[dependabot]

Bumps the python-minor-and-patch group with 5 updates:

Package	From	To
streamlit	1.66.0	1.66.1
pandas	3.0.6	3.1.0
claude-agent-sdk	0.2.168	0.2.173
sqlalchemy	2.1.4	2.1.6
alembic	1.20.0	1.20.1

Updates streamlit from 1.66.0 to 1.66.1

Release notes

Sourced from streamlit's releases.

1.66.1

Full Changelog: streamlit/streamlit@1.66.0...1.66.1

Commits

• ca6718b [chore] Update map and pydeck snapshots from 1.66.1 CI
• 1359d6e [fix] Use canonical timezone names in Python unit tests (#17567)
• 7526d1b [chore] Allow Pillow 13 (#17589)
• c706d9a Up version to 1.66.1
• See full diff in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates claude-agent-sdk from 0.2.168 to 0.2.173

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.173

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.309

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.173/

pip install claude-agent-sdk==0.2.173

v0.2.172

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.308

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.172/

pip install claude-agent-sdk==0.2.172

v0.2.171

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.307

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.171/

pip install claude-agent-sdk==0.2.171

v0.2.170

Bug Fixes

• Fixed parallel tool calls missing from session messages: get_session_messages and get_session_messages_from_store now return every tool call and result from turns that ran tools in parallel. Previously only one branch of the forked transcript was followed, dropping some calls and results (#1422)

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.173

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.309

0.2.172

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.308

0.2.171

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.307

0.2.170

Bug Fixes

• Fixed parallel tool calls missing from session messages: get_session_messages and get_session_messages_from_store now return every tool call and result from turns that ran tools in parallel. Previously only one branch of the forked transcript was followed, dropping some calls and results (#1422)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.306
• CI: release uploads to PyPI now use trusted publishing (GitHub OIDC) instead of a long-lived API token (#1418)

0.2.169

Documentation

• Clarified that include_hook_events does not suppress SessionStart and Setup hook events, which the CLI emits regardless of the setting (#1336)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.305
• CI: hash-pinned the release build tools (build, twine, wheel, hatchling) so a tampered or unexpected download stops the job (#1415)

Commits

• 163f50e docs: update changelog for v0.2.173
• 4059606 chore: release v0.2.173
• c12f3e8 chore: bump bundled CLI version to 2.1.309
• 6b4a557 docs: update changelog for v0.2.172
• a731da4 chore: release v0.2.172
• c3f458a chore: bump bundled CLI version to 2.1.308
• 7b790c7 docs: update changelog for v0.2.171
• 3cb0c27 chore: release v0.2.171
• 507d4e3 chore: bump bundled CLI version to 2.1.307
• dd27b70 docs: update changelog for v0.2.170
• Additional commits viewable in compare view

Updates sqlalchemy from 2.1.4 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

• [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

  This change is also backported to: 2.0.56

  References: #13711

• [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

  References: #13701

• [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

  References: #13709

orm extensions

• [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

  This change is also backported to: 2.0.56

  References: #13680

... (truncated)

Commits

• See full diff in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions