Skip to content

ci: bump the python group across 1 directory with 9 updates - #8

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-9bb25e4c91
Open

ci: bump the python group across 1 directory with 9 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-9bb25e4c91

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on clickhouse-connect, fastapi, starlette, uvicorn, numpy, pandas, pytest, httpx and pyyaml to permit the latest version.
Updates clickhouse-connect from 0.8.18 to 1.10.0

Release notes

Sourced from clickhouse-connect's releases.

v1.10.0

clickhouse-connect v1.10.0

Rust codec performance

  • NumPy and Pandas queries no longer require PyArrow. This covers buffered and streamed results and query(..., use_numpy=True). Strings use Arrow conversion when available and Rust object conversion otherwise. Invalid UTF-8 keeps its hex rendering. Explicit Arrow output and Arrow storage still require PyArrow.
  • Supported numeric, Boolean, BFloat16, Interval, date, timestamp, and time columns now convert directly from decoded buffers. Selected nullable, Array, and LowCardinality shapes also use this path. Existing output dtypes stay unchanged, apart from the nanosecond correction described below.
  • Large response chunks now feed the decoder in bounded slices, reducing temporary copies and peak memory for large NumPy, Pandas, and Python results.

Client improvements

  • DB-API connections and cursors now support with blocks. They close on normal and exceptional exit. Connection contexts don't manage transactions thus commit() and rollback() are still no-ops.
  • Async Arrow inserts move DataFrame conversion and Arrow encoding to a dedicated client worker, reducing event-loop stalls. #1054
  • Large async external-data uploads use bounded writes to reduce event-loop stalls during TLS encryption. Upload payloads are replayable for eligible retries. #1057

Query and insert fixes

  • QueryResult.result_rows works after materializing result_columns, including async queries with column_oriented=True.
  • Dynamic shared-storage values and JSON paths beyond max_dynamic_types decode supported compound and scalar values to Python objects. Nullable defaults and typed JSON null paths work, and DataFrame results retain the decoded objects. #1070
  • Internal DESCRIBE TABLE requests get their own query ID. Inserts retain the caller's ID, avoiding QUERY_WITH_SAME_ID_IS_ALREADY_RUNNING errors. #1066
  • After a remote close or HTTP 429/503/504, SQL execution retries only recognized reads. Writes, DDL, mutations, SET, USE, and CHECK TABLE aren't replayed. This also applies through DB-API and SQLAlchemy. Read retries and insert API retries are still available. #1079

Streaming and temporal fixes

  • Synchronous Native response cleanup waits for active reads and drains partially consumed HTTP chunks through the same parser. Early Rust stream closure drains the response before releasing its iterator, avoiding premature closure and subsequent SESSION_IS_LOCKED errors.
  • Rust cleanup releases each response source once, handles closure during read-ahead startup, and releases decoder workers after cancelled pending reads.
  • Async Rust stream cleanup finishes before cancellation is re-raised.
  • Rust NumPy and Pandas results preserve nanoseconds in nullable scalar DateTime64(9) columns, including SimpleAggregateFunction aliases. Unsupported scalar precisions now fail consistently.
  • Nullable SimpleAggregateFunction aliases of Time64 return correct durations and NaT for NULL values.

SQLAlchemy and Alembic fixes

  • Importing the dialect preserves another provider's clickhouse:// registration. Generated schema metadata and Alembic revisions use clickhousedb_* options so copies and migrations work with both drivers installed. #1074
  • GROUP BY uses aliases only for matching top-level expressions selected by the query. Unselected and nested expressions render in full. #1062
  • Nullable() and LowCardinality() preserve the wrapped type in their return annotations. #1033
  • Alembic accepts reflected AggregateFunction state versions when metadata omits the version, including nested types. Explicit versions still detect changes; legacy unversioned states match explicit version 0.

Installation

pip install clickhouse-connect

For the experimental Rust codec:

pip install "clickhouse-connect[rust]"

The Rust extra requires clickhouse-connect-core>=0.2.1,<0.3. The driver checks both binding and column-buffer APIs and reports upgrade guidance for older wheels.

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.10.0, 2026-10-07

Improvements

  • The DB-API Connection and Cursor now support the context manager protocol, so with connect(...) as connection: and with connection.cursor() as cursor: work. Both call close() when the block exits, including when it raises. Connection contexts don't manage transactions. The DB-API commit and rollback remain no-ops.
  • Rust codec NumPy and Pandas queries no longer require PyArrow. This includes buffered and streamed results and query(..., use_numpy=True). Pandas strings use the Arrow conversion when PyArrow is installed and the Rust object conversion otherwise. Invalid UTF-8 keeps its existing hex rendering. Explicit Arrow storage and Arrow methods still require PyArrow.
  • The Rust codec now converts non-nullable 8-64-bit integers, Float32/64, Boolean, BFloat16, Interval, Date/Date32, DateTime/DateTime64, and Time/Time64 columns to NumPy/Pandas directly from its decoded buffers. Nullable BFloat16 and Time/Time64 also use direct buffers, as do arrays of Time/Time64 and LowCardinality(Time). Extended Pandas nullable integer, float, and Interval output uses direct buffers as well. Output dtypes are unchanged.
  • The Rust codec now feeds large response chunks to the decoder in bounded slices. This reduces temporary decoder copies and the number of decoded blocks held during conversion, lowering peak memory for large query_np, query_df, and query() results. Output is unchanged.

Bug Fixes

  • Alembic autogeneration now accepts server-pinned AggregateFunction state versions when metadata omits the version, including nested types. Explicit metadata versions still detect state version changes. Reflected legacy states match an explicit version 0.
  • Importing the SQLAlchemy dialect no longer replaces another provider's clickhouse:// registration, including clickhouse-sqlalchemy. Generated schema metadata and Alembic revisions use clickhousedb_* options so metadata copies and migrations work with both packages installed. Closes #1074.
  • QueryResult.result_rows now works after reading result_columns. Previously, accessing rows after materializing columns raised StreamClosedError even though the data was already cached. This also affected AsyncClient.query() with column_oriented=True, where result_rows always failed.
  • After a remote connection close or HTTP 429/503/504, command(), query(), raw_query(), and raw_stream() now replay only statements the client recognizes as reads. Other statements, including SQL writes, DDL, mutations, SET, USE, and CHECK TABLE, are not replayed. This also covers their DB-API and SQLAlchemy wrappers. Read retries and retries through the insert APIs, including raw_insert(), remain available. Insert retries provide at-least-once delivery and can duplicate rows without server deduplication. Closes #1079.
  • Values in Dynamic shared storage, including JSON paths that exceed max_dynamic_types, now decode to Python objects instead of encoded bytes or strings. This covers supported arrays, tuples, maps, nested JSON, and date, time, UUID and IP address scalars, including nullable defaults and typed JSON null paths. DataFrame results keep the decoded objects. Closes #1070.
  • Inserts that resolve column types from the server now give the internal DESCRIBE TABLE its own server-generated query ID. The INSERT retains the caller's query_id from per-call settings or client defaults. This prevents QUERY_WITH_SAME_ID_IS_ALREADY_RUNNING errors when the server hasn't yet released the finished DESCRIBE. Closes #1066.
  • Closing a synchronous Native-format HTTP response now waits for an active read before draining it, including Rust codec reads that outlast read-ahead shutdown. Cleanup also finishes partially consumed HTTP chunks with the same parser. This prevents concurrent response reads, premature connection closure, and SESSION_IS_LOCKED errors on the next query.
  • AsyncClient now awaits response cleanup when a Rust codec stream closes, including when its consumer is cancelled. Cleanup finishes before cancellation is re-raised.
  • SQLAlchemy Nullable() and LowCardinality() now preserve the wrapped type in their return annotations. Column declarations such as Column("hostname", LowCardinality(String)) now pass strict type checking. Runtime behavior is unchanged. Closes #1033.
  • SQLAlchemy GROUP BY now uses aliases only for top-level labels that match an expression selected by the current query. Unselected and nested expressions render in full. Selected aliases, including independently rebuilt matching expressions, retain their names. This fixes unknown-identifier errors and incorrect grouping when a label collides with another column. Closes #1062.
  • Async insert_arrow and insert_df_arrow now run DataFrame conversion and Arrow encoding in a dedicated worker owned by the client. This reduces event-loop stalls during large inserts. Closes #1054.
  • Closing a Rust codec stream during read-ahead startup no longer lets a producer read from an already closed source. This applies to sync and async cleanup.
  • Closing a sync Rust codec stream early now drains its HTTP response before releasing the response iterator. This fixes premature connection closure that could make the next query on the same client fail with SESSION_IS_LOCKED.
  • Concurrent sync and async cleanup of a Rust codec stream now releases its response source only once.
  • Cancelling a pending Rust codec stream read now releases the waiting decoder worker. Previously, closing the stream could leave a worker blocked and hang async executor shutdown.
  • Rust codec NumPy and Pandas queries now preserve nanoseconds in nullable scalar DateTime64(9) columns, including SimpleAggregateFunction aliases. They also reject unsupported scalar DateTime64 precisions consistently for nullable columns and aliases.
  • Rust codec NumPy and Pandas queries now return correct durations and NaT for NULL values in Nullable(SimpleAggregateFunction(..., Time64)) columns. Previously, columns with NULLs returned floating-point bit patterns interpreted as durations.
  • Large async external-data uploads now use bounded writes to avoid long event-loop stalls during TLS encryption. Closes #1057.

Compatibility

  • When clickhouse-sqlalchemy is installed, use clickhousedb:// or clickhousedb+connect:// for ClickHouse Connect. Bare clickhouse:// remains with its existing provider; the ClickHouse Connect alias is still available when no other provider claims it. In mixed installs, cc-only schema options such as clickhouse_engine, clickhouse_ttl, clickhouse_settings, and clickhouse_dictionary_* must use the clickhousedb_ prefix. Custom schema defaults for ClickHouse Connect should use Table.argument_for("clickhousedb", ...) or Column.argument_for("clickhousedb", ...). Newly generated schema metadata and Alembic revisions use clickhousedb_* option names. In cc-only installs, table.kwargs["clickhouse_engine"] now returns None after a positional engine or table reflection; read clickhousedb_engine instead, and read generated Dictionary options through their clickhousedb_* keys. Public reflection dictionaries retain their existing clickhouse_* keys.
  • Type checkers now infer list[String] for [Nullable(String)]. If a collection also holds other ClickHouse types, annotate it as list[ChSqlaType] from clickhouse_connect.cc_sqlalchemy.datatypes.base.
  • Rust NumPy object columns for nullable scalar DateTime64(9) now contain numpy.datetime64 cells at UTC nanosecond resolution instead of Python datetime cells. SQL NULL stays None. Use query_df to retain named timezone metadata. Pandas datetime output now uses nanoseconds instead of Pandas 3's microseconds, while existing object dtypes from all-null blocks remain.
  • The Rust extra now requires clickhouse-connect-core>=0.2.1,<0.3. Rust codec setup checks the column buffer API separately from the binding API and reports upgrade guidance for older core wheels. See the core 0.2.1 release notes.

1.9.0, 2026-09-21

This stable release includes all changes from 1.9.0rc1, 1.9.0rc2, and 1.9.0rc3. See those entries below for the full async SQLAlchemy feature set, Rust codec performance improvements, and fixes included in 1.9.0.

Improvements

  • Added native async SQLAlchemy support for SQLAlchemy 2.0.44 and later. Install clickhouse-connect[sqlalchemy-async] and use clickhousedb+async:// with create_async_engine(). It supports buffered Core and ORM execution, DDL and reflection through run_sync(), and async Alembic environments. Use the native AsyncClient for streaming and bulk inserts. Closes #576.
  • Native Map reads now support the opt-in pairs format, which returns a list of key/value tuples and preserves duplicate keys and the sequence returned by the server. The default remains a dictionary. The format also applies to nested Maps and NumPy/Pandas results. Native Map inserts still require dictionaries and raise DataError for pair lists. Closes #949.

Bug Fixes

  • Rust codec read-ahead threads now close their source iterator explicitly when they stop. Early stream cleanup no longer depends on prompt garbage collection, which can delay cleanup on free-threaded Python.
  • Arrow insert_arrow / insert_df_arrow now quote table and database identifiers the same way insert() does, so hyphenated and other names that need backquotes work on both the sync and async clients. Closes #1014.

... (truncated)

Commits
  • 090fb9a Release/1.10.0 (#1085)
  • fec4e57 Fix Alembic comparison of server-pinned aggregate state versions (#1084)
  • 6d73879 Fix SQLAlchemy dialect coexistence with clickhouse-sqlalchemy (#1082)
  • a104e28 Fix row access after materializing query result columns (#1081)
  • 08131dc Restrict HTTP retries to recognized reads and insert data (#1080)
  • 122edfe Fix free-threaded insert concurrency test timeouts (#1078)
  • 4c25bc1 release prep for core 0.2.2 (#1077)
  • cac10b2 Fix Rust insert crashes on free-threaded Python (#1076)
  • c9f8139 Fix decoding of Dynamic shared values (#1071)
  • 8d3fe7b Keep the insert query_id off the internal DESCRIBE TABLE (#1067)
  • Additional commits viewable in compare view

Updates fastapi from 0.141.1 to 0.142.4

Release notes

Sourced from fastapi's releases.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

0.142.2

Fixes

... (truncated)

Commits

Updates starlette from 1.6.0 to 1.7.0

Release notes

Sourced from starlette's releases.

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
  • Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

  • Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
  • Return 400 for invalid multipart parser input #3492.
  • Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
  • Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
  • Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
  • Handle standalone If-None-Match: * in StaticFiles #3201.
  • Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
  • Persist session mutations made with popitem() and |= #3436.
  • Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
  • Implement identity on SimpleUser and UnauthenticatedUser #3271.
  • Allow HTTPException to use non-standard status codes without an explicit detail #3545.
  • Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
  • Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Changelog

Sourced from starlette's changelog.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
  • Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

  • Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
  • Return 400 for invalid multipart parser input #3492.
  • Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
  • Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
  • Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
  • Handle standalone If-None-Match: * in StaticFiles #3201.
  • Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
  • Persist session mutations made with popitem() and |= #3436.
  • Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
  • Implement identity on SimpleUser and UnauthenticatedUser #3271.
  • Allow HTTPException to use non-standard status codes without an explicit detail #3545.
  • Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
  • Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.
Commits
  • 2269e9a Version 1.7.0 (#3575)
  • 4fe55eb Preserve FileResponse status for range requests (#3568)
  • 1f08daf Mark OpenTelemetryMiddleware as experimental (#3574)
  • 57de5fa Support HTTP response trailers in TestClient (#3563)
  • 03f12b7 Allow HTTPException to use non-standard status codes (#3545)
  • 76fd00f Reject WebSocket requests to StaticFiles (#3532)
  • f03f65c docs: fix 'its not available' and 'This ensure' wording (#3526)
  • 485aca4 docs: the test client is built on httpx2, not httpx (#3525)
  • fd662b1 Implement identity on SimpleUser and UnauthenticatedUser (#3271)
  • 41db6a7 Stabilize CodSpeed upload buffer allocations (#3524)
  • Additional commits viewable in compare view

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates numpy from 2.4.6 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

  • Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

    (gh-32296)

  • MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

    (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Iason Krommydas
  • James Davies +
  • Joren Hammudoglu
  • Maanas Arora
  • Matti Picus
  • Nathan Goldbaum
  • Shikhar Goel +
  • Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

  • #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits
  • dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
  • edcac6a REL: Prepare for the NumPy 2.5.3 release
  • fd4d908 Merge pull request #32509 from charris/backport-32496
  • 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
  • 294956e Merge pull request #32506 from charris/backport-32503
  • 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
  • 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
  • 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
  • 8972f70 Merge pull request #32478 from charris/backport-32466
  • ab1b589 Merge pull request #32477 from charris/backport-32423
  • Additional commits viewable in compare view

Updates pandas from 2.3.2 to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

... (truncated)

Commits
  • 2905718 RLS: 3.0.6
  • 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
  • f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
  • 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
  • e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
  • b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
  • bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
  • bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
  • c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
  • 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
  • Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.
Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates httpx to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.
Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 4, 2026
@dependabot
ci: bump the python group across 1 directory with 9 updates
6099acc 
Updates the requirements on [clickhouse-connect](https://github.com/ClickHouse/clickhouse-connect), [fastapi](https://github.com/fastapi/fastapi), [starlette](https://github.com/Kludex/starlette), [uvicorn](https://github.com/Kludex/uvicorn), [numpy](https://github.com/numpy/numpy), [pandas](https://github.com/pandas-dev/pandas), [pytest](https://github.com/pytest-dev/pytest), [httpx](https://github.com/encode/httpx) and [pyyaml](https://github.com/yaml/pyyaml) to permit the latest version.

Updates `clickhouse-connect` from 0.8.18 to 1.10.0
- [Release notes](https://github.com/ClickHouse/clickhouse-connect/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-connect/blob/main/CHANGELOG.md)
- [Commits](ClickHouse/clickhouse-connect@v0.8.18...v1.10.0)

Updates `fastapi` from 0.141.1 to 0.142.4
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.142.4)

Updates `starlette` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.6.0...1.7.0)

Updates `uvicorn` from 0.53.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.53.0...0.54.0)

Updates `numpy` from 2.4.6 to 2.5.3
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.6...v2.5.3)

Updates `pandas` from 2.3.2 to 3.0.6
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v2.3.2...v3.0.6)

Updates `pytest` to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@7.0.0...9.1.1)

Updates `httpx` to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.0...0.28.1)

Updates `pyyaml` to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0...6.0.3)

---
updated-dependencies:
- dependency-name: clickhouse-connect
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: httpx
  dependency-version: 0.28.1
  dependency-type: direct:development
  dependency-group: python
- dependency-name: numpy
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  dependency-group: python
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:development
  dependency-group: python
- dependency-name: starlette
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-9bb25e4c91 branch from e076c16 to 6099acc Compare October 11, 2026 04:24

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants