chore(deps): update all dependencies

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
alembic (changelog)	==1.16.5 → ==1.18.1
certifi	==2025.10.5 → ==2026.1.4
charset-normalizer (changelog)	==3.4.3 → ==3.4.4
click (changelog)	==8.3.0 → ==8.3.1
geoalchemy2 (source)	==0.18.0 → ==0.18.1
google-api-core	==2.25.2 → ==2.29.0
google-auth	==2.41.1 → ==2.47.0
google-cloud-bigquery	==3.38.0 → ==3.40.0
google-cloud-core	==2.4.3 → ==2.5.0
google-cloud-testutils	==1.6.4 → ==1.7.0
google-crc32c	==1.7.1 → ==1.8.0
google-resumable-media	==2.7.2 → ==2.8.0
googleapis-common-protos (source)	==1.70.0 → ==1.72.0
greenlet (changelog)	==3.2.4 → ==3.3.0
grpcio (source)	==1.75.1 → ==1.76.0
grpcio-status	==1.75.1 → ==1.76.0
idna (changelog)	==3.10 → ==3.11
iniconfig	==2.1.0 → ==2.3.0
packaging	==25.0 → ==26.0
proto-plus	==1.26.1 → ==1.27.0
protobuf	==6.32.1 → ==6.33.4
pyparsing	==3.2.5 → ==3.3.2

---

Release Notes

certifi/python-certifi (certifi)

v2026.1.4

Compare Source

v2025.11.12

Compare Source

jawah/charset_normalizer (charset-normalizer)

v3.4.4

Compare Source

Changed

• Bound setuptools to a specific constraint setuptools>=68,<=81.
• Raised upper bound of mypyc for the optional pre-built extension to v1.18.2

Removed

• setuptools-scm as a build dependency.

Misc

• Enforced hashes in dev-requirements.txt and created ci-requirements.txt for security purposes.
• Additional pre-built wheels for riscv64, s390x, and armv7l architectures.
• Restore multiple.intoto.jsonl in GitHub releases in addition to individual attestation file per wheel.

pallets/click (click)

v8.3.1

Compare Source

Released 2025-11-15

• Don't discard pager arguments by correctly using subprocess.Popen. :issue:3039
  :pr:3055
• Replace Sentinel.UNSET default values by None as they're passed through
  the Context.invoke() method. :issue:3066 :issue:3065 :pr:3068
• Fix conversion of Sentinel.UNSET happening too early, which caused incorrect
  behavior for multiple parameters using the same name. :issue:3071 :pr:3079
• Hide Sentinel.UNSET values as None when looking up for other parameters
  through the context inside parameter callbacks. :issue:3136 :pr:3137
• Fix rendering when prompt and confirm parameter prompt_suffix is
  empty. :issue:3019 :pr:3021
• When Sentinel.UNSET is found during parsing, it will skip calls to
  type_cast_value. :issue:3069 :pr:3090

geoalchemy/geoalchemy2 (geoalchemy2)

v0.18.1

Compare Source

• Fix: Allow scientific notation within WKT string - @​autermann (#​573)
• Fix (mysql): Fix failing test for MySQL dialect - @​adrien-berchet (#​567)

googleapis/python-api-core (google-api-core)

v2.29.0

Compare Source

Features

• Auto enable mTLS when supported certificates are detected (#​869) (f8bf6f9610f3e0e7580f223794c3906513e1fa73)
• make parse_version_to_tuple public (#​864) (c969186f2b66bde1df5e25bbedc5868e27d136f9)

Bug Fixes

• flaky tests due to imprecision in floating point calculation and performance test setup (#​865) (93404080f853699b9217e4b76391a13525db4e3e)
• remove call to importlib.metadata.packages_distributions() for py38/py39 (#​859) (628003e217d9a881d24f3316aecfd48c244a73f0)
• Log version check errors (#​858) (6493118cae2720696c3d0097274edfd7fe2bce67)
• closes tailing streams in bidi classes. (#​851) (c97b3a004044ebf8b35c2a7ba97409d7795e11b0)

v2.28.1

Compare Source

Bug Fixes

• Remove dependency on packaging and pkg_resources (#​852) (ca59a86)

v2.28.0

Compare Source

Features

• Provide and use Python version support check (#​832) (d36e896)

v2.27.0

Compare Source

Features

• Support for async bidi streaming apis (#​836) (9530548)

v2.26.0

Compare Source

Features

• Add trove classifier for Python 3.14 (#​842) (43690de)

googleapis/google-auth-library-python (google-auth)

v2.47.0

Compare Source

Features

• drop cachetools dependency in favor of simple local implementation (#​1590) (5c07e1c4f52bc77a1b16fa3b7b3c5269c242f6f4)

Bug Fixes

• Python 3.8 support (#​1918) (60dc20014a35ec4ba71e8065b9a33ecbdbeca97a)

v2.46.0

Compare Source

Documentation

• update urllib3 docstrings for v2 compatibility (#​1903) (3f1aeea2d1014ea1d244a4c3470e52d74d55404b)

Features

• Recognize workload certificate config in has_default_client_cert_source for mTLS for Agentic Identities (#​1907) (0b9107d573123e358c347ffa067637f992af61b4)

Bug Fixes

• add types to default and verify_token and Request init based on comments in the source code. (#​1588) (59a5f588f7793b59d923a4185c8c07738da618f7)
• fix the document of secure_authorized_session (#​1536) (5d0014707fc359782df5ccfcaa75fd372fe9dce3)
• remove setup.cfg configuration for creating universal wheels (#​1693) (c767531ce05a89002d109f595187aff1fcaacfb7)
• use .read() instead of .content.read() in aiohttp transport (#​1899) (12f4470f808809e8abf1141f98d88ab720c3899b)
• raise RefreshError for missing token in impersonated credentials (#​1897) (94d04e090fdfc61926dd32bc1d65f8820b9cede5)
• Fix test coverage for mtls_helper (#​1886) (02e71631fe275d93825c2e957e830773e75133f7)

v2.45.0

Compare Source

Features

• Adding Agent Identity bound token support and handling certificate mismatches with retries (#​1890) (b32c934e6b0d09b94c467cd432a0a635e8b05f5c)

v2.44.0

Compare Source

Features

• support Python 3.14 (#​1822) (0f7097e78f247665b6ef0287d482033f7be2ed6d)
• add ecdsa p-384 support (#​1872) (39c381a5f6881b590025f36d333d12eff8dc60fc)
• MDS connections use mTLS (#​1856) (0387bb95713653d47e846cad3a010eb55ef2db4c)
• Implement token revocation in STS client and add revoke() metho… (#​1849) (d5638986ca03ee95bfffa9ad821124ed7e903e63)
• Add shlex to correctly parse executable commands with spaces (#​1855) (cf6fc3cced78bc1362a7fe596c32ebc9ce03c26b)

Bug Fixes

• Use public refresh method for source credentials in ImpersonatedCredentials (#​1884) (e0c3296f471747258f6d98d2d9bfde636358ecde)
• Add temporary patch to workload cert logic to accomodate Cloud Run mis-configuration (#​1880) (78de7907b8bdb7b5510e3c6fa8a3f3721e2436d7)
• Delegate workload cert and key default lookup to helper function (#​1877) (b0993c7edaba505d0fb0628af28760c43034c959)

v2.43.0

Compare Source

Features

• Add public wrapper for _mtls_helper.check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#​1859) Add public wrapper for check_use_client_cert which enables mTLS if
  GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert
  sources detected. Also, fix check_use_client_cert to return boolean
  value.
  Change #​1848 added the check_use_client_cert method that helps know if
  client cert should be used for mTLS connection. However, that was in a
  private class, thus, created a public wrapper of the same function so
  that it can be used by python Client Libraries. Also, updated
  check_use_client_cert to return a boolean value instead of existing
  string value for better readability and future scope.
  --------- (1535eccbff0ad8f3fd6a9775316ac8b77dca66ba)
• Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected (#​1848) The Python SDK will use a hybrid approach for mTLS enablement:

• If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is set
  (either true or false), the SDK will respect that setting. This is
  necessary for test scenarios and users who need to explicitly control
  mTLS behavior.
• If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not
  set, the SDK will automatically enable mTLS only if it detects Managed
  Workload Identity (MWID) or X.509 Workforce Identity Federation (WIF)
  certificate sources. In other cases where the variable is not set, mTLS
  will remain disabled.
  ** This change also adds the helper method check_use_client_cert and
  it's unit test, which will be used for checking the criteria for setting
  the mTLS to true
  ** This change is only for Auth-Library, other changes will be created
  for Client-Library use-cases.
  --------- (395e405b64b56ddb82ee639958c2e8056ad2e82b)

• onboard google-auth to librarian (#​1838) This PR onboards google-auth library to the Librarian system.
  Wait for
  #​1819. (c503eaa511357d7a76cc1e1f1d3a3be2dabd5bca)

v2.42.1

Compare Source

Bug Fixes

• Catch ValueError for json.loads() (#​1842) (b074cad)

v2.42.0

Compare Source

Features

• Add trust boundary support for external accounts. (#​1809) (36ecb1d)

Bug Fixes

• Read scopes from ADC json for impersoanted cred (#​1820) (62c0fc8)

googleapis/python-bigquery (google-cloud-bigquery)

v3.40.0

Compare Source

Features

• support load_table and list_rows with picosecond timestamp (#​2351) (46764a59ca7a21ed14ad2c91eb7f98c302736c22)
• support timestamp_precision in table schema (#​2333) (8d5785aea50b9f9e5b13bd4c91e8a08d6dac7778)

v3.39.0

Compare Source

Documentation

• remove experimental annotations from GA features (#​2303) (1f1f9d41e8a2c9016198d848ad3f1cbb88cf77b0)

Features

• adds support for Python runtime 3.14 (#​2322) (6065e14c448cb430189982dd70025fa0575777ca)
• Add ExternalRuntimeOptions to BigQuery routine (#​2311) (fa76e310a16ea6cba0071ff1d767ca1c71514da7)

Bug Fixes

• include io.Base in the PathType (#​2323) (b11e09cb6ee32e451b37eda66bece2220b9ceaba)
• honor custom retry in job.result() (#​2302) (e118b029bbc89a5adbab83f39858c356c23665bf)
• remove ambiguous error codes from query retries (#​2308) (8bbd3d01026c493dfa5903b397d2b01c0e9bf43b)

googleapis/python-cloud-core (google-cloud-core)

v2.5.0

Compare Source

Features

• Add Python 3.14 support (#​333) (c26e587)

Bug Fixes

• Remove setup.cfg configuration for creating universal wheels (#​332) (78ce8a6)
• Resolve issue where pre-release versions of dependencies are installed (#​329) (ab9785d)

googleapis/python-test-utils (google-cloud-testutils)

v1.7.0

Compare Source

Features

• Add Python 3.14 support (#​284) (3cb8491)

googleapis/python-crc32c (google-crc32c)

v1.8.0

Compare Source

Features

• Add support for Python 3.14 (d3118d9)
• Support Python 3.14 (#​315) (49d0a36)

Bug Fixes

• Update toml file with setup.cfg content (#​319) (42e5268)

googleapis/google-resumable-media-python (google-resumable-media)

v2.8.0

Compare Source

Features

• Add support for Python 3.13 and 3.14 (#​485) (9937233ded26924179d717b69df7c76c93f8c133)

Bug Fixes

• remove setup.cfg configuration for creating universal wheels (#​484) (75dbecf8d140483da27dffc970e2e87338e71432)
• resolve issue where pre-release versions of dependencies are installed (#​481) (23dafcf3f216a090a0d0c6941048c7da13cbe496)

googleapis/google-cloud-python (googleapis-common-protos)

v1.72.0: googleapis-common-protos 1.72.0

Compare Source

Features

• add common_resources.proto (#​14851) (e4e0e2a9)

• add field api_version to message ServiceForTransport (#​14843) (81812fde)

v1.71.0: googleapis-common-protos 1.71.0

Compare Source

Features

• add support for Python 3.14 (#​14699) (8b69540b)

grpc/grpc (grpcio)

v1.76.0

Compare Source

This is release 1.76.0 (genuine) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• Prioritize system CA over bundled CA. (#​40583)
• [event_engine] Introduce a event_engine_poller_for_python experiment. (#​40243)
• [metrics] add grpc.lb.backend_service label. (#​40486)

C#

• [csharp tools] #​39374 Grpc.Tools can't process file Suffix name with Upper character. (#​40072)

Python

• [Python] gRPC AsyncIO: Improve CompletionQueue polling performance. (#​39993)

kjd/idna (idna)

v3.11

Compare Source

pytest-dev/iniconfig (iniconfig)

v2.3.0

Compare Source

=====

• add IniConfig.parse() classmethod with strip_inline_comments parameter (fixes #​55)
  • by default (strip_inline_comments=True), inline comments are properly stripped from values
  • set strip_inline_comments=False to preserve old behavior if needed
• IniConfig() constructor maintains backward compatibility (does not strip inline comments)
• users should migrate to IniConfig.parse() for correct comment handling
• add strip_section_whitespace parameter to IniConfig.parse() (regarding #​4)
  • opt-in parameter to strip Unicode whitespace from section names
  • when True, strips Unicode whitespace (U+00A0, U+2000, U+3000, etc.) from section names
  • when False (default), preserves existing behavior for backward compatibility
• clarify Unicode whitespace handling (regarding #​4)
  • since iniconfig 2.0.0 (Python 3 only), all strings are Unicode by default
  • Python 3's str.strip() has handled Unicode whitespace since Python 3.0 (2008)
  • iniconfig automatically benefits from this in all supported versions (Python >= 3.10)
  • key names and values have Unicode whitespace properly stripped using Python's built-in methods

v2.2.0

Compare Source

=====

• drop Python 3.8 and 3.9 support (now requires Python >= 3.10)
• add Python 3.14 classifier
• migrate from hatchling to setuptools 77 with setuptools_scm
• adopt PEP 639 license specifiers and PEP 740 build attestations
• migrate from black + pyupgrade to ruff
• migrate CI to uv and unified test workflow
• automate GitHub releases and PyPI publishing via Trusted Publishing
• include tests in sdist
• modernize code for Python 3.10+ (remove future annotations, TYPE_CHECKING guards)
• rename _ParsedLine to ParsedLine

pypa/packaging (packaging)

v26.0

Compare Source

googleapis/proto-plus-python (proto-plus)

v1.27.0

Compare Source

Features

• Add classifier for Python 3.14 (#​544) (d9f41512648c4551fc3e926649864c5dfe3964b2)

pyparsing/pyparsing (pyparsing)

v3.3.2

Compare Source

• Defined pyparsing-specific warning classes so that they can be selectively enabled
  or disabled without affecting warnings raised by other libraries in the same Python
  app:

  • PyparsingWarning - base warning for all pyparsing-specific warnings (inherits
    from UserWarning)
  • PyparsingDeprecationWarning - warning for using deprecated features (inherits
    from PyparsingWarning and DeprecationWarning)
  • PyparsingDiagnosticWarning - warning raised when pyparsing diagnostics are
    enabled and a diagnostic feature is used (inherits from PyparsingWarning)

• Added as_datetime parse action to pyparsing.common - a more generalized
  version of the convert_to_datetime parse action (supports any expression that extracts
  date/time fields into "year", "month", "day", etc. results names), and validates
  that the parsed fields represent a valid date and time.

• Added iso8601_date_validated and iso8601_datetime_validated expressions to
  pyparsing.common, which return a Python datetime.datetime

• Various performance improvements in ParseResults class and core functions, with
  10-20% performance overall.

• Added regex_inverter web page (using PyScript) to demonstrate using the inv_regex.py
  example.

• Expanded regex forms handled by the examples/inv_regex.py example:

  • named capturing groups (?P<name>)
  • partial repetition ({m,} and {,n})
  • negated character classes ([^...])

• Added SPy (Simplified Python) parser to examples.

v3.3.1

Compare Source

• Added license info to metadata, following PEP-639. Thanks to Gedalia Pasternak and
  Marc Mueller for submitted issue and PR. Fixes #​626.

v3.3.0

Compare Source

===========================================================================================
The version 3.3.0 release will begin emitting DeprecationWarnings for pyparsing methods
that have been renamed to PEP8-compliant names (introduced in pyparsing 3.0.0, in August,
2021, with legacy names retained as aliases). In preparation, I added in pyparsing
3.2.2 a utility for finding and replacing the legacy method names with the new names.
This utility is located at pyparsing/tools/cvt_pep8_names.py. This script will scan all
Python files specified on the command line, and if the -u option is selected, will
replace all occurrences of the old method names with the new PEP8-compliant names,
updating the files in place.

Here is an example that converts all the files in the pyparsing /examples directory:

  python -m pyparsing.tools.cvt_pyparsing_pep8_names -u examples/*.py

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.