chore(deps): update all dependencies

[renovate-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
SQLAlchemy (changelog)	==2.1.4 → ==2.1.5				patch
bigquery-magics (source)	==0.10.3 → ==0.15.1				minor
bigquery_magics (source)	==0.10.3 → ==0.15.1				minor
certifi	==2026.7.22 → ==2026.10.18				minor
charset-normalizer	==3.4.9 → ==3.5.2				minor
charset-normalizer	==3.4.3 → ==3.5.2				minor
charset-normalizer	==3.5.1 → ==3.5.2				patch
click (changelog)	==8.4.2 → ==8.5.0				minor
click (changelog)	==8.3.0 → ==8.5.0				minor
cryptography (changelog)	==50.0.0 → ==50.0.2				patch
cryptography (changelog)	==50.0.1 → ==50.0.2				patch
distlib	==0.4.0 → ==0.4.4				patch
dorny/paths-filter	v4.0.1 → v4.0.3			action	patch
filelock	==4.2.0 → ==4.2.4				patch
geojson	==3.2.0 → ==3.3.0				minor
geopandas	==1.1.2 → ==1.2.0				minor
google-api-core	==2.33.0 → ==2.42.0				minor
google-api-core	==2.28.0 → ==2.42.0				minor
google-api-core	==2.41.0 → ==2.42.0				minor
google-auth (source)	==2.56.2 → ==2.62.0				minor
google-auth (source)	==2.41.1 → ==2.62.0				minor
google-auth (source)	==2.52.0 → ==2.62.0				minor
google-auth (source)	==2.60.0 → ==2.62.0				minor
google-auth-oauthlib (source)	==1.2.2 → ==1.5.0				minor
google-cloud-bigquery (source)	==3.45.0 → ==3.46.2				minor
google-cloud-bigquery (source)	==3.41.0 → ==3.46.2				minor
google-cloud-bigquery (source)	==3.44.0 → ==3.46.2				minor
google-cloud-monitoring (source)	==2.31.0 → ==2.32.0				minor
google-cloud-monitoring (source)	==2.29.0 → ==2.32.0				minor
google-cloud-spanner (source)	==3.69.0 → ==3.71.0				minor
google-crc32c	==1.7.1 → ==1.9.0				minor
google-resumable-media (source)	==2.7.2 → ==2.11.0				minor
google.cloud.bigquery (source)	==3.45.0 → ==3.46.2				minor
greenlet (changelog)	==3.5.4 → ==3.5.6				patch
grpcio	==1.83.0 → ==1.84.0				minor
grpcio	==1.75.1 → ==1.84.0				minor
idna (changelog)	==3.18 → ==3.20				minor
idna (changelog)	==3.15 → ==3.20				minor
ipywidgets	==8.1.8 → ==8.1.9				patch
markupsafe (changelog)	==3.0.3 → ==3.0.4				patch
pip (changelog)	==26.2 → ==26.2.1				patch
platformdirs (changelog)	==4.9.6 → ==4.13.5				minor
proto-plus	==1.28.2 → ==1.29.0				minor
proto-plus	==1.26.1 → ==1.29.0				minor
protobuf	==7.35.1 → ==7.36.2				minor
python	3.14 → 3.15			uses-with	minor
python	3.12 → 3.15			uses-with	minor
python	3.10 → 3.15			uses-with	minor
python-discovery (changelog)	==1.6.3 → ==1.6.4				patch
ruff (source, changelog)	==0.15.12 → ==0.17.1				minor
virtualenv (changelog)	==21.14.7 → ==21.14.11				patch
wrapt (changelog)	==2.5.0 → ==2.5.1				patch

---

Release Notes

googleapis/google-cloud-python (bigquery-magics)

v0.15.1: bigquery-magics: v0.15.1

Compare Source

Bug Fixes

• bump grpcio to 1.59.0; require Python 3.10+ (#​17351) (a53487a)
• require Protobuf 6.33.5+ (#​17743) (d267342)

v0.15.0: google-cloud-discoveryengine 0.15.0

Compare Source

Bug Fixes

• Add labels for additional Sessions identification (PiperOrigin-RevId: 8207103) (1dbd0988)

• Include AssistAnswer as a part of the Session (PiperOrigin-RevId: 8207103) (1dbd0988)

v0.14.0: google-cloud-discoveryengine 0.14.0

Compare Source

0.14.0 (2025-10-16)

v0.13.0

Compare Source

v0.12.2: bigquery-magics: v0.12.2

Compare Source

v0.12.2 (2026-03-26)

v0.12.1: google-ai-generativelanguage: v0.12.1

Compare Source

Features

• declare Python3.15 support (8775794)

v0.12.0: google-cloud-recommendations-ai 0.12.0

Compare Source

0.12.0 (2026-01-09)

v0.11.0: google-cloud-recommendations-ai 0.11.0

0.11.0 (2025-10-20)

certifi/python-certifi (certifi)

v2026.10.18

Compare Source

pallets/click (click)

v8.5.0

Compare Source

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell
  5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish
  completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate
  the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default.
  Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes
  a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the
  prompt when the output stream does not support them, matching echo().
  This stripping was lost in 8.4.0 when {pr}2969 began writing the
  prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning,
  an error under python -bb, when checking a value against the -
  convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is
  produced by a callback, covering cases {func}version_option intentionally
  does not. The feature set of {func}version_option is now frozen; see
  discussion #​3527. {pr}3581
• style() and secho() no longer silently drop the 256-color index 0
  (black) passed as fg or bg, and now validate color arguments. Invalid
  colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name
  _click_default_help instead of help, so a parameter named help no
  longer breaks parsing. The new name is visible in
  {meth}Command.to_info_dict output. Parameters that overwrite each other's
  value trigger a warning: an argument sharing its name with another
  parameter, or any parameter claiming the reserved name. Options may still
  share a name to compete for the same value (feature switches).
  {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full
  CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and
  validation steps in Option.__init__ move into focused helpers, and
  flag_value and default keep their unset sentinel at construction
  (resolved lazily on read) so is UNSET reliably tells a user-supplied value
  from an auto-derived one. Runtime behavior is unchanged, but
  {meth}Parameter.to_info_dict now resolves default=True on a feature
  switch to its flag_value, matching what the function receives at call
  time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and
  will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are
  now private (_-prefixed). The old names remain available with a
  DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,
  make_default_short_help, PacifyFlushWrapper, and safecall.
  {issue}3099 {pr}3695
• Deprecate {meth}CliRunner.isolated_filesystem. It relies on
  {func}os.chdir, which mutates process-global state and is not
  thread-safe. The helper predates Python 3 and modern pytest: use a
  temporary directory ({class}tempfile.TemporaryDirectory or pytest's
  tmp_path fixture) with absolute paths instead. For running tests in
  parallel, use process-based isolation (such as pytest-xdist) rather
  than threads, since {meth}CliRunner.invoke also redirects the
  process-global standard streams. {issue}3501 {issue}3700 {pr}3704
• prompt() is now generically typed and returns the type produced by
  type, value_proc, or a matching default instead of Any.
  {class}ParamType takes a second optional type parameter describing the
  input value it accepts (ParamType[int, str] for a type converting
  strings to integers), defaulting to Any. {pr}3407
• {meth}Command.get_help_option_names returns the help option names in the
  order they were declared. {pr}3728
• {func}get_pager_file yields a text stream on Windows again. The temporary
  file backend opened its file in binary mode, so writing a str to the pager
  raised TypeError: a bytes-like object is required, not 'str', and the
  color argument was ignored on that path. Regression introduced in 8.4.0
  by {pr}1572. {issue}3731 {issue}3732 {issue}3740 {pr}3739
• {func}progressbar settles on its final position when update_min_steps
  does not divide the total. Steps below that threshold are applied when the
  bar finishes, so show_pos renders 20/20 rather than the last multiple
  it reached. {issue}3571 {pr}3769
• An error raised while writing to the pager no longer gets replaced by
  PermissionError: [WinError 32] on Windows. The temporary file backend
  unlinked its file without closing it first, and Windows refuses to remove a
  file the process still holds open, so the cleanup failure masked the real
  exception. {issue}3731 {pr}3764
• The temporary file the pager writes to on Windows is opened with the encoding
  {func}get_pager_file picked for the output stream, and with
  errors="replace" to match the pipe backend. Any text stdout can encode
  reaches the pager.
• The temporary file pager backend forwards any parameters the user set in
  PAGER to the pager command instead of silently dropping them. On Windows,
  PAGER="less -R" now invokes less -R on the temporary file rather than
  bare less. {pr}3777
• Improve raw mode detection by parsing the option tokens. {issue}3416
  {pr}3777
• {func}edit accepts os.PathLike values for filename, in addition to
  strings. {issue}2869 {pr}3781

pyca/cryptography (cryptography)

v50.0.2

Compare Source

v50.0.1

Compare Source

pypa/distlib (distlib)

v0.4.4

Compare Source

v0.4.3

Compare Source

v0.4.2

Compare Source

v0.4.1

Compare Source

dorny/paths-filter

v4.0.3

Compare Source

• Document safe handling of file list outputs in workflows
• Escape multi-line filenames in list-files shell and csv output
• Add 'some-with-excludes' predicate quantifier
• Add contents permission to PR example
• Scope base-ignored warning to API path
• Update outputs in readme to account for the 'every' predicate-quantifier

v4.0.2

Compare Source

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

tox-dev/py-filelock (filelock)

v4.2.4

Compare Source

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. #​863

PyPI release

Full Changelog: tox-dev/filelock@4.2.3...4.2.4

v4.2.3

Compare Source

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at
  exit. #​860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat
  reports lost ownership rather than a transient refresh error.

PyPI release

Full Changelog: tox-dev/filelock@4.2.2...4.2.3

v4.2.2

Compare Source

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had
  failed because the working directory no longer exists. That call still raises FileNotFoundError, and it now
  leaves the lock's hold count unchanged. #​856

PyPI release

Full Changelog: tox-dev/filelock@4.2.1...4.2.2

v4.2.1

Compare Source

• On a singleton wrapper, close> and
  close> end only the holds that tasks acquired
  through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold.
  After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended
  hold, and close() on such a wrapper returns.
  Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #​832
• ReadWriteLock locks again after a release() that an exception from a signal handler interrupted.
  The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose
  backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled.
  AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins
  its queue no longer blocks every later call on that lock. #​833
• Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its
  database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite
  now opens the database by name only in a directory no other account can write, and through a private hard link
  elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database
  in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories
  through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it,
  and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more
  than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #​834
• Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create,
  such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder
  metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker
  no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release();
  ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows,
  a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission
  list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a
  symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a
  marker it cannot write instead of raising PermissionError. #​835
• Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing
  a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime
  offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no
  longer carry group or other write bits. A process name containing a carriage return or another line separator no longer
  makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check
  no longer compares start times and keeps the marker. #​836
• The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took
  the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on
  release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read
  levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat
  recorded a lost hold, it refuses new acquires until that hold is released. #​838
• StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode
  and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it
  narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is,
  so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on
  Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a
  sticky parent such as /tmp it refuses a coordination directory of another account, as
  SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed
  claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name
  raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's
  unlink. #​839
• Fix a lock reporting a hold the OS had dropped after a signal handler raised during
  acquire or release. A release that a signal handler cuts
  short after it has started now completes before the error propagates. A handler that acquires the lock its own thread is
  releasing now gets RuntimeError instead of a hold that stays held. The singleton cache no longer hands out an
  is_singleton=True lock or a ReadWriteLock whose finalizer is running, which released the new
  holder's lock. A signal during os.fork() no longer leaves the other threads blocked in their next lock call, and a
  fork from another thread no longer waits for a ReadWriteLock acquire on a busy database. #​840
• Fix a lock on a relative path locking a file in the directory the process changed to while the lock waited, and leaving
  its marker behind on release after such a change. The path resolved when an acquisition starts stays in use until
  the hold ends. An is_singleton=True lookup no longer returns a cached lock whose relative path now resolves to
  another file; a held lock still matches the file it holds. A rename of the lock's directory during a hold no longer
  leaves the marker behind or reports a false lease compromise, and a waiter no longer creates a second lock file in a
  directory that was renamed away. #​841
• SoftReadWriteLock reaches its records through descriptors of <path>.rw and gen or holders
  opened without following symlinks. On Windows it holds those directories open and refuses a junction (a directory that
  points at another directory). A tree swapped in after an earlier acquire therefore cannot redirect them. Its heartbeat
  rewrites a holder record only when the name still leads to the file it created, and does not block on a FIFO (a named
  pipe). A heartbeat that finds <path>.rw replaced by a symlink or junction reports the hold lost instead of ending
  the heartbeat thread. A live lock object repeats the ownership check whenever the tree it opens is not the one it
  prepared. #​842
• Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing
  or displacing a live holder's marker in five cases. ext4 gave a freed inode number to the next marker. A stalled
  FileLock removed its ENOSYS placeholder after a peer replaced it. A failed acquire cleaned up
  after a successor took the path. A stale break left the lock path empty while it checked the marker it had moved. A
  lifetime break judged a marker by a reused inode number. On Linux and macOS a stale marker now changes hands in one
  atomic exchange. On other platforms without one, except Windows, including NFS and SMB, the marker stays in place and
  waits for timeout or break_lock(). Restoring a marker no longer follows a symlink found under the break name. A
  holder that releases while a peer's exchange has its marker aside leaves a record no lock parses, so the put-back lands
  a marker that ages out. A lease heartbeat that finds another file at the lock path once, while a peer's break has its
  marker aside, waits for the next refresh before it reports a compromise. A contender that finds a dead breaker's marker
  puts back the marker that breaker left under its break name. A marker is the breaker's own only when it names the
  breaker's process on this host; the same process number on another host is a holder. A contender takes a stranded marker
  under a name of its own before it puts the marker back, so two contenders no longer reverse each other's exchange and
  remove the live holder's marker. A claim left behind by a failed put-back is retried on the next poll. #​843
• Canceling an AsyncReadWriteLock or AsyncSoftReadWriteLock acquire that waits for
  another process now stops the wait and raises the cancellation. It used to wait until that process released, or raise
  Timeout. A thread_local=True AsyncFileLock that threads with their own event
  loops share no longer deadlocks when one thread waits for the lock while another holds it. #​844
• SoftReadWriteLock refuses a commit that lands a whole retention window behind the log, so two
  committers stalled at adjacent generations can no longer admit a second writer. Its stale check samples the clock before
  it reads a holder record, so a pause between the two no longer counts as time the record stayed unchanged. #​845
• Fix a SoftFileLock contender evicting an empty marker after two seconds while its owner held the
  lock. The owner is a SoftFileLock before 3.22, which writes nothing into its marker, or a current one still writing
  its record. An empty marker now reads as held, and timeout, lifetime or break_lock() clears it. A contender
  that finds an empty marker a dead breaker left aside puts it back instead of removing it. #​846
• Fix ReadWriteLock on Windows acting on -journal and -wal files another account places beside
  its database: an acquire could fail with OperationalError, or SQLite could replay the journal and
  delete the file it names. The lock now reads the database directory's access control list. Where an account other than
  the locking account, SYSTEM and Administrators can add or remove names, SQLite opens a hard link inside a
  directory only those accounts can write. A filesystem without hard links raises OSError. #​854
• Fix SoftReadWriteLock subclasses sharing singleton instances with the base class or sibling subclasses.
  Each concrete class now keeps its own cache and construction guard, including after fork, while preserving
  cooperative class-definition keywords. #​855
• GraalPy is now tested weekly instead of on every change: GraalPy 25.4.4 can freeze the test suite, which made its job
  fail on unrelated changes. #​849

PyPI release

Full Changelog: tox-dev/filelock@4.2.0...4.2.1

jazzband/geojson (geojson)

v3.3.0

Compare Source

geopandas/geopandas (geopandas)

v1.2.0

Compare Source

New features and improvements:

• Static plotting in GeoPandas has been re-implemented. The new tooling shall be mostly
  backwards compatible while bringing a set of enhancements:

  • Categorical plotting now allows dict-based mapping of categories to colors and
    other styles.
  • Legends now reflect the geometry type and complete set of styles, not just a
    color.
  • Plotting of continuous variables with a classification scheme can now produce
    a colorbar instead of a categorical legend when using colorbar=True within
    legend_kwds.
  • vmin and vmax keywords are supported when scheme is defined, not ignored.
  • When using categorical colormap with categorical plots, colors are now assigned
    in order to optimize the contrast of the resulting map.
  • Colorbar size is automatically adjusted to be approximately the size of the plot.
  • Colorbar now indicates extensions if the vmin and/or vmax clip the values.
  • Legends are created automatically by matplotlib. This also means that you can
    create a single legend from a layered map by calling ax.legend() directly.
  • GeoPandas now labels axes using the information on units from CRS. This can be
    controlled via the add_labels keyword.
  • Static plots can include a basemap defined by the tiles keyword, exposing
    contextily.add_basemap from within the plot method. Requires contextily
    package to be installed.
  • scheme keyword can take a value "greedy" resulting in a greedy (topological)
    coloring where no two adjacent polygons share a color. Requires mapclassify and
    libpysal packages.

  The related refactoring of the plotting infrastructure has changed the internal
  representation of the figure generated by GeoPandas. This can be considered a breaking
  change if you rely the composition of collections, as that has changed. A number of
  plotting-related bugs has been fixed along as a side effect. All changes are reflected
  in an updated user guide.
  (#​3708, #​3728, #​3748, #​3752, #​3753, #​3763, #​3767, #​3689).

• GeoParquet improvements:

  • The upcoming GeoParquet 2.0 specification is now supported for both writing
    and reading (#​3632).
  • read_parquet now support direct reading from HTTP/HTTPS protocols (#​3699).
  • GeoDataFrame.to_parquet and read_parquet will now write and read attrs
    respectively (#​3597).

• Added geopandas.make_grid and GeoSeries.make_grid to generate a square
  or hexagonal grids covering the input geometry (#​2062).

• Added geopandas.read_file_info to expose information about file layers, including layer
  metadata (this is an alias for pyogrio.read_info) (#​3759).

• Add grid_size parameter to union, difference, symmetric_difference
  and intersection (#​3593).

• Document how to access the feature ID (fid) as the index when reading files
  with read_file and the pyogrio engine, using fid_as_index=True (#​3829).

Deprecations and compatibility notes:

• The resolution keyword to buffer has been deprecated to align with the convention in shapely,
  quad_segs should be used instead (#​3600).
• Expired deprecations: option use_pygeos which had no functionality,
  seed keyword in sample_points (replaced by rng) (#​3613).

Bug fixes:

• Fix GeoSeries.sample_points looping without end on zero-area polygons, such as a
  collapsed ring; it now returns an empty MultiPoint, as it already did for empty
  and missing geometries (#​3851).
• Fix read_parquet ignoring the partitioning keyword when auto-detecting
  the columns to read, so that partitioning=None no longer raises (#​3459).
• Fix GeoDataFrame.explode() raising a cryptic error when passing multiple
  (non-geometry) columns; it now falls back to the pandas multi-column explode (#​2753).
• Fix GeoDataFrame.from_features raising a ValueError for an empty list of
  features when a crs is provided; it now returns an empty GeoDataFrame with
  a geometry column (#​3777).
• Fix the index level of the parts created by explode(index_parts=True) and
  get_coordinates(index_parts=True) being int32 instead of int64 on 32-bit
  platforms (#​3865).
• Various compatibility fixes for pandas 3.1 (#​3802, #​3831).

Community:

• GeoPandas now uses the NumFOCUS Code of Conduct.
• GeoPandas has a new software paper which can be used as canonical citation, see https://geopandas.org/en/latest/about/citing.html

Notes on dependencies:

• GeoPandas 1.2 now requires Python 3.11 or greater and pandas 2.2, numpy 2.0, pyproj 3.7, and
  shapely 2.1, are now the minimum required version for these dependencies.
  Furthermore, the minimum tested version for optional dependencies has been updated to
  fiona 1.8.21, scipy 1.9, matplotlib 3.9, mapclassify 2.7 folium 0.15, pyarrow 15.0 and
  SQLAlchemy 2.0. Older versions of these libraries may continue to work, but are no longer
  considered supported (#​3371, #​3581).

v1.1.4

Compare Source

Bug fixes:

• Further hardening of to_postgis against SQL injection (#​3800).
• Ensure that points generated by sample_points are not sorted along x-axis (#​3773).
• Fix GeoDataFrame.explore() ignoring custom legend_kwds={"labels": ...}
  for categorical and boolean columns (#​3496).
• More graceful handling of keep_geom_type in the overlay() function with
  empty input (#​3745).

v1.1.3

Compare Source

This release addresses a handful of small compatibility issues with pandas 3.0 and backports some bugfixes.

Bug fixes:

• Improved compatibility with pandas 3.0 Copy-on-Write feature, making use of deferred copies where possible (#​3298, #​3711).
• Fix GeoSeries.sample_points not accepting list-like size when generating points using
  pointpaterns (#​3710).
• Fix from_wkt/wkb to correctly handle missing values with pandas 3 (where the new str dtype is used) (#​3714).
• Fix to_postgis to correctly handle missing values with pandas 3 (where the new str dtype is used) (#​3722).
• Using loc to assign column values to a new row index now correctly preserves the column CRS and geometry dtype
  on pandas 3.1, due to an upstream bug fix (#​3741, Pandas #​62523)
• Random states in pointpats methods of sample_points`` can now be fixed with rng` (#​3737).

googleapis/google-cloud-python (google-cloud-bigquery)

v3.46.2

Compare Source

Bug Fixes

• bigquery: accept empty sourceFormat fields (#​18472) (590e43d)
• bigquery: drop startIndex whenever a page token is sent (#​18603) (fc6eae3)
• bigquery: remove PendingDeprecationWarning from RowIterator.to_arrow (#​18684) (9025061)

v3.46.1

Compare Source

Bug Fixes

• bigquery: account for range element type, rounding mode, and foreign type in SchemaField equality (#​18540) ([053dbc9](https://redirect.github.com/googleapis/google-cloud-python/commit/053dbc9872ad3f26e10c311ff801b1a85faf

[!IMPORTANT]
✂ PR body was truncated to here.

[gemini-code-assist]

Code Review

This pull request updates various package dependencies across multiple requirements.txt files in the repository. Feedback on these changes highlights a compatibility issue where upgrading geopandas to 1.2.0 unconditionally breaks Python 3.10 support, suggesting the use of environment markers instead. Additionally, the reviewer advises installing monorepo-internal dependencies, specifically google-auth and google-crc32c, from their local paths using editable installs to ensure local changes are properly tested during development and CI.

[gemini-code-assist]

Upgrading geopandas to 1.2.0 unconditionally will break compatibility for Python 3.10 environments, as GeoPandas 1.2.0 requires Python 3.11 or greater. Since Python 3.10 is still supported by this repository, please use environment markers to fall back to 1.1.2 on Python 3.10.

geopandas==1.1.2; python_version < '3.11'
geopandas==1.2.0; python_version >= '3.11'

[gemini-code-assist]

In the google-cloud-python monorepo, google-auth is a member of the monorepo and exists locally in the packages/ directory. It should be installed directly from the local path to ensure that local changes are tested during development and CI.

-e ../../../google-auth

References

1. In the google-cloud-python monorepo, google-crc32c and google-auth are now members of the monorepo and exist locally in the packages/ directory, so they can be installed directly from local paths.

[gemini-code-assist]

In the google-cloud-python monorepo, google-crc32c is a member of the monorepo and exists locally in the packages/ directory. It should be installed directly from the local path to ensure that local changes are tested during development and CI.

-e ../../../google-crc32c

References

1. In the google-cloud-python monorepo, google-crc32c and google-auth are now members of the monorepo and exist locally in the packages/ directory, so they can be installed directly from local paths.

[gemini-code-assist]

In the google-cloud-python monorepo, google-auth is a member of the monorepo and exists locally in the packages/ directory. It should be installed directly from the local path to ensure that local changes are tested during development and CI.

-e ../../../google-auth

References

1. In the google-cloud-python monorepo, google-crc32c and google-auth are now members of the monorepo and exist locally in the packages/ directory, so they can be installed directly from local paths.