[dependabot]

Updates the requirements on fastapi, sqlalchemy, polars, duckdb and libpysal to permit the latest version.
Updates fastapi to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

• [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

  This change is also backported to: 2.0.56

  References: #13711

• [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

  References: #13701

• [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

  References: #13709

orm extensions

• [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

  This change is also backported to: 2.0.56

  References: #13680

... (truncated)

Commits

• See full diff in compare view

Updates polars to 2.1.0

Release notes

Sourced from polars's releases.

Python Polars 2.1.0

💥 Breaking changes

• Disallow mixed string <=> numeric arithmetic in eager (#30071)

🚀 Performance improvements

• Limit the memory of buckets sorted ahead in the sort flush (#30297)
• Make file readers wait for spills while over the memory budget (#30296)
• Count unspilled frames in the memory estimate right away (#30295)
• Simplify more boolean expressions and drop redundant null checks (#30293)
• Wait for spills while over the out-of-core memory budget (#30294)
• Lower the default out-of-core prefetch fraction to 0.5 (#30292)
• Aggregate unique and n_unique in the streaming group-by itself (#30281)
• Return freed memory to the OS right away while out-of-core data is spilled (#30280)
• Gather List(Array) and Array columns without per-row slices (#30278)
• Evaluate the streaming window node out of core (#30282)
• Avoid deep copies when building a DataFrame from flat dataclasses (#30275)
• Sort the window partitions by each order key instead of their row encoding (#30277)
• Scan the haystack for a single needle in is_in (#30276)
• Prefer fixed-width columns when only the row count is needed (#30274)
• Native gather for List arrays (#30019)
• Evaluate windows in filter predicates in the streaming window node (#30272)
• Don't busy-wait in RAYON.block_on (#30259)
• Encode nested Parquet levels directly from the level buffers (#30251)
• Reduce memory of CSV scans on wide rows (#30165)
• Avoid quadratic JSON serialization of nested lists and maps (#30203)
• Skip the gather when exploding lists without nulls (#30234)
• Speed up writing nested Parquet columns (#30245)
• Don't keep whole parquet string dictionaries alive for a few selected rows (#30248)
• Set default spill compression level to 1 (#30237)
• Reuse zstd contexts in compression and avoid memcpys (#30233)
• Remove repeated and scalar ordering keys before the sort rewrites (#30231)
• Remove repeated keys from by's (#30095)
• Keep only one guessed unique key per join order leaf (#30191)
• Don't let extra join keys shrink an estimate once one key is unique (#30190)
• Reduce binary size of asof join with by keys (#30192)
• Reduce binary size of SQL visitors and parallel group-by collect (#30171)
• Push as-of join key filters to the right input (#30123)
• Drop null as-of right keys with a parallel filter before the join node (#30125)
• Keep as-of nearest join state small (#30126)
• Explode lists in group_by aggregations without a per-group apply (#30020)
• Streaming OOC group-by with shuffles (#29911)
• Drop scalar ordering keys in the optimizer (#30063)
• Merge union inputs that scan files of the same kind into one multi-file scan (#30056)
• Use the streaming scalar window for std, var and combined reductions in over (#30066)
• Limit the bytes of local CSV and NDJSON files read at once in multi-file scans (#30055)
• Check the matched flag of join keys in the table entry before the bitset (#30067)
• Track matched build rows of all join tables in a bitset (#30050)
• Add dedicated list gather kernels (#30049)

... (truncated)

Commits

• 7f902bd Python Polars 2.1.0 (#30124)
• dfb63c7 fix(rust): Include rolling index columns in expression metadata (#29245)
• a26073c perf: Limit the memory of buckets sorted ahead in the sort flush (#30297)
• 8d11086 test: Fix allocator-dependent failure in masked zero-copy to_numpy test (#3...
• a9a998b perf: Make file readers wait for spills while over the memory budget (#30296)
• 8b57b77 perf: Count unspilled frames in the memory estimate right away (#30295)
• 720d744 refactor: Simplify the out-of-core decay state and tests (#30283)
• f7a3227 perf: Simplify more boolean expressions and drop redundant null checks (#30293)
• 48de7ae perf: Wait for spills while over the out-of-core memory budget (#30294)
• 28cfd43 fix: Compare Array(Struct) rows field by field (#30290)
• Additional commits viewable in compare view

Updates duckdb to 2.0.0

Release notes

Sourced from duckdb's releases.

DuckDB v2.0.0

duckdb-python 2.0.0 is the Python package for DuckDB 2.0. It supports Python >= 3.11 and drops Python 3.10. From Python 3.12 on, one wheel per platform serves every Python version. The binding layer was rewritten on nanobind, query results stream instead of being collected up front, the relational API was rebuilt on SQL text, and the way DataFrames, Arrow data and polars frames are read was replaced. Many long-standing bugs are fixed, and moving data in and out of Python is much faster. The engine is DuckDB 2.0.0; see its release notes for what changed in SQL and storage.

Highlights

• Moving data is much faster. Numeric exports to numpy, pandas, Arrow and polars take a quarter to two fifths of the 1.5 time; in-memory Arrow, polars and pandas 3 inputs are scanned on all threads, 8x to 20x faster; Arrow UDFs run about 20x faster; draining an Arrow reader on 16 threads takes an eighth of the time. (#693, #697, #700)
• Results stream. con.execute() starts the query and you read rows as you fetch them; con.complete() and con.abort() finish or cancel an open result, and an open result or Arrow reader owns the connection until it is done.
• The relational API is rebuilt on SQL text. A relation is a lazy query, bound at every step so its schema is known; rel.sql_query() shows exactly what will run. Many new methods and expression helpers (col, lit, when, window functions). One semantic change: a plain string in an expression is a value, not a column name. (#697)
• A new Appender for fast bulk inserts: with con.appender("t") as a: a.append_row(...), under a microsecond per row. (#661)
• One stable ABI wheel per platform for Python 3.12 and later, so a new Python release works on day one. Python 3.15 is supported. (#672, #673, #684)
• Arrow export on con.execute() results changed: fetch_arrow_table, fetch_record_batch and arrow(n) are gone; use con.sql(query).to_arrow_table() or .to_arrow_reader(). (#702)
• The experimental Spark API is brought up to date: it is now compatible with PySpark 4.2.0 and 3.5.9 (#686). We would love your input on whether to continue support or to drop it in future releases.

Upgrading from 1.x: what to check

1. Make sure you run Python 3.11 or later.
2. If you call fetch_arrow_table, fetch_record_batch, arrow(n) or pl() on the result of con.execute(), switch to con.sql(query).to_arrow_table(), to_arrow_reader() or pl(). Libraries that call the removed names on an execute result need an update. (#702)
3. If you call fetchone(), fetchmany(), fetch_df_chunk() or execute() on a relation, use rel.limit(n).fetchall(), rel.to_arrow_reader(), rel.materialize(), or run the query through con.execute(). (#697)
4. If you compare a relation column with a plain string, col("s") == "x" now compares with the text x. Wrap column names in col(). (#697)
5. If you rely on import duckdb having opened the default database, note that it happens on the first duckdb.sql() or duckdb.connect() call instead. (#680)
6. If you pass Decimal values with a positive exponent, such as Decimal("1E+2"), they now arrive as the number they denote, 100, where 1.5 produced 1.00. (#654)
7. If you write files with overwrite=False, an existing file is now refused instead of replaced. (#668)
8. If a test or script depends on str(rel) being free, note that it runs the query each time now.

Breaking changes

Arrow export on DB-API results (#702)

Results of con.execute() are now read row by row and are not kept in memory, so they cannot hand their data to Arrow for free. fetch_arrow_table, fetch_record_batch, arrow(rows_per_batch) and pl() on a DB-API result are removed; they had been deprecated. to_arrow_table() and to_arrow_reader() remain, also as duckdb.to_arrow_table() and duckdb.to_arrow_reader(), but they materialize the rows twice, once as the result and once as Arrow, and emit a UserWarning pointing at the relational path, con.sql(query).to_arrow_table(), which we recommend instead. The reader no longer streams: its first batch arrives after the whole query ran. After a partial fetchone or fetchmany the Arrow call returns the remaining rows instead of raising. With preserve_insertion_order off, the row order can differ between calls. duckdb.arrow(n) with an integer is gone; duckdb.arrow(arrow_object) still builds a relation.

# 1.5
table = con.execute("SELECT * FROM t").fetch_arrow_table()
reader = con.execute("SELECT * FROM t").fetch_record_batch(10_000)
2.0
table = con.sql("SELECT * FROM t").to_arrow_table()
reader = con.sql("SELECT * FROM t").to_arrow_reader(10_000)

Relations are SQL text (#697)

The relational API is a query building API, not an execution API. A relation is a piece of SQL text with a schema bound once when it is built, so every step knows its columns and types. It runs nothing until you ask for data, and it runs again on every read; rel.sql_query() returns exactly the text that runs, as one SELECT per group of steps and a common table expression where the order of clauses breaks. The engine's binder decides every column name and type; nothing is renamed by the client.

What you are most likely to notice:

• A bare string operand of an expression is a value, not a column. For one release a warning is raised when the string matches a column name; the warning goes in 2.1. A dotted string is not split into parts; pass the parts separately.

... (truncated)

Commits

• 83c7199 Build the dictionary test's indices with a 64 bit arange (#705)
• b12fd55 Build the dictionary test's indices with a 64 bit arange
• 6aa2ce3 Build the Linux and macOS wheels with clang and ThinLTO (#703)
• 2f0ac79 Pin submodule to v2.0.0 hash
• f7826ad Fix wrong values and lost parallelism in the pandas, numpy and Arrow input sc...
• 2f2a0dd Bring back to_arrow_table and to_arrow_reader on DB-API results over a re-fee...
• 6086a15 Keep the macOS wheels native, like the engine's release
• 07ee3e2 Build the Linux and macOS wheels with clang and ThinLTO
• a2c151f Register the linked extensions when the module loads, not only on import (#701)
• dd2a3e9 Read numpy masks a word at a time
• Additional commits viewable in compare view

Updates libpysal to 4.15.1

Release notes

Sourced from libpysal's releases.

v4.15.1

What's Changed

Bug Fixes

• Fix/clique expansion by @​ljwolf in pysal/libpysal#938
• BUG: Graph.build_travel_cost does not support GeoSeries by @​martinfleis in pysal/libpysal#946

Maintenance

• drop macOS intel chip testing by @​jGaboardi in pysal/libpysal#942

Other Changes

• Add network marker on some new tests by @​QuLogic in pysal/libpysal#926
• add libjxl for build_docs action by @​sjsrey in pysal/libpysal#927
• GHA: fix the version switcher update by @​martinfleis in pysal/libpysal#929
• revert #927 by @​martinfleis in pysal/libpysal#928
• update docs extra in pyproject by @​martinfleis in pysal/libpysal#930
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pysal/libpysal#931
• fix adaptive bandwidth crashes when combined with coplanar='clique' by @​ljwolf in pysal/libpysal#933
• Bump actions/setup-python from 6 to 7 by @​dependabot[bot] in pysal/libpysal#934
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pysal/libpysal#941
• pin pulp to <4 by @​martinfleis in pysal/libpysal#943
• Fix/distance band divide by zero warning by @​sjsrey in pysal/libpysal#936

Full Changelog: pysal/libpysal@v4.15.0...v4.15.1

Changelog

Sourced from libpysal's changelog.

Version 4.3.0 (2020-06-28)

We closed a total of 85 issues (enhancements and bug fixes) through 27 pull requests, since our last release on 2020-02-01.

Issues Closed

• Standardize libpysal/examples/*.py docstrings (#294)
• Fetch (#295)
• Mac builds seem to take longer — bump up timeout (#273)
• Voronoi_frames function causes jupyter notebook kernel to die (#281)
• ENH: allow specific buffer in fuzzy_contiguity (#280)
• Return alpha option & use pygeos for alphashaping if available (#278)
• add weights writing as a method on weights. (#276)
• Docs ci badge (#277)
• [rough edge] libpysal.examples w/o internet? (#259)
• removing six from ci (#275)
• Handle connection errors for remote datasets (#274)
• examples directory prevents installing with pyInstaller (#263)
• GH-263: Don't implicitly import examples when importing base library (#264)
• Error in the internal hack for the Arc_KDTree class inheritance and the KDTree function (#254)
• GitHub Actions failures (#271)
• Bugfix (#255)
• dropping nose in ci/36.yml (#270)
• Follow-up To Do for GH Actions (#268)
• Polish up GitHub Action residuals (#269)
• TEST: turning off 3.6 on github actions (#266)
• Initializing complete Github Actions CI (#267)
• fix for issue #153 (#256)
• DOC: Udpdating citations, minor description editing (#265)
• Cleaning up weights/weights.py docs (#262)
• Unused code in weights.from_networkx()? (#261)
• redirect pysal/#934 to libpysal (#9)
• defaulting to using the dataframe index as the id set (#35)
• Handling coincident points in KNN (#23)
• MGWR_Georgia_example.ipynb fails due to different sample data shapes (#67)
• Kernel docstring does not mention unique Gaussian kernel behavior (#47)
• MGWR_Georgia_example.ipynb missing pickle import statement (#69)
• weights.Voronoi is a function, not a class. (#99)
• some weights util functions are lost in ini.py (#121)
• Current weight plot method is time consuming for a large data set (#123)
• [ENH][WIP] Adding a rasterW to extract W from raster and align values (#150)
• network kernel weights (#151)
• Add from_sparse and from_numpy methods, to match the other from_ methods (#173)
• Weight Object Question (#208)
• ENH: setting up github actions (#258)
• deprecate or test shapely_ext (#114)
• Tests failures under Python 3.8 (#177)
• Update reqs for tests (#250)
• Nbdocs (#253)
• test_fiiter fails on 3.8 but passes on < 3.8 (#249)
• 3.8 (#251)

... (truncated)

Commits

• bd91887 Fix/distance band divide by zero warning (#936)
• 5300d0b Merge pull request #946 from martinfleis/travel-series
• b159689 Merge pull request #938 from ljwolf/fix/clique-expansion
• 1282b4d BUG: Graph.build_travel_cost does not support GeoSeries
• 9aaeb55 pin pulp to <4 (#943)
• 1f3c76a drop macOS intel chip testing (#942)
• bb570d8 [pre-commit.ci] pre-commit autoupdate (#941)
• 3fcf285 fill value required explicitly due to #937
• 25b5242 fix #937 by expanding groups
• b808e7c Bump actions/setup-python from 6 to 7 (#934)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dgz-engineering	Building	Preview	Nov 1, 2026 6:39pm UTC