Skip to content

chore(deps): bump the dependencies group across 1 directory with 7 updates - #56

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dependencies-1067f118bc
Open

chore(deps): bump the dependencies group across 1 directory with 7 updates#56
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dependencies-1067f118bc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on boto3, requests-aws4auth, requests, aws-cdk-lib, python-dotenv, pandas and pyarrow to permit the latest version.
Updates boto3 from 1.43.71 to 1.43.111

Commits

Updates requests-aws4auth from 1.3.2 to 1.4.0

Release notes

Sourced from requests-aws4auth's releases.

v1.4.0

What's Changed

Bugfixes

  • Sign the Host header that is actually sent. The port is now kept unless it is the default for the scheme (80 for http, 443 for https), fixing SignatureDoesNotMatch on non-default ports with requests, #79 #34, via #81. This re-applies the fix from #63, which 1.2.2 reverted after #65.
  • IPv6 literal hosts such as https://[::1] are signed correctly; previously the host was signed as [.
  • Credentials embedded in the URL (https://user:pass@host) are no longer signed as the host.

Changes

  • Fix the inverted assertion in the non-standard port test from #68.
  • Integration tests against MinIO and RadosGW on non-default ports, run in CI, #80.
  • Add Python 3.13 and 3.14 classifiers.

Users connecting through a port-forward or SSH tunnel (the #65 setup) should also see signatures accepted now; see #65 for details.

Full Changelog: tedder/requests-aws4auth@v1.3.2...v1.4.0

Changelog

Sourced from requests-aws4auth's changelog.

1.4.0 (2026-10-09)

Bugfixes

  • Sign the Host header that is actually sent. The port is now kept unless it is the default for the scheme (80 for http, 443 for https), fixing SignatureDoesNotMatch on non-default ports with requests, #79 #34. This re-applies the fix from #63, which 1.2.2 reverted.
  • IPv6 literal hosts such as https://[::1] are signed correctly; previously the host was signed as [.
  • Credentials embedded in the URL (https://user:pass@host) are no longer signed as the host.

Changes

  • Fix the inverted assertion in the non-standard port test from #68.
  • Integration tests against MinIO and RadosGW on non-default ports, run in CI.
  • Add Python 3.13 and 3.14 classifiers.
Commits
  • 3073140 release 1.4.0
  • 41071a4 ci: run MinIO from Chainguard's image
  • 583f2fc fix: stop pinning the Host header on the request
  • 5d866eb fix: sign the Host header that is actually sent
  • b2af19f minor fix
  • 84ad414 chore: tests, integration to support issue 79
  • See full diff in compare view

Updates requests from 2.33.1 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)
Commits

Updates aws-cdk-lib from 2.265.0 to 2.273.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.273.0

⚠ BREAKING CHANGES

  • ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-appstream: AWS::AppStream::StackFleetAssociation: FleetName property is now immutable. aws-appstream: AWS::AppStream::StackFleetAssociation: StackName property is now immutable. aws-appsync: AWS::AppSync::ApiCache: AtRestEncryptionEnabled property is now immutable. aws-appsync: AWS::AppSync::ApiCache: TransitEncryptionEnabled property is now immutable. aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: OutputConfig attribute removed. aws-cloud9: AWS::Cloud9::EnvironmentEC2: Id attribute removed. aws-config: AWS::Config::ConfigurationRecorder: Id attribute removed. aws-config: AWS::Config::OrganizationConfigRule: Id attribute removed. aws-datazone: AWS::DataZone::PolicyGrant: Detail property is now required. aws-datazone: AWS::DataZone::PolicyGrant: Principal property is now required. aws-directoryservice: AWS::DirectoryService::MicrosoftAD: Id attribute removed. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.NetworkProtocol property is now required. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.SecurityGroupIds property is now required.

Features

Bug Fixes

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

  • redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
  • redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

  • redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
  • redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

Bug Fixes

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

  • glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
  • construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
  • Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead

... (truncated)

Commits
  • 60329ee chore(release): 2.273.0 (#38997)
  • 22a8ee5 chore: update analytics metadata blueprints
  • f911ee4 chore(release): 2.273.0
  • ed0df78 feat: update L1 CloudFormation resource definitions (#38969)
  • 873b82b docs: add cdk-review skills (#38942)
  • 07c059f docs(events): add examples for RuleTargetInput and EventField (#38470)
  • 7292cc7 chore(bedrock): add Claude Opus 5, Mythos 5, and Fable 5 foundation models (#...
  • 2915b0d chore(ec2): interface VPC endpoint for eks-proxy (#38385)
  • a12f3a1 feat(batch): add ConsumableResource L2 construct (#36971)
  • 6aa03e5 feat(opensearchservice): add useLatestServiceSoftwareForBlueGreen support (#3...
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • Additional commits viewable in compare view

Updates pandas to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • 2905718 RLS: 3.0.6
  • 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
  • f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
  • 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
  • e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
  • b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
  • bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
  • bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
  • c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
  • 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
  • Additional commits viewable in compare view

Updates pyarrow to 26.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.0

Release Notes URL: https://arrow.apache.org/release/26.0.0.html

Commits
  • 4461671 MINOR: [Release] Update versions for 26.0.0
  • 9d03a26 MINOR: [Release] Update .deb/.rpm changelogs for 26.0.0
  • 5ce3c95 MINOR: [Release] Update CHANGELOG.md for 26.0.0
  • 28e6c67 GH-51687: [C++] Skipt tests that require threads if ARROW_ENABLE_THREADING=OF...
  • 12409f8 GH-51682: [CI][C++] Add liburiparser-dev to system dependency image (#51683)
  • 1deceed GH-51675: [Python][Packaging] Apply upstream fix to UriParser from vcpkg and ...
  • cca44b5 GH-51638: [CI][C++][Parquet] Update expected JSON output in parquet-reader-te...
  • 5183e21 GH-46901: [C++][Compute] Add remainder and modulo kernels (#48914)
  • f0d043c MINOR: [Docs][C++] Fix doxygenfile path for arrow/flight/transport.h (#51677)
  • 17be9c7 GH-51652: [Python] Add NumPy StringDType to Arrow conversion (#51157)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dependencies group across 1 directory with 7 up…
ce4ea99 
…dates

Updates the requirements on [boto3](https://github.com/boto/boto3), [requests-aws4auth](https://github.com/tedder/requests-aws4auth), [requests](https://github.com/psf/requests), [aws-cdk-lib](https://github.com/aws/aws-cdk), [python-dotenv](https://github.com/theskumar/python-dotenv), [pandas](https://github.com/pandas-dev/pandas) and [pyarrow](https://github.com/apache/arrow) to permit the latest version.

Updates `boto3` from 1.43.71 to 1.43.111
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.71...1.43.111)

Updates `requests-aws4auth` from 1.3.2 to 1.4.0
- [Release notes](https://github.com/tedder/requests-aws4auth/releases)
- [Changelog](https://github.com/tedder/requests-aws4auth/blob/main/HISTORY.md)
- [Commits](tedder/requests-aws4auth@v1.3.2...v1.4.0)

Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)

Updates `aws-cdk-lib` from 2.265.0 to 2.273.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](aws/aws-cdk@v2.265.0...v2.273.0)

Updates `python-dotenv` from 1.2.2 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.4)

Updates `pandas` to 3.0.6
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.5...v3.0.6)

Updates `pyarrow` to 26.0.0
- [Release notes](https://github.com/apache/arrow/releases)
- [Commits](apache/arrow@apache-arrow-25.0.1...apache-arrow-26.0.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.111
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: requests-aws4auth
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-cdk-lib
  dependency-version: 2.273.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:production
  dependency-group: dependencies
- dependency-name: pyarrow
  dependency-version: 26.0.0
  dependency-type: direct:production
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies python Pull requests that update python code labels Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants