chore(deps): update all dependencies

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@babel/preset-env (source)	7.29.2 → 7.29.5			devDependencies	patch
actions/checkout	v4 → v6			action	major
actions/setup-python	v5 → v6			action	major
cryptography (changelog)	==47.0.0 → ==48.0.0				major
db-dtypes (source)	==1.5.1 → ==1.6.0				minor
dorny/paths-filter	v3 → v4			action	major
google-auth	==2.50.0 → ==2.52.0				minor
google-cloud-bigquery-storage (source)	==2.37.0 → ==2.38.0				minor
google-cloud-core (source)	==2.5.1 → ==2.6.0				minor
google-cloud-spanner (source)	==3.65.0 → ==3.66.0				minor
google-cloud-testutils (source)	==1.7.1 → ==1.8.0				minor
googleapis-common-protos (source)	==1.74.0 → ==1.75.0				minor
idna (changelog)	==3.13 → ==3.14				minor
jest (source)	30.3.0 → 30.4.2			devDependencies	minor
jest-environment-jsdom (source)	30.3.0 → 30.4.1			devDependencies	minor
jsdom	29.1.0 → 29.1.1			devDependencies	patch
pandas	==2.3.3 → ==3.0.2				major
pip (changelog)	==26.1 → ==26.1.1				patch
propcache	==0.4.1 → ==0.5.2				minor
proto-plus	==1.27.2 → ==1.28.0				minor
python	3.10 → 3.14			uses-with	minor
python	3.12 → 3.14			uses-with	minor
rules_cc	0.1.1 → 0.2.18			http_archive	minor
urllib3 (changelog)	==2.6.3 → ==2.7.0				minor
virtualenv	==21.3.0 → ==21.3.1				patch

---

Release Notes

babel/babel (@​babel/preset-env)

v7.29.5

Compare Source

v7.29.3

Compare Source

actions/checkout (actions/checkout)

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

v6.0.0

Compare Source

v6

Compare Source

v5.0.1

Compare Source

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in #​2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

Compare Source

What's Changed

• Update actions checkout to use node 24 by @​salmanmkc in #​2226
• Prepare v5.0.0 release by @​salmanmkc in #​2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v5

Compare Source

v4.3.1

Compare Source

What's Changed

• Port v6 cleanup to v4 by @​ericsciple in #​2305

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236
• Prepare release v4.3.0 by @​salmanmkc in #​2237

New Contributors

• @​motss made their first contribution in #​1971
• @​mouismail made their first contribution in #​1977
• @​benwells made their first contribution in #​2043
• @​nebuk89 made their first contribution in #​2194
• @​salmanmkc made their first contribution in #​2236

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

Compare Source

• url-helper.ts now leverages well-known environment variables by @​jww3 in #​1941
• Expand unit test coverage for isGhes by @​jww3 in #​1946

v4.2.1

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in #​1924

v4.2.0

Compare Source

• Add Ref and Commit outputs by @​lucacome in #​1180
• Dependency updates by @​dependabot- #​1777, #​1872

v4.1.7

Compare Source

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in #​1739
• Bump actions/checkout from 3 to 4 by @​dependabot in #​1697
• Check out other refs/* by commit by @​orhantoy in #​1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in #​1776

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in #​1732

v4.1.5

Compare Source

• Update NPM dependencies by @​cory-miller in #​1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in #​1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in #​1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in #​1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in #​1707

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in #​1692
• Add dependabot config by @​cory-miller in #​1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in #​1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in #​1643

v4.1.3

Compare Source

• Check git version before attempting to disable sparse-checkout by @​jww3 in #​1656
• Add SSH user parameter by @​cory-miller in #​1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in #​1650

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598

v4.1.1

Compare Source

• Correct link to GitHub Docs by @​peterbe in #​1511
• Link to release page from what's new section by @​cory-miller in #​1514

v4.1.0

Compare Source

• Add support for partial checkout filters

actions/setup-python (actions/setup-python)

v6.2.0

Compare Source

v6.1.0

Compare Source

What's Changed

Enhancements:

• Add support for pip-install input by @​gowridurgad in #​1201
• Add graalpy early-access and windows builds by @​timfel in #​880

Dependency and Documentation updates:

• Enhanced wording and updated example usage for allow-prereleases by @​yarikoptic in #​979
• Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @​dependabot in #​1139
• Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @​dependabot in #​1094
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @​dependabot in #​1199
• Upgrade requests from 2.32.2 to 2.32.4 by @​dependabot in #​1130
• Upgrade prettier from 3.5.3 to 3.6.2 by @​dependabot in #​1234
• Upgrade @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by @​dependabot in #​1235

New Contributors

• @​yarikoptic made their first contribution in #​979

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in #​1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

• Add support for pip-version by @​priyagupta108 in #​1129
• Enhance reading from .python-version by @​krystof-k in #​787
• Add version parsing from Pipfile by @​aradkdj in #​1067

Bug fixes:

• Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @​aparnajyothi-y in #​1183
• Change missing cache directory error to warning by @​aparnajyothi-y in #​1182
• Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @​aparnajyothi-y in #​1122
• Include python version in PyPy python-version output by @​cdce8p in #​1110
• Update docs: clarification on pip authentication with setup-python by @​priya-kinthali in #​1156

Dependency updates:

• Upgrade idna from 2.9 to 3.7 in /tests/data by @​dependabot[bot] in #​843
• Upgrade form-data to fix critical vulnerabilities #​182 & #​183 by @​aparnajyothi-y in #​1163
• Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @​aparnajyothi-y in #​1165
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​1181
• Upgrade @​actions/tool-cache from 2.0.1 to 2.0.2 by @​dependabot[bot] in #​1095

New Contributors

• @​krystof-k made their first contribution in #​787
• @​cdce8p made their first contribution in #​1110
• @​aradkdj made their first contribution in #​1067

Full Changelog: actions/setup-python@v5...v6.0.0

v6

Compare Source

v5.6.0

Compare Source

What's Changed

• Workflow updates related to Ubuntu 20.04 by @​aparnajyothi-y in #​1065
• Fix for Candidate Not Iterable Error by @​aparnajyothi-y in #​1082
• Upgrade semver and @​types/semver by @​dependabot in #​1091
• Upgrade prettier from 2.8.8 to 3.5.3 by @​dependabot in #​1046
• Upgrade ts-jest from 29.1.2 to 29.3.2 by @​dependabot in #​1081

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

Enhancements:

• Support free threaded Python versions like '3.13t' by @​colesbury in #​973
• Enhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade @​action/cache from 4.0.0 to 4.0.3 by @​priya-kinthali in #​1056
• Add support for .tool-versions file in setup-python by @​mahabaleshwars in #​1043

Bug fixes:

• Fix architecture for pypy on Linux ARM64 by @​mayeut in #​1011
  This update maps arm64 to aarch64 for Linux ARM64 PyPy installations.

Dependency updates:

• Upgrade @​vercel/ncc from 0.38.1 to 0.38.3 by @​dependabot in #​1016
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot in #​1015

New Contributors

• @​colesbury made their first contribution in #​973
• @​mahabaleshwars made their first contribution in #​1043

Full Changelog: actions/setup-python@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

Enhancements:

• Update cache error message by @​aparnajyothi-y in #​968
• Enhance Workflows: Add Ubuntu-24, Remove Python 3.8 by @​priya-kinthali in #​985
• Configure Dependabot settings by @​HarithaVattikuti in #​1008

Documentation changes:

• Readme update - recommended permissions by @​benwells in #​1009
• Improve Advanced Usage examples by @​lrq3000 in #​645

Dependency updates:

• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot in #​1012
• Upgrade urllib3 from 1.25.9 to 1.26.19 in /tests/data by @​dependabot in #​895
• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in #​1014
• Upgrade @actions/http-client from 2.2.1 to 2.2.3 by @​dependabot in #​1020
• Upgrade requests from 2.24.0 to 2.32.2 in /tests/data by @​dependabot in #​1019
• Upgrade @actions/cache to ^4.0.0 by @​priyagupta108 in #​1007

New Contributors

• @​benwells made their first contribution in #​1009
• @​HarithaVattikuti made their first contribution in #​1008
• @​lrq3000 made their first contribution in #​645

Full Changelog: actions/setup-python@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in #​941
• Upgrade IA publish by @​Jcambass in #​943

Bug Fixes:

• Normalise Line Endings to Ensure Cross-Platform Consistency by @​priya-kinthali in #​938
• Revise isGhes logic by @​jww3 in #​963
• Bump pillow from 7.2 to 10.2.0 by @​aparnajyothi-y in #​956

Enhancements:

• Enhance workflows and documentation updates by @​priya-kinthali in #​965
• Bump default versions to latest by @​jeffwidman in #​905

New Contributors

• @​Jcambass made their first contribution in #​941
• @​jww3 made their first contribution in #​963

Full Changelog: actions/setup-python@v5...v5.3.0

v5.2.0

Compare Source

What's Changed

Bug fixes:

• Add .zip extension to Windows package downloads for Expand-Archive Compatibility by @​priyagupta108 in #​916
  This addresses compatibility issues on Windows self-hosted runners by ensuring that the filenames for Python and PyPy package downloads explicitly include the .zip extension, allowing the Expand-Archive command to function correctly.
• Add arch to cache key by @​Zxilly in #​896
  This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts.
  Note: This change may break previous cache keys as they will no longer be compatible with the new format.

Documentation changes:

• Fix display of emojis in contributors doc by @​sciencewhiz in #​899
• Documentation update for caching poetry dependencies by @​gowridurgad in #​908

Dependency updates:

• Bump @​iarna/toml version from 2.2.5 to 3.0.0 by @​priya-kinthali in #​912
• Bump pyinstaller from 3.6 to 5.13.1 by @​aparnajyothi-y in #​923

New Contributors

• @​sciencewhiz made their first contribution in #​899
• @​priyagupta108 made their first contribution in #​916
• @​Zxilly made their first contribution in #​896
• @​aparnajyothi-y made their first contribution in #​923

Full Changelog: actions/setup-python@v5...v5.2.0

v5.1.1

Compare Source

What's Changed

Bug fixes:

• fix(ci): update all failing workflows by @​mayeut in #​863
  This update ensures compatibility and optimal performance of workflows on the latest macOS version.

Documentation changes:

• Documentation update for cache by @​gowridurgad in #​873

Dependency updates:

• Bump braces from 3.0.2 to 3.0.3 and undici from 5.28.3 to 5.28.4 by @​dependabot in #​893

New Contributors

• @​gowridurgad made their first contribution in #​873

Full Changelog: actions/setup-python@v5...v5.1.1

v5.1.0

Compare Source

What's Changed

• Leveraging the raw API to retrieve the version-manifest, as it does not impose a rate limit and hence facilitates unrestricted consumption without the need for a token for Github Enterprise Servers by @​Shegox in #​766.
• Dependency updates by @​dependabot and @​HarithaVattikuti in #​817
• Documentation changes for version in README by @​basnijholt in #​776
• Documentation changes for link in README by @​ukd1 in #​793
• Documentation changes for link in Advanced Usage by @​Jamim in #​782
• Documentation changes for avoiding rate limit issues on GHES by @​priya-kinthali in #​835

New Contributors

• @​basnijholt made their first contribution in #​776
• @​ukd1 made their first contribution in #​793
• @​Jamim made their first contribution in #​782
• @​Shegox made their first contribution in #​766
• @​priya-kinthali made their first contribution in #​835

Full Changelog: actions/setup-python@v5.0.0...v5.1.0

pyca/cryptography (cryptography)

v48.0.0

Compare Source

googleapis/google-cloud-python (db-dtypes)

v1.6.0: db-dtypes: v1.6.0

Compare Source

Features

• enable mypy session for db-dtypes (#​16689) (856731e1)

dorny/paths-filter (dorny/paths-filter)

v4.0.1

Compare Source

What's Changed

• Support merge queue by @​masaru-iritani in #​255

New Contributors

• @​masaru-iritani made their first contribution in #​255

Full Changelog: dorny/paths-filter@v4.0.0...v4.0.1

v4.0.0

Compare Source

• Update action runtime to node24

v4

Compare Source

• Update action runtime to node24

v3.0.3

Compare Source

• Add missing predicate-quantifier

v3.0.2

Compare Source

• Add config parameter for predicate quantifier

v3.0.1

Compare Source

• Compare base and ref when token is empty

kjd/idna (idna)

v3.14

Compare Source

jestjs/jest (jest)

v30.4.2

Compare Source

Fixes

• [jest-runtime] Fix named imports from CJS modules whose module.exports is a function with own-property exports (#​16150)

v30.4.1

Compare Source

Features

• [jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#​16141)

Fixes

• [jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#​16143)

v30.4.0

Compare Source

Features

• [babel-jest] Support collecting coverage from .mts, .cts (and other) files (#​15994)
• [jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#​16006)
• [jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#​15984)
• [jest-config] Add support for jest.config.mts as a valid configuration file (#​16005)
• [jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#​16133)
• [@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#​16128)
• [@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#​16128)
• [@jest/fake-timers] Support faking Temporal.Now.* (#​16131)
• [jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#​16088)
• [jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#​16064)
• [jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#​16062)
• [jest-runtime] Support require() of ES modules on Node v24.9+ (#​16074)
• [jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#​16127)
• [@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#​16062)
• [jest-util] Add isError helper (#​16076)
• [pretty-format] Support React 19 (#​16123)

Fixes

• [expect-utils] Fix toStrictEqual failing on structuredClone results due to cross-realm constructor mismatch (#​15959)
• [@jest/expect-utils] Prevent toMatchObject/subset matching from throwing when encountering exotic iterables (#​15952)
• [fake-timers] Convert Date to milliseconds before passing to @sinonjs/fake-timers (#​16029)
• [jest] Export GlobalConfig and ProjectConfig TypeScript types (#​16132)
• [jest-circus] Prevent crash when asyncError is undefined for non-Error throws (#​16003)
• [jest-circus, jest-jasmine2] Include Error.cause in JSON failureMessages output (#​15967)
• [jest-config] Fix preset path resolution on Windows when the preset uses subpath exports (#​15961)
• [jest-config] Allow collectCoverage and coverageProvider in project config without a validation warning (#​16132)
• [jest-config] Project config validator now emits "is not supported in an individual project configuration" instead of "probably a typing mistake" for known global-only options (#​16132)
• [jest-environment-node] Fix --localstorage-file warning on Node 25+ (#​16086)
• [jest-reporters] Apply global coverage threshold to unmatched pattern files in addition to glob/path thresholds (#​16137)
• [jest-reporters, jest-runner, jest-runtime, jest-transform] Fix coverage report not showing correct code coverage when using projects config option (#​16140)
• [jest-runtime] Resolve expect and @jest/expect from the internal module registry so test-file imports share the same JestAssertionError as the global expect (#​16130)
• [jest-runtime] Improve CJS-from-ESM interop: __esModule/Babel default unwrap, broader named-export coverage, and shared CJS singleton across importers (#​16050)
• [jest-runtime] Load .js files with ESM syntax but no "type":"module" marker as native ESM (#​16050)
• [jest-runtime] Extend the .js-with-ESM-syntax fallback to require() on Node v24.9+ - falls back to require(esm) when the CJS parser rejects ESM syntax (#​16078)
• [jest-runtime] Fix deadlocks and double-evaluation in concurrent ESM and wasm imports (#​16050)
• [jest-runtime] Fix error when require() is called after the Jest environment has been torn down (#​15951)
• [jest-runtime] Fix missing error when import() is called after the Jest environment has been torn down (#​16080)
• [jest-runtime] Fix virtual unstable_mockModule registrations not respected in ESM (#​16081)
• [jest-runtime] Apply moduleNameMapper when resolving modules with require.resolve() and the paths option (#​16135)

Chore & Maintenance

• [@jest/fake-timers] Upgrade @sinonjs/fake-timers (#​16139)
• [jest-runtime] Use synchronous linkRequests / instantiate for ESM linking on Node v24.9+ (#​16063)

jsdom/jsdom (jsdom)

v29.1.1

Compare Source

pandas-dev/pandas (pandas)

v3.0.2: pandas 3.0.2

Compare Source

We are pleased to announce the release of pandas 3.0.2.
This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher.
The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

v3.0.1: pandas 3.0.1

Compare Source

We are pleased to announce the release of pandas 3.0.1.
This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0.0 supports Python 3.11 and

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates various dependencies across multiple packages, including major version bumps for cryptography and pandas. Feedback was provided regarding breaking changes in cryptography v48.0.0, such as the removal of OpenSSL 1.1.1 support and specific API modifications. Additionally, the upgrade to pandas v3.0.2 introduces Copy-on-Write as the default behavior, which requires verification of code relying on DataFrame views to ensure compatibility.

[gemini-code-assist]

The update to cryptography v48.0.0 is a major version bump with several backward-incompatible changes. As per the changelog, this version removes support for OpenSSL 1.1.1 and introduces other breaking API changes.

Key breaking changes include:

• Support for OpenSSL 1.1.1 has been removed. Supported versions are now 3.0, 3.1, 3.2, and 3.3.
• The deprecated signer and verifier arguments to PKCS7.sign have been removed.
• Constructors for DHParameterNumbers and DSAParameterNumbers have changed.

Given that this is a security-critical library, please verify that these changes do not adversely affect the project.

[gemini-code-assist]

Upgrading pandas to v3.0.2 is a major version change. A key breaking change is that Copy-on-Write (CoW) is now enabled by default. This can introduce subtle bugs by changing how assignments to DataFrame/Series views are handled.

For example, chained assignments that previously modified an original DataFrame might now operate on a copy, leaving the original unchanged. It is highly recommended to review the code relying on pandas to ensure compatibility with this new behavior.

For more details, please refer to the pandas 3.0 release notes.

[forking-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[chalmerlowe]

LGTM