chore(deps): bump the all-dependencies group in /core/python/long-horizon-harness with 19 updates

[dependabot]

Updates the requirements on google-cloud-logging, fastapi, uvicorn, pyjwt, python-multipart, pyopenssl, dateparser, google-cloud-storage, google-cloud-aiplatform[agent-engines], google-api-python-client, a2a-sdk[http-server,sqlite], google-cloud-secret-manager, croniter, pandas, matplotlib, ruff, ty, codespell and pytest-asyncio to permit the latest version.
Updates google-cloud-logging from 3.15.0 to 3.16.1

Release notes

Sourced from google-cloud-logging's releases.

google-cloud-logging: v3.16.1

3.16.1 (2026-07-07)

Documentation

• logging: fix StructuredLogHandler docstring parameter name (#17625) (32862f0), closes #17604

Changelog

Sourced from google-cloud-logging's changelog.

Changelog

PyPI History

Commits

• fc6b861 chore: release main (#17600)
• 9638879 feat: update googleapis and regenerate (#17635)
• 6a49390 chore: update goldens (#17632)
• 32862f0 docs(logging): fix StructuredLogHandler docstring parameter name (#17625)
• d68c11d chore(deps): Bump Pillow version constraint in google-cloud-documentai-toolbo...
• adf7d27 test(spanner): await database calls in async snippets (#17627)
• 247e2ad refactor(auth): replace pyOpenSSL with standard ssl and cryptography (#16976)
• fd0e4b6 chore(spanner): remove unused asyncio import in samples (#17620)
• f538ad8 fix(auth): handle PermissionError on workload certificates to avoid startup h...
• 0f4bfed fix: bump gdal from 3.13.0 to 3.13.1 in /packages/bigframes (#17609)
• Additional commits viewable in compare view

Updates fastapi from 0.136.1 to 0.140.6

Release notes

Sourced from fastapi's releases.

0.140.6

Refactors

• ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #16073 by @​tiangolo.

0.140.5

Refactors

• ⚡️ Avoid flattening dependencies for body fields. PR #16071 by @​tiangolo.

0.140.4

Refactors

• ⚡️ Skip unused dependency repeat bookkeeping. PR #16069 by @​tiangolo.

0.140.3

Refactors

• ⚡️ Avoid repeated dependency flattening in OpenAPI. PR #16067 by @​tiangolo.

0.140.2

Refactors

• ⚡️ Stop retaining flat dependency trees. PR #16065 by @​tiangolo.

Internal

• 👷 Add new memory benchmark. PR #16064 by @​tiangolo.

0.140.1

Refactors

• ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #16062 by @​tiangolo.

0.140.0

Refactors

• ⚡️ Reduce memory usage in dependencies. PR #16049 by @​tiangolo.

Docs

• 📝 Fix links in docs. PR #15967 by @​YuriiMotov.
• 📝 Add Library Skills documentation. PR #16041 by @​tiangolo.
• 📝 Update docs to use uv projects by default. PR #16032 by @​tiangolo.
• 📝 Restructure FastAPI People and related pages. PR #16015 by @​tiangolo.

Internal

• 👷 Add CI memory benchmark. PR #16046 by @​tiangolo.
• 👥 Update FastAPI People - Sponsors. PR #16027 by @​tiangolo.

... (truncated)

Commits

• bcd4e89 🔖 Release version 0.140.6 (#16074)
• 27c922c 📝 Update release notes
• cc96fd3 ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI (...
• ac068db 🔖 Release version 0.140.5 (#16072)
• 6be87d1 📝 Update release notes
• 23e4a10 ⚡️ Avoid flattening dependencies for body fields (#16071)
• 7ac0f1b 🔖 Release version 0.140.4 (#16070)
• 44e4eea 📝 Update release notes
• 7134121 ⚡️ Skip unused dependency repeat bookkeeping (#16069)
• 415d37f 🔖 Release version 0.140.3 (#16068)
• Additional commits viewable in compare view

Updates uvicorn from 0.47.0 to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

• Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @​Kludex in Kludex/uvicorn#3025
• Remove colorama from the standard extra by @​Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation by @​Aayush7352 in Kludex/uvicorn#3019

New Contributors

• @​Aayush7352 made their first contribution in Kludex/uvicorn#3019

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

• Memoize trusted host checks to avoid re-parsing the client IP per request by @​Kludex in Kludex/uvicorn#2970
• Cache the asgi scope sub-dict per connection by @​Kludex in Kludex/uvicorn#2976
• Build a fresh asgi scope dict per request by @​Kludex in Kludex/uvicorn#2977
• Replace click.style with an internal ANSI style helper by @​Kludex in Kludex/uvicorn#2981
• Avoid copying single-frame WebSocket payloads in websockets-sansio by @​Kludex in Kludex/uvicorn#2983
• Deprecate the legacy websockets implementation and default auto to websockets-sansio by @​Kludex in Kludex/uvicorn#2985
• Exit with a dedicated code on startup failure and stop the supervisor when a worker can't boot by @​Kludex in Kludex/uvicorn#3001
• Skip the eager app import in the parent when spawning workers by @​Kludex in Kludex/uvicorn#3012

Full Changelog: Kludex/uvicorn@0.49.0...0.50.0

Version 0.49.0

What's Changed

• Bump httptools minimum version to 0.8.0 by @​Kludex in Kludex/uvicorn#2962
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by @​Kludex in Kludex/uvicorn#2971

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Version 0.48.0

What's Changed

• Default ssl_ciphers to None and use OpenSSL defaults by @​Kludex in Kludex/uvicorn#2940
• Ignore duplicate forwarding headers in ProxyHeadersMiddleware by @​Kludex in Kludex/uvicorn#2944

Full Changelog: Kludex/uvicorn@0.47.0...0.48.0

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

• Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)
• Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)
• Default --ws auto to websockets-sansio when websockets is installed (#2985)
• Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)
• Build a fresh asgi scope dict per request (#2977)
• Cache the asgi scope sub-dict per connection (#2976)
• Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)
• Memoize trusted host checks in ProxyHeadersMiddleware (#2970)
• Replace click.style with an internal ANSI style helper (#2981)

Deprecated

• Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

0.49.0 (June 3, 2026)

Changed

• Bump httptools minimum version to 0.8.0 (#2962)
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

... (truncated)

Commits

• e4d0b05 Version 0.51.0 (#3028)
• 944e43d Remove colorama from the standard extra (#3027)
• 2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
• a1b570c Version 0.50.2 (#3022)
• 83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
• b4d0116 Version 0.50.1 (#3020)
• 2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
• 1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
• 837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
• 21d2c16 Version 0.50.0 (#3013)
• Additional commits viewable in compare view

Updates pyjwt from 2.12.1 to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

• GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @​aradona91.

• GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @​sushi-gif.

• GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @​thesmartshadow.

• GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @​KEIJOT.

• GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @​eddieran.

Fixed

• Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @​SnailSploit and @​spartan8806 for the reports.
• Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @​WLUB for the report.
• RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @​MachineLearning-Nerd for the report.

Changed

• Migrate the dev, docs, and tests package extras to dependency groups, by @​kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

• Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
• PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
• PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
• b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
• enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

Changelog

Sourced from pyjwt's changelog.

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

Security

- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.
Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.
Changed



Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__

Commits

• 7144e45 Apply ruff format
• d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
• 22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
• 95791b1 Bundle security fixes and hardening into 2.13.0
• dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
• 9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
• b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
• 40e3147 Migrate development extras to dependency groups (#1152)
• See full diff in compare view

Updates python-multipart from 0.0.29 to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

• Replace per-byte partial-boundary scan with rfind lookbehind by @​Kludex in Kludex/python-multipart#300

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Version 0.0.31

What's Changed

• Speed up multipart header parsing and callback dispatch by @​Kludex in Kludex/python-multipart#295
• Bound header field name size before validating by @​Kludex in Kludex/python-multipart#296
• Validate Content-Length is non-negative in parse_form by @​Kludex in Kludex/python-multipart#297

Full Changelog: Kludex/python-multipart@0.0.30...0.0.31

Version 0.0.30

What's Changed

• Treat only & as the urlencoded field separator by @​Kludex in Kludex/python-multipart#290
• Ignore RFC 2231 extended parameters in parse_options_header by @​Kludex in Kludex/python-multipart#291

Full Changelog: Kludex/python-multipart@0.0.29...0.0.30

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

• Speed up partial-boundary scanning for CR/LF-dense part data #300.

0.0.31 (2026-06-04)

• Speed up multipart header parsing and callback dispatch #295.
• Bound header field name size before validating #296.
• Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

• Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.
• Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.

Commits

• 238ead6 Version 0.0.32 (#302)
• 8672979 Replace per-byte partial-boundary scan with rfind lookbehind (#300)
• 8190779 Bump the python-packages group with 7 updates (#301)
• 0d3c086 Use uv package ecosystem for Dependabot (#299)
• 4cffc68 Version 0.0.31 (#298)
• c814948 Reject negative Content-Length in parse_form (#297)
• 6b837d4 Bound header field name size before validating (#296)
• e0c4f9d Bump the github-actions group with 3 updates (#294)
• b8a01bb Bump the python-packages group with 3 updates (#293)
• 6732164 Speed up multipart header parsing and callback dispatch (#295)
• Additional commits viewable in compare view

Updates pyopenssl from 24.3.0 to 26.3.0

Changelog

Sourced from pyopenssl's changelog.

26.3.0 (2026-06-12)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Dropped support for Python 3.8.
• The minimum cryptography version is now 49.0.0.
• Removed deprecated OpenSSL.crypto.X509Req, OpenSSL.crypto.dump_certificate_request, and OpenSSL.crypto.load_certificate_request. cryptography.x509 should be used instead.
• OpenSSL.SSL.Connection.set_session now raises ValueError if the Session was obtained from a Connection that was using a different Context than this one. OpenSSL requires (but does not verify) that sessions only be re-used with a compatible SSL_CTX, so this contract is now enforced.

Deprecations: ^^^^^^^^^^^^^

• Deprecated OpenSSL.crypto.PKey.generate_key and OpenSSL.crypto.PKey.check. The key generation and loading APIs in cryptography should be used instead.
• Deprecated OpenSSL.crypto.dump_privatekey. The serialization APIs on cryptography private key types should be used instead.
• Deprecated all the mutable APIs on OpenSSL.crypto.X509: set_version, set_pubkey, sign, set_serial_number, gmtime_adj_notAfter, gmtime_adj_notBefore, set_notBefore, set_notAfter, set_issuer, and set_subject. cryptography.x509.CertificateBuilder should be used instead.
• Deprecated OpenSSL.SSL.Context.set_passwd_cb. Users should decrypt and load their private keys themselves, with cryptography's key loading APIs, and then call OpenSSL.SSL.Context.use_privatekey.
• Deprecated OpenSSL.crypto.X509Name, as well as the remaining APIs that consume or return it: OpenSSL.crypto.X509.get_issuer, OpenSSL.crypto.X509.get_subject, and OpenSSL.SSL.Context.set_client_ca_list. The APIs in cryptography.x509 should be used instead.

Changes: ^^^^^^^^

• OpenSSL.SSL.Connection.get_client_ca_list now takes an as_cryptography keyword-argument. When True is passed then cryptography.x509.Name are returned, instead of OpenSSL.crypto.X509Name. In the future, passing False (the default) will be deprecated.

26.2.0 (2026-05-04)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Removed deprecated OpenSSL.crypto.X509Extension, OpenSSL.crypto.X509Req.add_extension, OpenSSL.crypto.X509Req.get_extensions, OpenSSL.crypto.X509.add_extension, OpenSSL.crypto.X509.get_extensions. cryptography.x509 should be used instead.
• It is now an error to calling any mutating method on OpenSSL.SSL.Context after it has been used to create a Connection. This was previously deprecated and has always been unsafe.

Deprecations: ^^^^^^^^^^^^^

Changes: ^^^^^^^^

• Maximum supported cryptography version is now 48.x.
• Added OpenSSL.SSL.Connection.set_options to set options on a per-connection basis.

26.1.0 (2026-04-24)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

... (truncated)

Commits

• a34aa1d Prepare 26.3.0 release (#1515)
• 24db880 Deprecate X509Name and the remaining APIs that consume or return it (#1514)
• 1dc08be Add as_cryptography parameter to Connection.get_client_ca_list (#1508)
• 55653a5 Require cryptography 49, drop Python 3.8 (#1513)
• 9bad760 Remove deprecated CSR functionality (#1507)
• 98ca874 Enforce that Session is only re-used with the Context it came from (#1512)
• cbcb1da Deprecate Context.set_passwd_cb (#1511)
• 3b9d07d Deprecate all the mutable APIs on X509 (#1510)
• e096920 Deprecate PKey.generate_key, PKey.check, and dump_privatekey (#1509)
• 7079d6d Fix zizmor findings in GitHub Actions workflows (#1506)
• Additional commits viewable in compare view

Updates dateparser from 1.4.0 to 1.4.1

Release notes

Sourced from dateparser's releases.

1.4.1

Breaking changes:

• Remove fastText language detection support: the fasttext extra is dropped and detect_languages() now raises ImportError. Migrate to the langdetect extra, which also unblocks numpy 2.x compatibility (#1315)

Security fixes:

• Make digit quantifiers possessive in the relative-date regexes to prevent quadratic backtracking (ReDoS) on long digit runs (#1335)

New features:

• Add the USE_GIVEN_LANGUAGE_ORDER setting to try languages and locales in the order given rather than by frequency (#789)

Fixes:

• Preserve explicit signs on individual components when parsing relative dates that combine decades with years, such as "-1 decade +2 years" (#1330)
• Fall back to other provided languages in search_dates when the detected language yields no dates (#1331)
• Parse relative date expressions with spaces between the sign and number, such as "now - 2 hours" and "now + 1 day" (#1327)
• Use the parser-relative now for the current month when filling in incomplete dates so the month and day stay consistent (#1332)
• Fix Norwegian Bokmål (nb) parsing of relative date expressions such as "3 måneder siden" and "om 2 måneder" (#1334)
• Parse abbreviated English month expressions such as "1mon ago" and "3mons ago" (#1329)
• Preserve surrounding whitespace when removing skip tokens during translation to avoid spurious double spaces (#1324)

Improvements:

• Move project metadata and build configuration to pyproject.toml (#1311)
• Add alternative Korean date expressions for today, yesterday, tomorrow, and "N months ago/later" (#1289)
• Expand Czech date translations with additional inflections, word numbers, decade and century expressions, and clock phrases like "čtvrt na tři" (#1325)
• Replace internal OrderedDict usage with the built-in dict (#1328)

Changelog

Sourced from dateparser's changelog.

1.4.1 (2026-06-15)

Breaking changes:

• Remove fastText language detection support: the fasttext extra is dropped and detect_languages() now raises ImportError. Migrate to the langdetect extra, which also unblocks numpy 2.x compatibility (#1315)

Security fixes:

• Make digit quantifiers possessive in the relative-date regexes to prevent quadratic backtracking (ReDoS) on long digit runs (#1335)

New features:

• Add the USE_GIVEN_LANGUAGE_ORDER setting to try languages and locales in the order given rather than by frequency (#789)

Fixes:

• Preserve explicit signs on individual components when parsing relative dates that combine decades with years, such as "-1 decade +2 years" (#1330)
• Fall back to other provided languages in search_dates when the detected language yields no dates (#1331)
• Parse relative date expressions with spaces between the sign and number, such as "now - 2 hours" and "now + 1 day" (#1327)
• Use the parser-relative now for the current month when filling in incomplete dates so the month and day stay consistent (#1332)
• Fix Norwegian Bokmål (nb) parsing of relative date expressions such as "3 måneder siden" and "om 2 måneder" (#1334)
• Parse abbreviated English month expressions such as "1mon ago" and "3mons ago" (#1329)
• Preserve surrounding whitespace when removing skip tokens during translation to avoid spurious double spaces (#1324)

Improvements:

• Move project metadata and build configuration to pyproject.toml (#1311)
• Add alternative Korean date expressions for today, yesterday, tomorrow, and "N months ago/later" (#1289)
• Expand Czech date translations with additional inflections, word numbers, decade and century expressions, and clock phrases like "čtvrt na tři" (#1325)
• Replace internal OrderedDict usage with the built-in dict (#1328)

Commits

• 08c78d3 1.4.1 release (#1337)
• a049fd1 Add Korean alternative date expressions (#1289)
• 98b9c32 make relative-date regex digit quantifiers possessive (#1335)
• 5c6d97f fix: Preserve explicit signs for years when combined with decades (#1330)
• 0d11d82 Locale order support (#789)
• 081d251 fix(nb): improve Norwegian Bokmål date parsing (#1334)
• 333e519 Fix merge issue (#1333)
• 5c437a1 Move project metadata and configuration to 'pyproject.toml' (#1311)
• b107ac3 Replace internal OrderedDict usage with dict (#1328)
• b903e69 fix: Parse 1mon ago (#1329)
• Additional commits viewable in compare view

Updates google-cloud-storage from 3.10.1 to 3.13.0

Release notes

Sourced from google-cloud-storage's releases.

google-cloud-storage: v3.13.0

3.13.0 (2026-07-13)

Features

• storage: add option to disable checksums and improve robustness of full_object_checksum validation (#17665) (a5a717d)
• storage: support full_object_checksum in AsyncAppendableObjectWriter (#17658) (e08d5ca)

google-cloud-storage: v3.12.1

3.12.1 (2026-07-07)

Bug Fixes

• storage: log occasional (1 in 5 million) additional bytes received from GCS in read path (#17423) (335c12f)

Changelog

Sourced from google-cloud-storage's changelog.

3.13.0 (2026-03-26)

Features

• Allow Protobuf 7.x (1eb7c268482e55971966e284dac2cbeb903adcbb)

Bug Fixes

• Require Python 3.9 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Require google-api-core >= 2.11.0 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Improve type checking (1eb7c268482e55971966e284dac2cbeb903adcbb)

3.12.0 (2026-03-23)

Features

• Add a field for upgrading previous processor version when fine tuning (ee7dd7dc168ecf943440cef38efff348e8eff095)

3.11.0 (2026-03-05)

Features

• Added a field for enabling image and table annotation for layout parser processor (6120fb0db084f5e8d1502fb1bb37594ac9976f6e)

3.10.0 (2026-02-12)

Documentation

• Updated comments for various fields and messages (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)

Features

• The method ReviewDocument in .google.cloud.documentai.v1beta3.DocumentProcessorService is deprecated (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)
• A new field enable_table_split is added to message .google.cloud.documentai.v1beta3.OcrConfig.LayoutParsingParams (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)
• Added new messages Documents and RawDocuments for inline document input (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)
• The field skip_human_review in messages .google.cloud.documentai.v1beta3.ProcessRequest and .google.cloud.documentai.v1beta3.BatchProcessRequest is deprecated (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)
• A new field document_prompt is added to message .google.cloud.documentai.v1beta3.DocumentSchema (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)
• A new field revisions is added to message .google.cloud.documentai.v1beta3.Evaluation (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)
• A new field document_type is added to message .google.cloud.documentai.v1beta3.ImportDocumentsRequest (5371e8e931dfba1d504ac2ffbd48a7f4abdcc158)

Bug Fixes

• Removed the SpannerIndexingConfig message and the spanner_indexing_config field from .google.cloud.documentai.v1beta3.Dataset BREAKING CHANGE: The SpannerIndexingConfig message and the spanner_indexing_config field ...

  Description has been truncated

[github-actions]

This update changes the constraint to pyopenssl<27.0, which allows pyopenssl>=26.0 to be installed. As documented in the comment above, pyopenssl>=26.0 has a context immutability issue that breaks urllib3.contrib.pyopenssl and causes ValueError crashes on Vertex AI calls; please keep pyopenssl<25.0.