chore(deps): update python-nonmajor - autoclosed

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
PyMySQL (changelog)	==1.2.0 → ==1.2.3
SQLAlchemy (changelog)	==2.0.52 → ==2.1.4
asyncpg	==0.31.0 → ==0.32.0
cryptography (changelog)	==50.0.0 → ==50.0.2
filelock	==3.32.3 → ==3.32.7
google-auth (source)	==2.56.3 → ==2.61.0
idna (changelog)	==3.19 → ==3.20
psycopg (changelog)	==3.3.4 → ==3.3.6
psycopg-binary (changelog)	==3.3.4 → ==3.3.6

---

Release Notes

PyMySQL/PyMySQL (PyMySQL)

v1.2.3

Compare Source

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for
compatibility with aiomysql.

Use pymysql.converters at your own risk.
It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Compare Source

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for
compatibility with aiomysql.
This function does not escape dictionaries and is entirely unnecessary.
Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1

Compare Source

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes
parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets.
This vulnerability also occurs when strings decoded from bytes using
surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

• Queries are now encoded using the strict error handler instead of
  surrogateescape.
  Queries that cannot be encoded using the connection encoding can no longer be sent.

• bytes parameters are now always sent as hexadecimal literals, such as
  X'636174'. Note that this increases the number of bytes sent.

• The binary_prefix parameter of connect() is deprecated. The _binary
  prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to
character encoding.
However, we strongly recommend using UTF-8 (utf8mb4).
Other character sets are not thoroughly tested, and their limited use means
that problems may go unreported. In the 2020s, encodings other than UTF-8
should be considered legacy.

MagicStack/asyncpg (asyncpg)

v0.32.0

Compare Source

Improvements

• Support Python 3.15 (#​1367, #​1378)
  (by @​elprans in 1b11846 and 58c0c59)

• Support PostgreSQL 19 (#​1379)
  (by @​elprans in 8d2a5ae)

• Make pool min_size a maintained connection floor and add init_size to
  control the number of connections opened at startup (#​1323).
  Idle connections at or below min_size are retained, and closed connections
  are replaced in the background. init_size defaults to min_size.
  To preserve the previous behavior, where the pool could drain to zero,
  replace min_size=N with init_size=N, min_size=0.
  (by @​shatilov-diman in 67a1cbc)

• Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#​1359)
  (by @​twelfthlabor in 00319a9)

• Use the statement cache for copy_records_to_table() introspection (#​1360)
  (by @​matemax in dd05865)

Fixes

• Clean up connections rejected by target_session_attrs immediately so an
  unresponsive rejected host cannot delay the selected connection, and cleanup
  tasks cannot outlive the event loop. Rejected connections are aborted without
  waiting for a graceful disconnect; servers may log "unexpected EOF on client
  connection" if the Terminate message is not delivered before the transport
  closes.

• Fix a connection pool deadlock when releasing a connection after a protocol
  abort (#​1324)
  (by @​pchaseh in 4a83cc2)

• Honor Connection.close(timeout=...) while waiting for a pending
  cancellation (#​1361)
  (by @​gyanu2507 in c06bcb4)

• Prevent stuck cancellation from blocking connection teardown or pool release
  by bounding cancellation with the command or release timeout (#​1370)
  (by @​elprans in 4cf0220)

• Preserve the server error when the connection closes mid-operation (#​1369)
  (by @​RitiGrover in 6c8f1a7)

• Fix COPY cleanup when a records generator raises, preserving the original
  exception and avoiding protocol desynchronization and stalled rollback (#​1358)
  (by @​CodingCossack in fdc6bc8)

• Reparse unnamed statements before cursor binding when the statement cache
  is disabled (#​1364)
  (by @​elprans in 302ba49)

• Allow cursors in transactions started outside Connection.transaction(),
  such as with an explicit BEGIN (#​1350)
  (by @​aryansk in 25aaaf5)

• Remove the query logger when the query_logger() block raises (#​1373)
  (by @​kratos0718 in 6a7fbd3)

• Fix a segfault in Record.get() with an invalid number of positional
  arguments (#​1333)
  (by @​apoorvdarshan in 40a3832)

• Align SSL startup retries with libpq and improve SSL rejection diagnostics
  (#​1366). Retry alternative transports only before authentication succeeds.
  Direct TLS now requires sslmode=require, verify-ca, or verify-full,
  or an explicit SSLContext.
  (by @​elprans in 78752c9)

• Preserve password errors during SSL fallback when the fallback fails with
  a less specific authorization error (#​1331)
  (by @​Mauricio0129 in 2d97947)

• Handle cleartext password authentication when no password is supplied
  without raising an AttributeError (#​1351)
  (by @​aryansk in 6be5915)

• Set the postgresql ALPN protocol on SSL contexts created by asyncpg so
  direct TLS connections work with PostgreSQL 17 and later (#​1372).
  User-provided contexts must set this protocol for direct TLS connections.
  (by @​DurandA in b21325d)

• Link explicitly against libm on non-Windows platforms to fix undefined
  math symbol errors when loading the extensions (#​1305)
  (by @​veeceey in db8ecc2)

• Fix builds on FreeBSD 15 by linking against libstdthreads (#​1368)
  (by @​elprans in 87bcaf9)

Other

• Replace pkg_resources with packaging in setup.py (#​1362)
  (by @​elprans in 6695db7)

• Build Linux and macOS ARM64 wheels on native runners and add Windows ARM64
  wheel builds (#​1308)
  (by @​ddelange in 1e8cc1c)

• Add manual and PR-label-triggered dry runs to the release workflow (#​1374)
  (by @​elprans in 1bd643e)

• Clarify how execute() uses prepared statements and how to confirm an
  INSERT in the documentation (#​1336)
  (by @​pctablet505 in cdf816c)

• Fix typos in comments and docstrings (#​1332)
  (by @​maxtaran2010 in bc3e246)

pyca/cryptography (cryptography)

v50.0.2

Compare Source

v50.0.1

Compare Source

tox-dev/py-filelock (filelock)

v3.32.7

Compare Source

What's Changed

• Fix final symlink test on musl by @​lprnmns in tox-dev/filelock#737
• 📝 docs: say acquire() falls back to the lock's blocking attribute by @​hxperl in tox-dev/filelock#733

New Contributors

• @​hxperl made their first contribution in tox-dev/filelock#733

Full Changelog: tox-dev/filelock@3.32.6...3.32.7

v3.32.6

Compare Source

What's Changed

• 🐛 fix(lease): reject a duration no marker can carry by @​lprnmns in tox-dev/filelock#723
• 🐛 fix(soft-rw): reject non-finite timing options by @​lprnmns in tox-dev/filelock#724
• fix: preserve exception notes when copying and pickling by @​jackwalkerlabs in tox-dev/filelock#729
• test(soft-rw): reuse existing test module by @​gaborbernat in tox-dev/filelock#730
• fix: respect ACL write access when the owner write bit is absent by @​jackwalkerlabs in tox-dev/filelock#728
• Fix SoftReadWriteLock state lock timeout by @​Sohel2309 in tox-dev/filelock#726

New Contributors

• @​jackwalkerlabs made their first contribution in tox-dev/filelock#729
• @​Sohel2309 made their first contribution in tox-dev/filelock#726

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

v3.32.5

Compare Source

What's Changed

• 🧪 test(fork): report where a stalled fork stops by @​gaborbernat in tox-dev/filelock#715
• 📝 docs: say that mode is read-only in the thread-local section by @​Gares95 in tox-dev/filelock#716
• 🐛 fix(lease): clear token after failed acquire by @​lprnmns in tox-dev/filelock#721

New Contributors

• @​lprnmns made their first contribution in tox-dev/filelock#721

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

v3.32.4

Compare Source

What's Changed

• 🐛 fix: retry transient denials on open and claim read by @​gaborbernat in tox-dev/filelock#705
• 🧪 test: deflake six scheduled-run failures by @​gaborbernat in tox-dev/filelock#704
• 🧪 test: cover a reclaimed private record for real by @​gaborbernat in tox-dev/filelock#706
• 🧪 test(fork): fork once the event loop has closed by @​gaborbernat in tox-dev/filelock#714
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in tox-dev/filelock#713
• escape the hostname every marker publishes by @​dxbjavid in tox-dev/filelock#709

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

googleapis/google-cloud-python (google-auth)

v2.61.0: google-cloud-container 2.61.0

Compare Source

Features

• add network_tier_config field to NodeNetworkConfig (PiperOrigin-RevId: 8223116) (9170f84f)

• add membership_type field to Fleet (PiperOrigin-RevId: 8223116) (9170f84f)

• deprecate enterprise_config field in Cluster (PiperOrigin-RevId: 8223116) (9170f84f)

• add end_time_behavior field to MaintenanceExclusionOptions (PiperOrigin-RevId: 8223116) (9170f84f)

• add rotation_config field to SecretManagerConfig (PiperOrigin-RevId: 8223116) (9170f84f)

• add node_kernel_module_loading field to LinuxNodeConfig (PiperOrigin-RevId: 8223116) (9170f84f)

• deprecate enable_legacy_lustre_port field in LustreCsiDriverConfig (PiperOrigin-RevId: 8223116) (9170f84f)

• add autoscaled_rollout_policy field to BlueGreenSettings (PiperOrigin-RevId: 8223116) (9170f84f)

• add writable_cgroups field to ContainerdConfig (PiperOrigin-RevId: 8223116) (9170f84f)

• add privileged_admission_config field to Autopilot (PiperOrigin-RevId: 8223116) (9170f84f)

• add network_tier_config field to IPAllocationPolicy (PiperOrigin-RevId: 8223116) (9170f84f)

• deprecate desired_enterprise_config field in ClusterUpdate (PiperOrigin-RevId: 8223116) (9170f84f)

• add desired_secret_sync_config to ClusterUpdate (PiperOrigin-RevId: 8222684) (9170f84f)

Documentation

• various documentation fixes (PiperOrigin-RevId: 8223116) (9170f84f)

• various documentation fixes (PiperOrigin-RevId: 8222684) (9170f84f)

v2.60.0: google-cloud-container 2.60.0

Compare Source

Features

• Add &#​39;enabled&#​39; field to AutoIpamConfig to enable/disable Auto IPAM (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add fields to DNSEndpointConfig to control k8s token and cert authentication via DNS (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add SecretSyncConfig to sync secrets from Secret Manager (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add SwapConfig to enable and configure swap memory for node pools (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add &#​39;end_time_behavior&#​39; to MaintenanceExclusionOptions (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add network_tier_config and accelerator_network_profile to NodePool (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add cluster-level network_tier_config (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add &#​39;wait_for_drain_duration&#​39; to AutoscaledRolloutPolicy in BlueGreenSettings (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add PrivilegedAdmissionConfig for Autopilot clusters (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add MembershipType to Fleet config (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add WritableCgroups to the containerd config (PiperOrigin-RevId: 8193530) (89cd6f54)

• Add NodeKernelModuleLoading to configure kernel module loading policies for nodes (PiperOrigin-RevId: 8193530) (89cd6f54)

Documentation

• updated comments for various types, messages, and fields. (PiperOrigin-RevId: 8193530) (89cd6f54)

v2.59.1: google-auth: v2.59.1

Compare Source

Bug Fixes

• auth: support mTLS in requests.Request for token refresh and impersonation (#​18486) (590376d)

v2.59.0: google-auth: v2.59.0

Compare Source

Features

• declare Python3.15 support (05b0c34)

v2.58.1: google-auth: v2.58.1

Compare Source

Bug Fixes

• auth: allow mTLS retry when credentials raise NotImplementedError on refresh (#​18349) (1665e68)

v2.58.0: google-auth: v2.58.0

Compare Source

Features

• [aiohttp] Add mTLS reconfiguration logic when certificate mismatch (906ace7)
• auth: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads (#​18224) (906ace7)

v2.57.1: google-auth: v2.57.1

Compare Source

Bug Fixes

• auth: parse hostname for mTLS and PSC endpoint certificate rotation (#​18147) (#​18201) (b18bb4c)

v2.57.0: google-auth: v2.57.0

Compare Source

Features

• auth: add deprecation warning for grpcio < 1.83.0 (PQC support) (#​18070) (68bdaba)

Bug Fixes

• auth: parse hostname for mTLS and PSC endpoint certificate rotat… (#​18153) (b642373)
• auth: prevent TypeError and support home-dir cert fallback for X… (#​18016) (b9a1379)

Documentation

• handwritten: centralize CONTRIBUTING.rst pointers (#​17642) (23b9499)

kjd/idna (idna)

v3.20

Compare Source

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental
  codec.
• Add support for Python 3.15.

psycopg/psycopg (psycopg)

v3.3.6

Compare Source

v3.3.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun