[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
certifi	==2026.7.22 → ==2026.10.23
cffi (changelog)	==2.1.0 → ==2.1.1
charset-normalizer (changelog)	==3.4.9 → ==3.5.2
click (changelog)	==8.4.2 → ==8.5.0
cryptography (changelog)	==50.0.0 → ==50.0.2
google-api-core	==2.33.0 → ==2.43.0
google-auth (source)	==2.56.2 → ==2.62.0
google-cloud-core (source)	==2.6.0 → ==2.8.0
google-cloud-storage (source)	==3.13.0 → ==3.17.1
google-crc32c	==1.8.0 → ==1.9.0
google-resumable-media (source)	==2.10.0 → ==2.11.0
googleapis-common-protos (source)	==1.75.0 → ==1.76.0
idna (changelog)	==3.18 → ==3.20
proto-plus	==1.28.2 → ==1.29.0
pycparser	==3.0 → ==3.12

---

Release Notes

certifi/python-certifi (certifi)

v2026.10.23

Compare Source

v2026.10.19

Compare Source

v2026.10.18

Compare Source

python-cffi/cffi (cffi)

v2.1.1

Compare Source

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (#​269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

jawah/charset_normalizer (charset-normalizer)

v3.5.2

Compare Source

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for
  abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties
  for uncommon CJK characters. (#​796)
• Supported encodings without aliases failing name resolution or being ignored in charset
  declarations. (#​800)

v3.5.1

Compare Source

Changed

• Raised upper bound of setuptools to v84 (#​794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy.
  Only impacted large content input >1M bytes.

v3.5.0

Compare Source

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#​773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#​774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the
  pure Python fallback. The previous engine (mypyc) started to hit rough limit around
  the optimization of our noise/coherence detector while Cython allows us to
  steer the engine toward the right generated optimized sources.
  This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are
  immediately discoverable (i.e. not hidden import like mypyc did).
  Moreover, a long wished distribution is the abi3 wheels, this will allow us
  to no longer rush each year when a new Python interpreter is released.
  We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

pallets/click (click)

v8.5.0

Compare Source

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell
  5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish
  completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate
  the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default.
  Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes
  a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the
  prompt when the output stream does not support them, matching echo().
  This stripping was lost in 8.4.0 when {pr}2969 began writing the
  prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning,
  an error under python -bb, when checking a value against the -
  convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is
  produced by a callback, covering cases {func}version_option intentionally
  does not. The feature set of {func}version_option is now frozen; see
  discussion #​3527. {pr}3581
• style() and secho() no longer silently drop the 256-color index 0
  (black) passed as fg or bg, and now validate color arguments. Invalid
  colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name
  _click_default_help instead of help, so a parameter named help no
  longer breaks parsing. The new name is visible in
  {meth}Command.to_info_dict output. Parameters that overwrite each other's
  value trigger a warning: an argument sharing its name with another
  parameter, or any parameter claiming the reserved name. Options may still
  share a name to compete for the same value (feature switches).
  {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full
  CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and
  validation steps in Option.__init__ move into focused helpers, and
  flag_value and default keep their unset sentinel at construction
  (resolved lazily on read) so is UNSET reliably tells a user-supplied value
  from an auto-derived one. Runtime behavior is unchanged, but
  {meth}Parameter.to_info_dict now resolves default=True on a feature
  switch to its flag_value, matching what the function receives at call
  time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and
  will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are
  now private (_-prefixed). The old names remain available with a
  DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,
  make_default_short_help, PacifyFlushWrapper, and safecall.
  {issue}3099 {pr}3695
• Deprecate {meth}CliRunner.isolated_filesystem. It relies on
  {func}os.chdir, which mutates process-global state and is not
  thread-safe. The helper predates Python 3 and modern pytest: use a
  temporary directory ({class}tempfile.TemporaryDirectory or pytest's
  tmp_path fixture) with absolute paths instead. For running tests in
  parallel, use process-based isolation (such as pytest-xdist) rather
  than threads, since {meth}CliRunner.invoke also redirects the
  process-global standard streams. {issue}3501 {issue}3700 {pr}3704
• prompt() is now generically typed and returns the type produced by
  type, value_proc, or a matching default instead of Any.
  {class}ParamType takes a second optional type parameter describing the
  input value it accepts (ParamType[int, str] for a type converting
  strings to integers), defaulting to Any. {pr}3407
• {meth}Command.get_help_option_names returns the help option names in the
  order they were declared. {pr}3728
• {func}get_pager_file yields a text stream on Windows again. The temporary
  file backend opened its file in binary mode, so writing a str to the pager
  raised TypeError: a bytes-like object is required, not 'str', and the
  color argument was ignored on that path. Regression introduced in 8.4.0
  by {pr}1572. {issue}3731 {issue}3732 {issue}3740 {pr}3739
• {func}progressbar settles on its final position when update_min_steps
  does not divide the total. Steps below that threshold are applied when the
  bar finishes, so show_pos renders 20/20 rather than the last multiple
  it reached. {issue}3571 {pr}3769
• An error raised while writing to the pager no longer gets replaced by
  PermissionError: [WinError 32] on Windows. The temporary file backend
  unlinked its file without closing it first, and Windows refuses to remove a
  file the process still holds open, so the cleanup failure masked the real
  exception. {issue}3731 {pr}3764
• The temporary file the pager writes to on Windows is opened with the encoding
  {func}get_pager_file picked for the output stream, and with
  errors="replace" to match the pipe backend. Any text stdout can encode
  reaches the pager.
• The temporary file pager backend forwards any parameters the user set in
  PAGER to the pager command instead of silently dropping them. On Windows,
  PAGER="less -R" now invokes less -R on the temporary file rather than
  bare less. {pr}3777
• Improve raw mode detection by parsing the option tokens. {issue}3416
  {pr}3777
• {func}edit accepts os.PathLike values for filename, in addition to
  strings. {issue}2869 {pr}3781

pyca/cryptography (cryptography)

v50.0.2

Compare Source

v50.0.1

Compare Source

googleapis/google-cloud-python (google-api-core)

v2.43.0: google-cloud-bigquery-storage: v2.43.0

Compare Source

Features

• bigquery-storage: add Arrow options and cancel to read_rows (#​18643) (939bdd0)

v2.42.0: google-api-core: v2.42.0

Compare Source

Features

• observability: implement universal 4-path OpenTelemetry tracing (#​18433) (7d18b25)

v2.41.0: google-cloud-pubsub: v2.41.0

Compare Source

Features

• update API sources and regenerate (#​18396) (e9f8e59)
• update API sources and regenerate. (e9f8e59)

v2.40.0: google-api-core: v2.40.0

Compare Source

Features

• declare Python3.15 support (05b0c34)

v2.39.0: google-api-core: v2.39.0

Compare Source

Features

• google-api-core: add support for resumable uploads (#​18352) (17d6c53)

v2.38.0: google-api-core: v2.38.0

Compare Source

Features

• core: add request hook to enrich T4 network spans with GCP resource attributes (E) (#​18272) (1ca95e9)

v2.37.0: google-api-core: v2.37.0

Compare Source

Features

• gapic: add OpenTelemetry T3 client method span wrapping in gapic_v1.method (D) (#​18274) (156e319)

v2.36.0: google-api-core: v2.36.0

Compare Source

Features

• api-core: add ClientInterceptor and apply_interceptors helper (A) (#​18236) (b6db5a9)
• api-core: add tracer_provider to ClientOptions for OTel support (#​18139) (9ffebc2)

Bug Fixes

• api-core: handle list-shaped REST error payloads (#​18232) (02d1fd8)
• api-core: move http encoding into transcode method (#​18218) (082a99a)

v2.35.0: google-api-core: v2.35.0

Compare Source

Features

• api_core: add deprecation warning for grpcio < 1.83.0 for PQC (#​18045) (7e2e23e)

Bug Fixes

• api_core: improve rest path validation (#​17753) (63bfb96)
• api_core: support suppress_metrics_header fallback in AuthMetadataPlugin (#​18029) (dd2000d)

Documentation

• handwritten: centralize CONTRIBUTING.rst pointers (#​17642) (23b9499)

v2.34.0: google-cloud-bigquery-storage 2.34.0

Compare Source

Features

• Add support for Python 3.14 (bd0f5422)

Bug Fixes

• Deprecate credentials_file argument (bd0f5422)

• Require grpcio &gt;= 1.33.2 (bd0f5422)

• Require grpcio &gt;= 1.75.1 for Python 3.14 (bd0f5422)

kjd/idna (idna)

v3.20

Compare Source

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental
  codec.
• Add support for Python 3.15.

v3.19

Compare Source

• Restore the std3_rules option, which had no effect since changes
  to UTS #​46 processing in Unicode 16. Note that uts46_remap()
  defaults to enabling STD3 rules, so direct callers will see input
  containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #​46 mapping, particularly for
  ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document
  thread safety.
• Expose the Unicode version of the generated tables as
  idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to
  IDNAError so that the failed rule and the offending character can
  be identified without parsing the exception message.
• The deprecated transitional argument to encode() and
  uts46_remap() is now completely ignored, and gives a deprecation warning
  for the latter.
• Reject A-labels that are not the canonical Punycode encoding of
  their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of
  InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes
  passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage
  measurement, and CI checks that the data tables match the generator
  output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for
contributions to this release.

eliben/pycparser (pycparser)

v3.12

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.