Skip to content

chore(deps): bump the python-minor-and-patch group with 24 updates - #4

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/dev/python-minor-and-patch-6a2037673f
Closed

chore(deps): bump the python-minor-and-patch group with 24 updates#4
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/dev/python-minor-and-patch-6a2037673f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 24 updates:

Package From To
mako 1.4.1 1.4.3
markupsafe 3.0.3 3.0.4
sqlalchemy 2.0.48 2.1.6
aiogram 3.30.0 3.31.0
aiohttp 3.14.3 3.14.5
alembic 1.16.5 1.20.1
anyio 4.14.2 4.15.1
certifi 2026.7.22 2026.10.23
charset-normalizer 3.5.1 3.5.2
cryptography 50.0.0 50.0.2
google-auth-oauthlib 1.4.0 1.5.0
google-auth 2.56.3 2.62.0
google-genai 2.8.0 2.34.0
greenlet 3.5.5 3.5.6
idna 3.19 3.20
propcache 0.5.2 0.5.4
pyasn1 0.6.4 0.6.5
pycparser 3.0 3.12
pydantic 2.13.4 2.14.2
pydantic-core 2.46.4 2.50.2
python-dotenv 1.2.3 1.2.4
tenacity 9.1.4 9.2.1
urllib3 2.7.0 2.8.0
yarl 1.24.5 1.25.1

Updates mako from 1.4.1 to 1.4.3

Release notes

Sourced from mako's releases.

1.4.3

Released: Tue Sep 22 2026

bug

  • [bug] [tests] Fixed regression caused in 1.4.2 where tests added to the suite were unable to run directly on Windows, due to posix mechanics: the tests force os.path to posixpath, whereas TemplateLookup.get_template() converts the configured directory using os.path.sep. These tests are now skipped on that platform, where the traversal check is instead exercised against ntpath natively.

    References: #441

1.4.2

Released: Tue Sep 22 2026

bug

  • [bug] [tests] Adjusted the test suite to accommodate for a change in Pygments 2.21.0 where the HtmlFormatter now renders " and ' characters literally rather than as HTML entities, which caused failures in tests that assert against the rendered output of html_error_template().

    References: #440

  • [bug] [template] Fixed issue in TemplateLookup where a URI beginning with a drive designator (e.g. C:/../../secret.txt) could bypass the directory traversal check on Windows, allowing reads of arbitrary files outside of the template directory. The check in Template normalized the URI using os.path, which on Windows is ntpath; as ntpath splits the drive designator off and treats the remainder as rooted, the .. segments were absorbed before the check could inspect them. Normalization is now performed with posixpath, which is the same module used by TemplateLookup.get_template() to resolve the URI to a file.

    References: #441

Commits

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

  • Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
  • Improve performance of striptags. #521
Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

  • Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
  • Improve performance of striptags. :issue:521
Commits

Updates sqlalchemy from 2.0.48 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

  • [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

    This change is also backported to: 2.0.56

    References: #13711

  • [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

    References: #13701

  • [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

    References: #13709

orm extensions

  • [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

    This change is also backported to: 2.0.56

    References: #13680

... (truncated)

Commits

Updates aiogram from 3.30.0 to 3.31.0

Release notes

Sourced from aiogram's releases.

Telegram Bot API 10.3

What's Changed

New Contributors

Full Changelog: aiogram/aiogram@v3.30.0...v3.31.0

Changelog

Sourced from aiogram's changelog.

3.31.0 (2026-08-26)

Bugfixes

  • Fixed :class:aiogram.utils.i18n.SimpleI18nMiddleware never resolving territory-specific locales: a Telegram language_code like pt-br now selects an available pt_BR translations directory (falling back to the bare language when only it exists), instead of always resolving to the bare language and missing the territory directory. [#1755](https://github.com/aiogram/aiogram/issues/1755) <https://github.com/aiogram/aiogram/issues/1755>_

  • Fixed :code:Message.content_type returning :code:photo for Live Photo messages. Telegram sends a regular :code:photo alongside :code:live_photo, so :code:live_photo is now checked first and :code:ContentType.LIVE_PHOTO is returned. :code:Message.send_copy also copies such messages via :class:aiogram.methods.send_live_photo.SendLivePhoto instead of sending a static photo. [#1841](https://github.com/aiogram/aiogram/issues/1841) <https://github.com/aiogram/aiogram/issues/1841>_

  • Fixed missing dispatcher contextual argument for filters, handlers and middlewares when updates are fed via webhook (:class:aiogram.webhook.aiohttp_server.SimpleRequestHandler, :class:aiogram.webhook.aiohttp_server.TokenBasedRequestHandler) or direct :meth:aiogram.dispatcher.dispatcher.Dispatcher.feed_update calls. Previously it was only injected by start_polling, so a callback declaring a required dispatcher parameter worked in polling mode but failed with TypeError in webhook mode, aborting event propagation for sibling handlers as well. [#1855](https://github.com/aiogram/aiogram/issues/1855) <https://github.com/aiogram/aiogram/issues/1855>_

  • Improved import performance by reusing the type namespace when rebuilding Telegram object models. [#1861](https://github.com/aiogram/aiogram/issues/1861) <https://github.com/aiogram/aiogram/issues/1861>_

  • Fixed bot-level parse_mode default not being applied to recently added methods and types. sendGift, giftPremiumSubscription, sendPaidMedia, sendLivePhoto, sendMessageDraft, postStory, editStory, editEphemeralMessageText, editEphemeralMessageCaption, :class:aiogram.types.input_checklist.InputChecklist, :class:aiogram.types.input_checklist_task.InputChecklistTask, :class:aiogram.types.input_media_live_photo.InputMediaLivePhoto and :class:aiogram.types.input_media_voice_note.InputMediaVoiceNote were missing the Default("parse_mode") sentinel, so Bot(default=DefaultBotProperties(parse_mode=...)) was silently ignored and captions were sent unformatted. [#1873](https://github.com/aiogram/aiogram/issues/1873) <https://github.com/aiogram/aiogram/issues/1873>_

  • Fixed bot-level defaults being ignored by ten generated entities.

    :code:Bot(default=DefaultBotProperties(protect_content=..., show_caption_above_media=..., link_preview=...)) was silently dropped by :class:aiogram.methods.copy_messages.CopyMessages, :class:aiogram.methods.forward_messages.ForwardMessages, :class:aiogram.methods.post_story.PostStory, :class:aiogram.methods.repost_story.RepostStory, :class:aiogram.methods.send_checklist.SendChecklist, :class:aiogram.methods.send_live_photo.SendLivePhoto, :class:aiogram.methods.send_paid_media.SendPaidMedia, :class:aiogram.methods.send_rich_message.SendRichMessage, :class:aiogram.methods.edit_ephemeral_message_text.EditEphemeralMessageText and

... (truncated)

Commits
  • 97cfe79 Bump changelog
  • 4d281df fix(i18n): resolve territory-specific locales from Telegram language_code (#1...
  • 8a4f322 Rewrite the 2.x -> 3.x migration guide: fix factual errors, cover silent brea...
  • c2af7b3 Added full support for the Bot API 10.3 (#1888)
  • bea6716 Add Claude agent skills for pre-PR reviews, testing, codegen, and FSM dispatc...
  • 7a7c350 Fix bot-level parse_mode default not applied to recently added entities (#1873)
  • aaac433 Bump vulnerable dependencies to patched versions (#1872)
  • ba098a5 Fix missing dispatcher contextual argument on webhook feed path (#1855) (#1856)
  • c0c48ed Reuse type namespace when rebuilding models (#1861)
  • fc6e5bc Fix content type detection for live photos (#1871)
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates alembic from 1.16.5 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

  • [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

    References: #1085

  • [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

    References: #1360

  • [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

    References: #1462

  • [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

  • [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

  • Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311)

4.15.0

  • Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

    • follow_symlinks on exists() (Python 3.12+)
    • follow_symlinks on is_dir() (Python 3.13+)
    • follow_symlinks on is_file() (Python 3.13+)
    • follow_symlinks on owner() (Python 3.13+)
    • follow_symlinks on group() (Python 3.13+)
    • newline on read_text() (Python 3.13+)

    (#1286, #1293; PR by @​jaideeppyne)

  • Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

  • Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

  • Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

  • Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

  • Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

  • Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

  • Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

  • Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

  • Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

  • Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

  • Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

  • Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

  • Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

  • Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

  • Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

  • Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

  • Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

  • Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits
  • ffcd154 Bumped up the version
  • 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
  • 9283662 Bumped up the version
  • d137692 Improved the instructions for AI agents
  • 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
  • 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
  • b825c3b Fixed pyproject.toml changes not triggering the test suite
  • 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
  • b05fe6d Fixed wrong type in move_on_after (#1297)
  • 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
  • Additional commits viewable in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)
Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)
Commits
  • 935c29a Release 3.5.2 (#805)
  • 9d3238a test: disable traefik in downstream niquests
  • b4c0368 docs: write changelog entry for 3.5.2
  • 717da31 chore: bump version to 3.5.2
  • 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
  • 41e28b6 chore: raise Cython upper bound to 3.3
  • b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
  • f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
  • See full diff in compare view

Updates cryptography from 50.0.0 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:


50.0.1 - 2026-08-25

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

Updates google-auth-oauthlib from 1.4.0 to 1.5.0

Release notes

Sourced from google-auth-oauthlib's releases.

google-shopping-merchant-promotions: v1.5.0

1.5.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-shopping-merchant-ordertracking: v1.5.0

1.5.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-shopping-merchant-notifications: v1.5.0

1.5.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-shopping-merchant-lfp: v1.5.0

1.5.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-shopping-merchant-issueresolution: v1.5.0

1.5.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-shopping-merchant-conversions: v1.5.0

1.5.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)
Changelog

Sourced from google-auth-oauthlib's changelog.

1.5.0 (2022-07-11)

Features

Bug Fixes

1.4.8 (2022-05-24)

Bug Fixes

  • add hardcoded IAM references temporarily (#209) (5dc99d2)

1.4.7 (2022-04-12)

Bug Fixes

  • add markdown header if it is missing (#203) (ccd53bd)

1.4.6 (2022-04-06)

Bug Fixes

  • support parsing summary docstring that is not well formed (#200) (a1b362d)

1.4.5 (2022-03-18)

Bug Fixes

1.4.4 (2022-03-03)

Bug Fixes

  • parse docstring that come without summaries (#187) (8282604)

1.4.3 (2022-02-15)

... (truncated)

Commits
  • d6bed5a chore: release main (#18464)
  • 78ff458 feat(gapic-generator): add schema support for resumable uploads (#18480)
  • af2100a tests: add showcase to golden files (#18479)
  • e1d306a fix: resolve error where google/longrunning/operations.proto is missing (#18477)
  • 7871fa9 fix(gapic-generator): init mock response in version header test (#18488)
  • 0b488a3 feat(bigtable): Reroute Mutations Batcher to use data client (#18200)
  • 30b4f44 fix(google-auth-oauthlib): prevent ipv6 address reuse (#18463)
  • 1d9f468 chore(main): release google-auth 2.59.0 (#18465)
  • c7c133a chore(bigtable): Added an internal batch completed callback to the data clien...
  • 8cb3c6a perf(spanner): optimize query option merging and prevent in-place mutation (#...
  • Additional commits viewable in compare view

Updates google-auth from 2.56.3 to 2.62.0

Release notes

Sourced from google-auth's releases.

google-auth: v2.62.0

2.62.0 (2026-10-12)

Features

  • auth: enable bound ID tokens by default on Cloud Run (#18635) (8b625c4)

google-auth: v2.61.0

2.61.0 (2026-10-07)

Features

  • auth: support bound access and ID tokens for GKE (#18594) (9f5fd7b)

google-auth: v2.60.0

2.60.0 (2026-10-02)

Features

  • auth: Support sync credentials in AsyncAuthorizedSession (#18542) (3799568)
Commits
  • 5deaacb chore(main): release google-auth 2.62.0 (#18637)
  • 8b625c4 feat(auth): enable bound ID tokens by default on Cloud Run (#18635)
  • 98fc304 feat(dbapi): wire timeout parameter through Connection to execute_sql (#18484)
  • 0cabf7c test(spanner): increase stale database cleanup cutoff to 3 hours (#18633)
  • ab56473 perf(spanner): prune lock and begin event allocations on single-use snapshots...
  • 78b9da2 fix(google-cloud-spanner): do not replay DDL statements on transaction retry ...
  • f18a11e feat(db-dtypes): support pandas 3.1 (#18590)
  • 590e43d fix(bigquery): accept empty sourceFormat fields (#18472)
  • 05b3775 perf(spanner): optimize single-chunk results and single-row lookups (#18602)
  • a7678fd fix(spanner): eliminate duplicate metrics capture and measure full streaming ...
  • Additional commits viewable in compare view

Updates google-genai from 2.8.0 to 2.34.0

Release notes

Sourced from google-genai's releases.

v2.34.0

2.34.0 (2026-10-29)

Features

  • Add support for continuation_token and requires_continuation status (daac53e)
  • Add support for Python 3.15. (cb1408b)
  • Add video upscale task parameter (0456043)
  • Drop support for Python 3.10 (2677298)
  • interactions: Add automatic_continuation to interactions.create in the Python SDK (c85d5ae)
  • interactions: Declare continuation_ids on Interaction (4bdde3a)
  • Support base_url, api_version and headers in LiveConnectConfig.http_options (c0e9c54)
  • Support video understanding in Gemini Developer API (34b58fd)

Bug Fixes

  • interactions: Align SDK User-Agent and x-goog-api-client headers (358d249)
  • Resolve PEP 563 string annotations when invoking AFC tools (4650ea1), refs #3156
  • Stop per-request Authorization and X-Server-Timeout from leaking into client default headers (0584c96), refs #3158

v2.33.0

2.33.0 (2026-10-22)

Features

  • Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (16a29c9)
  • Add support for Python 3.15. (e1c4fc7)
  • Add support for Python 3.15. (1a64450)
  • client: Support httpx2 with GOOGLE_GENAI_HTTP_CLIENT configuration (87ddba1)
  • Include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (adbc79c)

Bug Fixes

  • client: Skip mTLS URL rewriting for multi-regional .rep.googleapis.com endpoints and honor GOOGLE_API_USE_MTLS_ENDPOINT in Google Auth sessions (4e44c84)
  • Honor an explicit zero in HttpRetryOptions delay fields (419dd89), refs #2026
  • Honor HttpRetryOptions for aiohttp connection errors in async requests (ee639c6), refs #3160

Documentation

  • Update unenforced JSON Schema keywords on Interactions schema fields. (c97ae02)

v2.32.0

2.32.0 (2026-10-21)

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.34.0 (2026-10-29)

Features

  • Add support for continuation_token and requires_continuation status (daac53e)
  • Add support for Python 3.15. (cb1408b)
  • Add video upscale task parameter (0456043)
  • Drop support for Python 3.10 (2677298)
  • interactions: Add automatic_continuation to interactions.create in the Python SDK (c85d5ae)
  • interactions: Declare continuation_ids on Interaction (4bdde3a)
  • Support base_url, api_version and headers in LiveConnectConfig.http_options (c0e9c54)
  • Support video understanding in Gemini Developer API (34b58fd)

Bug Fixes

  • interactions: Align SDK User-Agent and x-goog-api-client headers (358d249)
  • Resolve PEP 563 string annotations when invoking AFC tools (4650ea1), refs #3156
  • Stop per-request Authorization and X-Server-Timeout from leaking into client default headers (0584c96), refs #3158

2.33.0 (2026-10-22)

Features

  • Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (16a29c9)
  • Add support for Python 3.15. (e1c4fc7)
  • Add support for Python 3.15. (1a64450)
  • client: Support httpx2 with GOOGLE_GENAI_HTTP_CLIENT configuration (87ddba1)
  • Include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (adbc79c)

Bug Fixes

@dependabot
chore(deps): bump the python-minor-and-patch group with 24 updates
76de51e 
---
updated-dependencies:
- dependency-name: mako
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: sqlalchemy
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: aiogram
  dependency-version: 3.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: alembic
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: google-auth-oauthlib
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-auth
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-genai
  dependency-version: 2.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: greenlet
  dependency-version: 3.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: propcache
  dependency-version: 0.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pyasn1
  dependency-version: 0.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pycparser
  dependency-version: '3.12'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pydantic-core
  dependency-version: 2.50.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: tenacity
  dependency-version: 9.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: yarl
  dependency-version: 1.25.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 2, 2026
@vlnchk vlnchk mentioned this pull request Nov 3, 2026
Merged
@vlnchk

vlnchk commented Nov 3, 2026

Copy link
Copy Markdown
Owner

Closing: this group cannot be installed (pydantic 2.14 needs aiogram that allows it — aiogram 3.31 requires pydantic<2.14; tenacity 9.2 conflicts with google-genai 2.34, which requires tenacity<9.2). The security fixes from this group land in #9. google-genai 2.34 changes the tool schema format sent to the model and will be upgraded separately with an eval run.

@vlnchk vlnchk closed this Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vlnchk