chore(deps): update all dependencies#16475
chore(deps): update all dependencies#16475renovate-bot wants to merge 2 commits intogoogleapis:mainfrom
Conversation
trusted-contributions-gcf
bot
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates various dependencies across multiple packages, including rules_cc, ruff, sphinx, and several Google Cloud libraries. Feedback indicates that the update to google-api-core v2.30.0 in sqlalchemy-spanner drops support for Python 3.8, which may be a breaking change for users on that version.
| google-api-core[grpc]==2.30.0 \ | ||
| --hash=sha256:02edfa9fab31e17fc0befb5f161b3bf93c9096d99aed584625f38065c511ad9b \ | ||
| --hash=sha256:80be49ee937ff9aba0fd79a6eddfde35fe658b9953ab9b79c57dd7061afa8df5 |
There was a problem hiding this comment.
The update to google-api-core==2.30.0 drops support for Python 3.8. According to the release notes for google-api-core v2.30.0, this version requires Python ≥ 3.9. This is a breaking change that will drop support for Python 3.8.
If sqlalchemy-spanner needs to continue supporting Python 3.8, this dependency update should be reverted or pinned to a version compatible with Python 3.8 (e.g., <2.30.0).
renovate-bot
force-pushed
the
renovate/all
branch
from
16cccbf to
6704312
Compare
trusted-contributions-gcf
bot
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
trusted-contributions-gcf
bot
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
3 participants
This PR contains the following updates:
v4→v5v5→v6v4→v6v5→v6==3.13.3→==3.13.4==1.17.0→==1.18.4==25.4.0→==26.1.0==1.4.0→==1.4.2==6.2.6→==7.0.5==6.2.1→==7.0.5==2025.10.5→==2026.2.25==3.4.4→==3.4.6==8.3.0→==8.3.1v3→v4==2.26.0→==2.30.0==2.28.1→==2.30.0==2.41.1→==2.49.1==2.48.0→==2.49.1==2.43.0→==2.49.1==2.4.3→==2.5.0==3.58.0→==3.63.0==1.7.0→==1.7.1==1.71.0→==1.73.1==1.72.0→==1.73.1==1.75.1→==1.80.0==1.76.0→==1.80.0==1.75.1→==1.80.0==8.7.1→==9.0.0==9.10.0→==9.12.0==6.7.0→==6.7.1==25.0→==26.0==2.3.3→==3.0.1==0.8.1→==0.9.0==1.27.1→==1.27.2==1.26.1→==1.27.2==6.33.5→==7.34.1==2.19.2→==2.20.0==1.16→==1.17==9.0.0→==9.0.23.10→3.143.12→3.143.9→3.143.8→3.14==2.32.5→==2.33.0==0.14.14→==0.15.80.1.1→0.2.17==4.5.0→==9.1.0==1.0.4→==2.0.0==1.0.2→==2.0.0==2.0.1→==2.1.0==1.0.3→==2.0.0==1.1.5→==2.0.0==0.5.3→==0.5.5==2.4.0→==2.4.1==2.5.0→==2.6.3==0.45.1→==0.46.3==1.17.3→==2.1.2==1.22.0→==1.23.0Release Notes
actions/cache (actions/cache)
v5Compare Source
actions/checkout (actions/checkout)
v6Compare Source
actions/setup-python (actions/setup-python)
v6Compare Source
aio-libs/aiohttp (aiohttp)
v3.13.4Compare Source
===================
Features
Added
max_headersparameter to limit the number of headers that should be read from a response -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11955.Added a
dns_cache_max_sizeparameter toTCPConnectorto limit the size of the cache -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12106.Bug fixes
Fixed server hanging indefinitely when chunked transfer encoding chunk-size
does not match actual data length. The server now raises
TransferEncodingErrorinstead of waiting forever for data that willnever arrive -- by :user:
Fridayai700.Related issues and pull requests on GitHub:
:issue:
10596.Fixed access log timestamps ignoring daylight saving time (DST) changes. The
previous implementation used :py:data:
time.timezonewhich is a constant anddoes not reflect DST transitions -- by :user:
nightcityblade.Related issues and pull requests on GitHub:
:issue:
11283.Fixed
RuntimeError: An event loop is runningerror when usingaiohttp.GunicornWebWorkeror
aiohttp.GunicornUVLoopWebWorkeron Python >=3.14.-- by :user:
Tasssadar.Related issues and pull requests on GitHub:
:issue:
11701.Fixed :exc:
ValueErrorwhen creating a TLS connection withClientTimeout(total=0)by converting0toNonebefore passing tossl_handshake_timeoutin :py:meth:asyncio.loop.start_tls-- by :user:veeceey.Related issues and pull requests on GitHub:
:issue:
11859.Restored :py:meth:
~aiohttp.BodyPartReader.decodeas a synchronous methodfor backward compatibility. The method was inadvertently changed to async
in 3.13.3 as part of the decompression bomb security fix. A new
:py:meth:
~aiohttp.BodyPartReader.decode_itermethod is now availablefor non-blocking decompression of large payloads using an async generator.
Internal aiohttp code uses the async variant to maintain security protections.
Changed multipart processing chunk sizes from 64 KiB to 256KiB, to better
match aiohttp internals
-- by :user:
bdracoand :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11898.Fixed false-positive :py:class:
DeprecationWarningfor passingenable_cleanup_closed=Trueto :py:class:~aiohttp.TCPConnectorspecifically on Python 3.12.7.-- by :user:
Robsdedude.Related issues and pull requests on GitHub:
:issue:
11972.Fixed _sendfile_fallback over-reading beyond requested count -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12096.Fixed digest auth dropping challenge fields with empty string values -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12097.ClientConnectorCertificateError.os_errorno longer raises :exc:AttributeError-- by :user:
themylogin.Related issues and pull requests on GitHub:
:issue:
12136.Adjusted pure-Python request header value validation to align with RFC 9110 control-character handling, while preserving lax response parser behavior, and added regression tests for Host/header control-character cases.
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12231.Rejected duplicate singleton headers (
Host,Content-Type,Content-Length, etc.) in the C extension HTTP parser to matchthe pure Python parser behaviour, preventing potential host-based
access control bypasses via parser differentials
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12240.Aligned the pure-Python HTTP request parser with the C parser by splitting
comma-separated and repeated
Connectionheader values for keep-alive,close, and upgrade handling -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12249.Improved documentation
Documented :exc:
asyncio.TimeoutErrorforWebSocketResponse.receive()and related methods -- by :user:
veeceey.Related issues and pull requests on GitHub:
:issue:
12042.Packaging updates and notes for downstreams
Upgraded llhttp to 3.9.1 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12069.Contributor-facing changes
The benchmark CI job now runs only in the upstream repository -- by :user:
Cycloctane.It used to always fail in forks, which this change fixed.
Related issues and pull requests on GitHub:
:issue:
11737.Fixed flaky performance tests by using appropriate fixed thresholds that account for CI variability -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
11992.Miscellaneous internal changes
Fixed
test_invalid_idnato work withidna3.11 by using an invalid character (\u0080) that is rejected byyarlduring URL construction -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12027.Fixed race condition in
test_data_fileon Python 3.14 free-threaded builds -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12170.python-attrs/attrs (attrs)
v26.1.0Compare Source
Backwards-incompatible Changes
field_transformer, so transformers receive fully populatedAttributeobjects with usablealiasvalues instead ofNone.The new
Attribute.alias_is_defaultflag indicates whether the alias was auto-generated (True) or explicitly set by the user (False).#1509
Changes
attrs.validators.optional(), so it no longer rejects tuples with more than one validator.#1496
attrs.validators.disabled()contextmanager can now be nested.#1513
on_setattr=attrs.setters.NO_OPin addition toNone.#1515
attrs.fields().#1529
pypa/build (build)
v1.4.2Compare Source
What's Changed
New Contributors
Full Changelog: pypa/build@1.4.1...1.4.2
v1.4.1Compare Source
What's Changed
Full Changelog: pypa/build@1.4.0...1.4.1
certifi/python-certifi (certifi)
v2026.2.25Compare Source
v2026.1.4Compare Source
v2025.11.12Compare Source
jawah/charset_normalizer (charset-normalizer)
v3.4.6Compare Source
Changed
charset_normalizer.mdfor higher performance. Removedeligible(..)andfeed(...)in favor of
feed_info(...).UNICODE_RANGES_COMBINEDusing Unicode blocks v17.Fixed
--normalizewriting to wrong path when passing multiple files in. (#702)Misc
v3.4.5Compare Source
Changed
setuptoolsconstraint tosetuptools>=68,<=82.Fixed
Misc
query_yes_nofunction (inside CLI) to avoid using ambiguous licensed code.cd.pysubmodule into mypyc optional compilation to reduce further the performance impact.pallets/click (click)
v8.3.1Compare Source
Released 2025-11-15
subprocess.Popen. :issue:3039:pr:
3055Sentinel.UNSETdefault values byNoneas they're passed throughthe
Context.invoke()method. :issue:3066:issue:3065:pr:3068Sentinel.UNSEThappening too early, which caused incorrectbehavior for multiple parameters using the same name. :issue:
3071:pr:3079Sentinel.UNSETvalues asNonewhen looking up for other parametersthrough the context inside parameter callbacks. :issue:
3136:pr:3137promptandconfirmparameterprompt_suffixisempty. :issue:
3019:pr:3021Sentinel.UNSETis found during parsing, it will skip calls totype_cast_value. :issue:3069:pr:3090dorny/paths-filter (dorny/paths-filter)
v4Compare Source
googleapis/google-cloud-python (google-api-core)
v2.30.0: google-api-core: v2.30.0Compare Source
Bug Fixes
v2.29.0v2.28.1v2.28.0v2.27.0: google-cloud-secret-manager: v2.27.0v2.27.0 (2026-03-26)
googleapis/google-auth-library-python (google-auth)
v2.48.0Compare Source
Features
NO_GCE_CHECKenvironment variable (#1610) (383c9827536d9376e8248370ce4c2b83e468d027)Bug Fixes
content-headerfrom AWS IMDS get request (#1934) (97bfea9e02ede953fc8ee154e0deed3a3cfc6dcc)user_verification=preferredfor ReAuth WebAuthn challenge (#1798) (3f88a24089c4ee6822d510de0db210b54260d873)v2.47.0Compare Source
Features
cachetoolsdependency in favor of simple local implementation (#1590) (5c07e1c4f52bc77a1b16fa3b7b3c5269c242f6f4)Bug Fixes
v2.46.0Compare Source
Documentation
Features
Bug Fixes
v2.45.0Compare Source
Features
v2.44.0Compare Source
Features
Bug Fixes
v2.43.0Compare Source
Features
GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert
sources detected. Also, fix check_use_client_cert to return boolean
value.
Change #1848 added the check_use_client_cert method that helps know if
client cert should be used for mTLS connection. However, that was in a
private class, thus, created a public wrapper of the same function so
that it can be used by python Client Libraries. Also, updated
check_use_client_cert to return a boolean value instead of existing
string value for better readability and future scope.
--------- (1535eccbff0ad8f3fd6a9775316ac8b77dca66ba)
(either true or false), the SDK will respect that setting. This is
necessary for test scenarios and users who need to explicitly control
mTLS behavior.
set, the SDK will automatically enable mTLS only if it detects Managed
Workload Identity (MWID) or X.509 Workforce Identity Federation (WIF)
certificate sources. In other cases where the variable is not set, mTLS
will remain disabled.
** This change also adds the helper method
check_use_client_certandit's unit test, which will be used for checking the criteria for setting
the mTLS to true
** This change is only for Auth-Library, other changes will be created
for Client-Library use-cases.
--------- (395e405b64b56ddb82ee639958c2e8056ad2e82b)
google-authto librarian (#1838) This PR onboardsgoogle-authlibrary to the Librarian system.Wait for
#1819. (c503eaa511357d7a76cc1e1f1d3a3be2dabd5bca)
v2.42.1Compare Source
Bug Fixes
v2.42.0Compare Source
Features
Bug Fixes
googleapis/python-cloud-core (google-cloud-core)
v2.5.0Compare Source
Features
Bug Fixes
googleapis/python-spanner (google-cloud-spanner)
v3.63.0Compare Source
Documentation
Features
Bug Fixes
v3.62.0Compare Source
Features
Bug Fixes
v3.61.0Compare Source
Features
v3.60.0Compare Source
Documentation
Features
Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.