5.4 (2021-01-19)

• yaml/pyyaml#407 -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA
• yaml/pyyaml#472 -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
• yaml/pyyaml#441 -- Fix memory leak in implicit resolver setup
• yaml/pyyaml#392 -- Fix py2 copy support for timezone objects
• yaml/pyyaml#378 -- Fix compatibility with Jython

5.3.1 (2020-03-18)

• yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor

5.3 (2020-01-06)

• yaml/pyyaml#290 -- Use is instead of equality for comparing with None
• yaml/pyyaml#270 -- Fix typos and stylistic nit
• yaml/pyyaml#309 -- Fix up small typo
• yaml/pyyaml#161 -- Fix handling of slots
• yaml/pyyaml#358 -- Allow calling add_multi_constructor with None
• yaml/pyyaml#285 -- Add use of safe_load() function in README
• yaml/pyyaml#351 -- Fix reader for Unicode code points over 0xFFFF

... (truncated)

Commits

• 49790e7 Release 6.0.3 (#889)
• 41309b0 Release 6.0.2 (#819)
• dd9f0e1 6.0.2rc1 (#809)
• f5527a2 disable CI trigger on PR edits
• b4d80a7 Python 3.12 + musllinux_1_1_x86_64 wheel support
• c42fa3b 6.0.1 release
• ae08bdc block Cython 3.0+ as a build dep (#702)
• f873cfe Add python 3.11 support (#663)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.