[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
SQLAlchemy (changelog)	==2.1.5 → ==2.1.6				patch
actions/setup-python (changelog)	5fda3b9 → 6d4fd22			action	digest
alembic (changelog)	==1.20.0 → ==1.20.1				patch
bigquery-magics (source)	==0.15.1 → ==0.15.2				patch
bigquery_magics (source)	==0.15.1 → ==0.15.2				patch
certifi	==2026.10.19 → ==2026.10.23				patch
db-dtypes (source)	==1.8.0 → ==1.9.0				minor
google-api-core	==2.42.0 → ==2.43.0				minor
googleapis-common-protos (source)	==1.75.5 → ==1.76.0				minor
grpc-google-iam-v1	==0.14.5 → ==0.14.6				patch
grpcio	==1.84.0 → ==1.84.1				patch
grpcio-status	==1.84.0 → ==1.84.1				patch
multidict	==7.1.0 → ==7.2.0				minor
pandas (changelog)	==3.0.6 → ==3.1.0				minor
pycparser	==3.11 → ==3.12				minor
python-dateutil	==2.9.0.post0 → ==3.0.0				major
ruff (source, changelog)	==0.17.1 → ==0.17.2				patch
virtualenv (changelog)	==21.14.12 → ==21.14.13				patch

---

Release Notes

googleapis/google-cloud-python (bigquery-magics)

v0.15.2: bigquery-magics: v0.15.2

Compare Source

Features

• support Python 3.15 (8fceef4)

Bug Fixes

• bigquery-magics: wait for graph server startup before returning from init (#​18763) (77e4d66)
• validate Host header in graph_server request handlers (#​17932) (ea7299f)

certifi/python-certifi (certifi)

v2026.10.23

Compare Source

grpc/grpc (grpcio)

v1.84.1

Compare Source

This is release gRPC Core 1.84.1 (gimbal).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [Backport][v1.84.x][security] Update gRPC repo roots. (#​43700)

aio-libs/multidict (multidict)

v7.2.0

Compare Source

=====

(2026-10-23)

7.2.0 drops Python 3.10, fixes a crash in a proxy built without
__init__() and a :exc:MemoryError from a huge __length_hint__(),
and is otherwise a performance release for the C extension: lookups,
adds, updates and deletes each needed a few percent fewer instructions.

Bug fixes

• Stopped a huge __length_hint__() from raising :exc:MemoryError in
  :meth:~multidict.MultiDict.extend, :meth:~multidict.MultiDict.update
  and :meth:~multidict.MultiDict.merge; the C extension capped the room
  it reserved for the hint at the largest table the constructor allocates
  up front -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1767.

• Fixed a segmentation fault when using a :class:~multidict.MultiDictProxy
  or :class:~multidict.CIMultiDictProxy built by __new__() without
  __init__(); __new__() started requiring the proxied multidict, the
  same argument as the constructor -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1782.

Features

• Sped up reading a multidict in the C extension. md[key],
  :meth:~multidict.MultiDict.get and :meth:~multidict.MultiDict.getone
  became up to 7% faster by returning the lookup's result by value instead
  of through a pointer to the caller's local, which had made
  -fstack-protector-strong add a stack canary to every call. On the GIL
  build a :meth:~multidict.MultiDict.get miss became 5% faster and
  key in md inlined its hash table lookup. On the free-threaded build
  :meth:~multidict.MultiDict.getall stopped taking the multidict's lock
  for a multidict without repeated keys, the way
  :meth:~multidict.MultiDict.get already avoided it. len(md.keys())
  and iterating over the keys of a multidict that holds a key more than
  once became 4% to 13% faster -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1775, :issue:1776, :issue:1781, :issue:1800, :issue:1817.

• Sped up building and updating a multidict in the C extension. On the GIL
  build, constructing a multidict from a sequence of pairs needed 8% to 10%
  fewer instructions and :meth:~multidict.MultiDict.update 3.5% to 4.5%
  fewer. On the free-threaded build, building a
  :class:~multidict.MultiDict became up to 14% faster, since a table that
  is both full and unable to hold the new key in its compact form was grown
  and moved in one rebuild, and :meth:~multidict.MultiDict.add,
  md[key] = value for a new key and
  :meth:~multidict.MultiDict.setdefault needed 2% to 3% fewer
  instructions, about 1% fewer on the GIL build. Updating a multidict with
  existing keys needed 1.5% to 2.9% fewer instructions, while adding a new
  key needed about 0.5% more on the GIL build -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1763, :issue:1774, :issue:1780, :issue:1785, :issue:1802.

• Sped up replacing and removing items in the C extension.
  :meth:~multidict.MultiDict.add, :meth:~multidict.MultiDict.getall,
  md[key] = value and del md[key] stopped computing the identity
  of a key that, or whose :class:~multidict.istr canonical form, already
  serves as one, as md[key] did, and checked a
  :class:~multidict.CIMultiDict key holding uppercase letters only once.
  On the GIL build del md[key] needed 4% to 5% fewer instructions,
  md[key] = value about 2% fewer and :meth:~multidict.MultiDict.pop
  1% fewer. Replacing a key that had duplicates needed 0.8% to 1.7% fewer
  instructions, and :meth:~multidict.MultiDict.clear became 6% faster on
  the free-threaded build -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1769, :issue:1770, :issue:1779, :issue:1796, :issue:1809.

Removals and backward incompatible breaking changes

• Dropped support for Python 3.10 as it has reached end of life
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1777.

Improved documentation

• Refreshed the instruction-count tables in the benchmarking reference
  against the current tree -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1816, :issue:1818.

Packaging updates and notes for downstreams

• Added the CPython 3.15 trove classifier and started testing the
  GIL and free-threaded 3.15 builds in CI -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1766.

Contributor-facing changes

• Split the release publishing and signing across four parallel jobs, so
  that each one finishes well within the lifetime of its short-lived PyPI
  upload token -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1768, :issue:1822.

• Changed the clear() benchmarks to clear a thousand prebuilt
  multidicts of 0 to 99 items each, copied outside the measured region,
  since the copy inside the timed loop and the single small table it
  measured made the result swing by up to 19% between runs of the same
  commit -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1784.

• Pinned Hypothesis in the MyPy pre-commit hooks and dropped a
  type: ignore comment from the Hypothesis tests that became unused
  once Hypothesis annotated run_state_machine_as_test(), which failed
  the MyPy lint job -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1820.

• Fixed a test of a huge __length_hint__() failing on 32-bit builds,
  where its 2**40 hint did not fit a Py_ssize_t
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1821.

Miscellaneous internal changes

• Split the C extension's helpers per table kind, so that the lookup
  loops of pop(), popall(), item replacement and update(), the
  table rebuild and the deferred delete of an entry call the helper for
  their own kind instead of testing it again, and moved the choice between
  overwriting and dropping each entry of a repeated key into the per-kind
  loops of update(). Folded helpers with a single caller into that
  caller: choosing the kind of a new table, reading a compact entry's
  identity and hash, filling a new entry, replacing a key's values,
  deleting a key and looking up the first value of a key that needs a
  computed identity. Merged the two per-kind checks for a deleted entry
  into one, and removed the separate watched copies of delete, pop and
  replace, folding the add that follows a missed replace into the replace
  itself -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1771, :issue:1772, :issue:1773, :issue:1786, :issue:1788,
  :issue:1789, :issue:1790, :issue:1792, :issue:1804, :issue:1805,
  :issue:1810, :issue:1811.

• Removed duplicated code from the C extension: the (key, default)
  methods shared their argument parsing and missing-key result, and one
  macro each replaced the copies of the lock-free compact entry match on
  the free-threaded build and of the per-kind dispatch of a single key
  lookup. Turned the watcher record, flush and pending check helpers and
  _growth_rate() into macros, so that a multidict without watchers
  skipped evaluating the event arguments, renamed the lowercase
  function-like macros to upper case, and dropped the leading underscore
  from the watcher functions that the macros call from other headers
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1793, :issue:1794, :issue:1795, :issue:1806, :issue:1807,
  :issue:1808, :issue:1812.

• Adjusted how the C extension spends GCC's inlining budget: marked most
  checks that lead to a raised exception as unlikely, so the compiler
  moves the error paths out of the hot code, kept the event name lookup of
  a failing watcher callback report and the cleanup of a dropped watcher
  event log out of line, and dropped the inline hint from the helpers
  that compute a table's size and that rebuild, build or free a table's
  keys -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1783, :issue:1791, :issue:1801, :issue:1815.

• Moved the C extension's repr() of multidicts, proxies and views and
  its equality comparison out of the hash table header, each into a header
  of its own -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:1778, :issue:1787.

---

pandas-dev/pandas (pandas)

v3.1.0: pandas 3.1.0

Compare Source

We are pleased to announce the release of pandas 3.1.0.
This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

eliben/pycparser (pycparser)

v3.12

Compare Source

dateutil/dateutil (python-dateutil)

v3.0.0

Compare Source

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

• dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #​1130)

Features

• Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #​462, #​1059, gh pr #​1130)
• Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #​1130)
• dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #​1130)

Bugfixes

• tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #​1130)
• tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and zoneinfo.ZoneInfo do. This means that datetime.time objects with such a zone attached are now aware: time(12, tzinfo=tz.gettz("UTC")).isoformat() is now "12:00:00+00:00" rather than "12:00:00". (gh pr #​1130)
• tz.tzfile now infers dst() from the standard time on both sides of each DST period, rather than only the one before it, and does so for each transition rather than for each local time type. This fixes dst() for double summer time (e.g. in Europe/London in the 1940s), for half-hour DST (e.g. in Pacific/Rarotonga) and where the standard offset changed at the same time as a DST transition (e.g. in America/Bahia_Banderas in 2010). Against the standard offsets in the tz database source, the only remaining errors are in Europe/Paris in 1944 and 1945. (gh pr #​1130)
• Fixed rrulestr raising ValueError on experimental X- parameters in an RRULE line (such as GNOME Evolution's X-EVOLUTION-ENDDATE); these are now ignored as RFC 5545 permits. Fixed by @​yajo (gh pr #​1374)
• Enabled pickling and deepcopy of cached rrule and rruleset instances. The cache setting is preserved, and cached results are regenerated on demand without copying locks or generators. Reported by @​niccokunzmann (gh issue #​1369). Fixed by @​Jay1023CN (gh pr #​1600).
• Fixed relativedelta.__ne__ raising TypeError when comparing against an unsupported type such as None; it now returns True. Reported and fixed by @​kevinkt1 (gh issue #​1157, gh pr #​1158)
• Raised the minimum version of six to 1.6, fixing No module named 'six.moves' errors with older versions. Reported by @​skytreader (gh issue #​1415), fixed by @​jdarias3 (gh pr #​1424).

Deprecations

• Deprecated the dateutil.zoneinfo module. The module now acts as a wrapper around the tzdata package and will be removed in a future version. Users are encouraged to migrate to dateutil.tz.gettz or the standard library's zoneinfo module. dateutil.zoneinfo.rebuild.rebuild no longer does anything, and by default raises RebuildDeprecationWarning as an error; filter the warning to call it as a no-op. (gh pr #​1130)
• Deprecated passing gettz a relative key that refers to a file outside of every directory on TZPATH, such as "../../etc/localtime". By default this now raises dateutil.tz.DeprecatedTzKeyWarning as an error; filter the warning to keep the old behavior for now, or pass an absolute path instead. (gh pr #​1130)

Documentation changes

• Added intersphinx to the docs build and cleaned up some broken links. (gh pr #​1463)

Misc

• Releases are now uploaded to PyPI using trusted publishing, and the built sdist and wheel are tested on all supported platforms before upload. (gh pr #​1619, #​1622)
• Changes to CI, tests and release tooling that do not affect users of the package: gh pr #​1417, #​1462, #​1464, #​1465, #​1466, #​1467, #​1468, #​1469, #​1470, #​1499, #​1501, #​1504, #​1576, #​1577, #​1578, #​1581, #​1585.

astral-sh/ruff (ruff)

v0.17.2

Compare Source

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#​25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#​28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#​29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#​29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#​29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#​29413)

Performance

• Avoid intermediate names in lint name resolution (#​29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#​29561)
• Share postfix parsing and reduce expression copies (#​29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#​18961)

Documentation

• Clarify documentation and correct stale guidance (#​29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#​29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

pypa/virtualenv (virtualenv)

v21.14.13

Compare Source

Bugfixes - 21.14.13

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash
  after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1
  (GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now draws the prompt from psvar[9], which is never parsed
  as shell syntax.

  Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence
  check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced.
  (#​3466)

PyPI release

Full Changelog: pypa/virtualenv@21.14.12...21.14.13

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the SQLAlchemy dependency in packages/sqlalchemy-spanner/requirements.txt from version 2.1.5 to 2.1.6, along with updating its associated cryptographic hashes. There are no review comments to address, and I have no additional feedback to provide.