chore(deps): update python-nonmajor

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
PyMySQL (changelog)	==1.2.0 → ==1.2.3
SQLAlchemy (changelog)	==2.0.52 → ==2.0.54
cryptography (changelog)	==50.0.0 → ==50.0.1
filelock	==3.32.3 → ==3.32.7
google-auth (source)	==2.56.3 → ==2.58.0
idna (changelog)	==3.19 → ==3.20
psycopg (changelog)	==3.3.4 → ==3.3.5
psycopg-binary (changelog)	==3.3.4 → ==3.3.5
virtualenv	==21.7.4 → ==21.7.14

---

Release Notes

PyMySQL/PyMySQL (PyMySQL)

v1.2.3

Compare Source

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for
compatibility with aiomysql.

Use pymysql.converters at your own risk.
It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Compare Source

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for
compatibility with aiomysql.
This function does not escape dictionaries and is entirely unnecessary.
Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1

Compare Source

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes
parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets.
This vulnerability also occurs when strings decoded from bytes using
surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

• Queries are now encoded using the strict error handler instead of
  surrogateescape.
  Queries that cannot be encoded using the connection encoding can no longer be sent.

• bytes parameters are now always sent as hexadecimal literals, such as
  X'636174'. Note that this increases the number of bytes sent.

• The binary_prefix parameter of connect() is deprecated. The _binary
  prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to
character encoding.
However, we strongly recommend using UTF-8 (utf8mb4).
Other character sets are not thoroughly tested, and their limited use means
that problems may go unreported. In the 2020s, encodings other than UTF-8
should be considered legacy.

pyca/cryptography (cryptography)

v50.0.1

Compare Source

tox-dev/py-filelock (filelock)

v3.32.7

Compare Source

What's Changed

• Fix final symlink test on musl by @​lprnmns in tox-dev/filelock#737
• 📝 docs: say acquire() falls back to the lock's blocking attribute by @​hxperl in tox-dev/filelock#733

New Contributors

• @​hxperl made their first contribution in tox-dev/filelock#733

Full Changelog: tox-dev/filelock@3.32.6...3.32.7

v3.32.6

Compare Source

What's Changed

• 🐛 fix(lease): reject a duration no marker can carry by @​lprnmns in tox-dev/filelock#723
• 🐛 fix(soft-rw): reject non-finite timing options by @​lprnmns in tox-dev/filelock#724
• fix: preserve exception notes when copying and pickling by @​jackwalkerlabs in tox-dev/filelock#729
• test(soft-rw): reuse existing test module by @​gaborbernat in tox-dev/filelock#730
• fix: respect ACL write access when the owner write bit is absent by @​jackwalkerlabs in tox-dev/filelock#728
• Fix SoftReadWriteLock state lock timeout by @​Sohel2309 in tox-dev/filelock#726

New Contributors

• @​jackwalkerlabs made their first contribution in tox-dev/filelock#729
• @​Sohel2309 made their first contribution in tox-dev/filelock#726

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

v3.32.5

Compare Source

What's Changed

• 🧪 test(fork): report where a stalled fork stops by @​gaborbernat in tox-dev/filelock#715
• 📝 docs: say that mode is read-only in the thread-local section by @​Gares95 in tox-dev/filelock#716
• 🐛 fix(lease): clear token after failed acquire by @​lprnmns in tox-dev/filelock#721

New Contributors

• @​lprnmns made their first contribution in tox-dev/filelock#721

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

v3.32.4

Compare Source

What's Changed

• 🐛 fix: retry transient denials on open and claim read by @​gaborbernat in tox-dev/filelock#705
• 🧪 test: deflake six scheduled-run failures by @​gaborbernat in tox-dev/filelock#704
• 🧪 test: cover a reclaimed private record for real by @​gaborbernat in tox-dev/filelock#706
• 🧪 test(fork): fork once the event loop has closed by @​gaborbernat in tox-dev/filelock#714
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in tox-dev/filelock#713
• escape the hostname every marker publishes by @​dxbjavid in tox-dev/filelock#709

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

googleapis/google-cloud-python (google-auth)

v2.58.0: google-cloud-container: v2.58.0

Compare Source

Features

• A new enum Mode is added (f4d2243)
• A new enum TransparentHugepageDefrag is added (f4d2243)
• A new enum TransparentHugepageEnabled is added (f4d2243)
• A new field additional_ip_ranges_configs is added to message .google.container.v1.IPAllocationPolicy (f4d2243)
• A new field auto_ipam_config is added to message .google.container.v1.IPAllocationPolicy (f4d2243)
• A new field boot_disk is added to message .google.container.v1.NodeConfig (f4d2243)
• A new field boot_disk is added to message .google.container.v1.UpdateNodePoolRequest (f4d2243)
• A new field default_compute_class_config is added to message .google.container.v1.ClusterAutoscaling (f4d2243)
• A new field desired_additional_ip_ranges_config is added to message .google.container.v1.ClusterUpdate (f4d2243)
• A new field desired_auto_ipam_config is added to message .google.container.v1.ClusterUpdate (f4d2243)
• A new field desired_user_managed_keys_config is added to message .google.container.v1.ClusterUpdate (f4d2243)
• A new field eviction_max_pod_grace_period_seconds is added to message .google.container.v1.NodeKubeletConfig (f4d2243)
• A new field eviction_minimum_reclaim is added to message .google.container.v1.NodeKubeletConfig (f4d2243)
• A new field eviction_soft_grace_period is added to message .google.container.v1.NodeKubeletConfig (f4d2243)
• A new field eviction_soft is added to message .google.container.v1.NodeKubeletConfig (f4d2243)
• A new field gke_auto_upgrade_config is added to message .google.container.v1.Cluster (f4d2243)
• A new field gke_auto_upgrade_config is added to message .google.container.v1.ClusterUpdate (f4d2243)
• A new field lustre_csi_driver_config is added to message .google.container.v1.AddonsConfig (f4d2243)
• A new field max_parallel_image_pulls is added to message .google.container.v1.NodeKubeletConfig (f4d2243)
• A new field min_node_cpus is added to message .google.container.v1.SoleTenantConfig (f4d2243)
• A new field mode is added to message .google.container.v1.AnonymousAuthenticationConfig (f4d2243)
• A new field single_process_oom_kill is added to message .google.container.v1.NodeKubeletConfig (f4d2243)
• A new field subnetwork is added to message .google.container.v1.NodeNetworkConfig (f4d2243)
• A new field transparent_hugepage_defrag is added to message .google.container.v1.LinuxNodeConfig (f4d2243)
• A new field transparent_hugepage_enabled is added to message .google.container.v1.LinuxNodeConfig (f4d2243)
• A new message AdditionalIPRangesConfig is added (f4d2243)
• A new message AutoIpamConfig is added (f4d2243)
• A new message BootDisk is added (f4d2243)
• A new message DefaultComputeClassConfig is added (f4d2243)
• A new message DesiredAdditionalIPRangesConfig is added (f4d2243)
• A new message EvictionGracePeriod is added (f4d2243)
• A new message EvictionMinimumReclaim is added (f4d2243)
• A new message EvictionSignals is added (f4d2243)
• A new message GkeAutoUpgradeConfig is added (f4d2243)
• A new message LustreCsiDriverConfig is added (f4d2243)
• A new value CLOUD_KMS_KEY_DESTROYED is added to enum Code (f4d2243)

v2.57.1: google-auth: v2.57.1

Compare Source

Bug Fixes

• auth: parse hostname for mTLS and PSC endpoint certificate rotation (#​18147) (#​18201) (b18bb4c)

v2.57.0: google-cloud-container: v2.57.0

Compare Source

Features

• add allowed_unsafe_sysctls in NodeKubeletConfig (82a928a)
• add allowed_unsafe_sysctls in NodeKubeletConfig (4c98f4e)
• add alpha_cluster_feature_gates in Cluster (82a928a)
• add alpha_cluster_feature_gates in Cluster (4c98f4e)
• add anonymous_authentication_config in Cluster (82a928a)
• add auto_monitoring_config in ManagedPrometheusConfig (82a928a)
• add auto_monitoring_config in ManagedPrometheusConfig (4c98f4e)
• add autopilot_compatibility_auditing_enabled in WorkloadPolicyConfig (82a928a)
• add autopilot_compatibility_auditing_enabled in WorkloadPolicyConfig (4c98f4e)
• add ClusterUpgradeInfo (82a928a)
• add ClusterUpgradeInfo (4c98f4e)
• add confidential_instance_type in ConfidentialNodes (82a928a)
• add confidential_instance_type in ConfidentialNodes (4c98f4e)
• add container_log_max_files in NodeKubeletConfig (82a928a)
• add container_log_max_files in NodeKubeletConfig (4c98f4e)
• add container_log_max_size in NodeKubeletConfig (82a928a)
• add container_log_max_size in NodeKubeletConfig (4c98f4e)
• add control_plane_endpoints_config in Cluster (82a928a)
• add data_cache_count in EphemeralStorageLocalSsdConfig (82a928a)
• add data_cache_count in EphemeralStorageLocalSsdConfig (4c98f4e)
• add desired_anonymous_authentication_config in ClusterUpdate (82a928a)
• add desired_anonymous_authentication_config in ClusterUpdate (4c98f4e)
• add desired_compliance_posture_config in ClusterUpdate (82a928a)
• add desired_control_plane_endpoints_config in ClusterUpdate (82a928a)
• add desired_default_enable_private_nodes in ClusterUpdate (82a928a)
• add desired_disable_l4_lb_firewall_reconciliation in ClusterUpdate (82a928a)
• add desired_disable_l4_lb_firewall_reconciliation in ClusterUpdate (4c98f4e)
• add desired_enterprise_config in ClusterUpdate (82a928a)
• add desired_node_pool_auto_config_linux_node_config in ClusterUpdate (82a928a)
• add desired_pod_autoscaling in ClusterUpdate (82a928a)
• add desired_pod_autoscaling in ClusterUpdate (4c98f4e)
• add desired_rbac_binding_config in ClusterUpdate (82a928a)
• add disable_l4_lb_firewall_reconciliation in NetworkConfig (82a928a)
• add disable_l4_lb_firewall_reconciliation in NetworkConfig (4c98f4e)
• add effective_cgroup_mode in NodeConfig (82a928a)
• add event_type in UpgradeInfoEvent (82a928a)
• add event_type in UpgradeInfoEvent (4c98f4e)
• add extended_support_end_time in UpgradeInfoEvent (82a928a)
• add extended_support_end_time in UpgradeInfoEvent (4c98f4e)
• add FetchClusterUpgradeInfoRequest (82a928a)
• add FetchClusterUpgradeInfoRequest (4c98f4e)
• add FetchNodePoolUpgradeInfoRequest (82a928a)
• add FetchNodePoolUpgradeInfoRequest (4c98f4e)
• add flex_start in NodeConfig (82a928a)
• add flex_start in NodeConfig (4c98f4e)
• add flex_start in UpdateNodePoolRequest (82a928a)
• add flex_start in UpdateNodePoolRequest (4c98f4e)
• add high_scale_checkpointing_config in AddonsConfig (82a928a)
• add high_scale_checkpointing_config in AddonsConfig (4c98f4e)
• add image_gc_high_threshold_percent in NodeKubeletConfig (82a928a)
• add image_gc_high_threshold_percent in NodeKubeletConfig (4c98f4e)
• add image_gc_low_threshold_percent in NodeKubeletConfig (82a928a)
• add image_gc_low_threshold_percent in NodeKubeletConfig (4c98f4e)
• add image_maximum_gc_age in NodeKubeletConfig (82a928a)
• add image_maximum_gc_age in NodeKubeletConfig (4c98f4e)
• add image_minimum_gc_age in NodeKubeletConfig (82a928a)
• add image_minimum_gc_age in NodeKubeletConfig (4c98f4e)
• add JOBSET in MonitoringComponentConfig.Component (82a928a)
• add JOBSET in MonitoringComponentConfig.Component (4c98f4e)
• add KCP_HPA in LoggingComponentConfig.Component (82a928a)
• add KCP_HPA in LoggingComponentConfig.Component (4c98f4e)
• add linux_node_config in NodePoolAutoConfig (82a928a)
• add local_ssd_encryption_mode in NodeConfig (82a928a)
• add max_run_duration in NodeConfig (82a928a)
• add max_run_duration in NodeConfig (4c98f4e)
• add max_run_duration in UpdateNodePoolRequest (82a928a)
• add max_run_duration in UpdateNodePoolRequest (4c98f4e)
• add MemoryManager (82a928a)
• add mitigated_versions in SecurityBulletinEvent (82a928a)
• add mitigated_versions in SecurityBulletinEvent (4c98f4e)
• add NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS in StatusCondition.Code (82a928a)
• add NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS in StatusCondition.Code (4c98f4e)
• add NodePoolUpgradeInfo (82a928a)
• add NodePoolUpgradeInfo (4c98f4e)
• add parallelstore_csi_driver_config in AddonsConfig (82a928a)
• add performance_monitoring_unit in AdvancedMachineFeatures (82a928a)
• add performance_monitoring_unit in AdvancedMachineFeatures (4c98f4e)
• add pod_autoscaling in Cluster (82a928a)
• add pod_autoscaling in Cluster (4c98f4e)
• add private_endpoint_enforcement_enabled in MasterAuthorizedNetworksConfig (82a928a)
• add rbac_binding_config in Cluster (82a928a)
• add standard_support_end_time in UpgradeInfoEvent (82a928a)
• add standard_support_end_time in UpgradeInfoEvent (4c98f4e)
• add storage_pools in NodeConfig (82a928a)
• add storage_pools in UpdateNodePoolRequest (82a928a)
• add topology_manager in NodeKubeletConfig (82a928a)
• add topology_manager in NodeKubeletConfig (4c98f4e)
• add TopologyManager (82a928a)
• add UPGRADE_INFO_EVENT in NotificationConfig.EventType (82a928a)
• add UPGRADE_INFO_EVENT in NotificationConfig.EventType (4c98f4e)
• add upgrade_target_version in ReleaseChannelConfig (82a928a)
• add UpgradeDetails (82a928a)
• add UpgradeDetails (4c98f4e)
• add user_managed_keys_config in Cluster (82a928a)
• add user_managed_keys_config in ClusterUpdate (82a928a)

Documentation

• Minor documentation updates (82a928a)
• Minor documentation updates (4c98f4e)

kjd/idna (idna)

v3.20

Compare Source

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental
  codec.
• Add support for Python 3.15.

psycopg/psycopg (psycopg)

v3.3.5

Compare Source

pypa/virtualenv (virtualenv)

v21.7.14

Compare Source

What's Changed

• 🐛 fix(activation): escape ! for csh history expansion by @​gaborbernat in #​3256

Full Changelog: pypa/virtualenv@21.7.13...21.7.14

v21.7.13

Compare Source

What's Changed

• 👷 ci: correct a stale checkout pin comment by @​gaborbernat in #​3254
• 🔧 chore: drop misc as a changelog fragment type by @​gaborbernat in #​3255
• 👷 ci: scope the nushell apt key to its own repo by @​gaborbernat in #​3253
• 🐛 fix(activation): stop path command injection in bash and fish by @​gaborbernat in #​3252

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

v21.7.12

Compare Source

What's Changed

• 🔧 chore(changelog): drop dead CVE-2026-24049 fragment by @​gaborbernat in #​3249
• 🐛 fix(activation): escape batch quote() against injection by @​gaborbernat in #​3250
• 🐛 fix(seed): verify downloaded wheel digests by @​gaborbernat in #​3251

Full Changelog: pypa/virtualenv@21.7.11...21.7.12

v21.7.11

Compare Source

What's Changed

• Add OpenSSF Scorecard workflow by @​gaborbernat in #​3238
• Document AI-assisted contributions and licensing policy by @​gaborbernat in #​3239
• 👷 ci(release): attest and sign release provenance by @​gaborbernat in #​3242
• 👷 ci: harden Scorecard-scored checks in CI by @​gaborbernat in #​3241
• 🐛 fix(ci): parallelize graalpy tests, recover crashed workers by @​gaborbernat in #​3240
• 🐛 fix(ci): mark real-shell activation tests as slow by @​gaborbernat in #​3243
• 👷 ci: run macOS jobs on macos-26 by @​gaborbernat in #​3244
• 🐛 fix(activation): undo a live activation before activate.bat saves values by @​darrenhuai in #​3245
• 🐛 fix(create): keep pyvenv.cfg values on a single line by @​gaborbernat in #​3247
• 🔧 chore(test): add opt-in Atheris fuzz harness by @​gaborbernat in #​3246
• 📝 docs(readme): add OpenSSF Best Practices badge by @​gaborbernat in #​3248

Full Changelog: pypa/virtualenv@21.7.10...21.7.11

v21.7.10

Compare Source

What's Changed

• 🔧 chore: check spelling with typos in pre-commit by @​even-even in #​3235
• 🐛 fix(activation): keep and restore the user's TCL_LIBRARY and TK_LIBRARY by @​darrenhuai in #​3234
• 🐛 fix(create): skip blank and comment lines in pyvenv.cfg by @​r3wretrhy in #​3232
• 🐛 fix(activation): restore PKG_CONFIG_PATH that was not set before by @​darrenhuai in #​3233

New Contributors

• @​r3wretrhy made their first contribution in #​3232

Full Changelog: pypa/virtualenv@21.7.9...21.7.10

v21.7.9

Compare Source

What's Changed

• fix(test): EncodingWarning: 'encoding' argument not specified by @​even-even in #​3228
• 🐛 fix(config): ignore a config file that fails to parse instead of crashing by @​darrenhuai in #​3230
• 🐛 fix(util): replace a stale symlink instead of writing through it by @​darrenhuai in #​3229

Full Changelog: pypa/virtualenv@21.7.8...21.7.9

v21.7.8

Compare Source

What's Changed

• 🐛 fix(create): report a missing source that both modes need by @​darrenhuai in #​3227

Full Changelog: pypa/virtualenv@21.7.7...21.7.8

v21.7.7

Compare Source

What's Changed

• 📄 docs: document the interpreter names in an environment by @​gaborbernat in #​3225
• 🎨 refactor(create): read the system exe without narrowing by @​gaborbernat in #​3224

Full Changelog: pypa/virtualenv@21.7.6...21.7.7

v21.7.6

Compare Source

What's Changed

• 🐛 fix(create): name Windows venv exes after the interpreter by @​darrenhuai in #​3223

Full Changelog: pypa/virtualenv@21.7.5...21.7.6

v21.7.5

Compare Source

What's Changed

• 🐛 fix(types): adapt to python-discovery 1.5.2 annotations by @​gaborbernat in #​3211
• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in #​3210
• Push renamed changelog to PR branch in upgrade workflow by @​gaborbernat in #​3213
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in #​3219
• docs: actualize python support version by @​even-even in #​3220
• 🐛 fix(create): check every execute bit in ExePathRef.can_run by @​darrenhuai in #​3217
• 🐛 fix(util): make safe_delete's error handler actually run by @​darrenhuai in #​3222

New Contributors

• @​even-even made their first contribution in #​3220

Full Changelog: pypa/virtualenv@21.7.4...21.7.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun