chore(deps): update all dependencies

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@babel/preset-env (source)	7.28.5 → 7.29.2			devDependencies	minor
actions/cache	v4 → v5			action	major
actions/checkout	v5 → v6			action	major
actions/checkout	v4 → v6			action	major
actions/setup-go	v5 → v6			action	major
actions/setup-python	v5 → v6			action	major
aiohttp	==3.13.4 → ==3.13.5				patch
alembic (changelog)	==1.17.0 → ==1.18.4				minor
argcomplete (changelog)	==3.6.2 → ==3.6.3				patch
attrs (changelog)	==25.4.0 → ==26.1.0				major
bigframes (source, changelog)	==2.25.0 → ==2.39.0				minor
build (changelog)	==1.4.0 → ==1.4.3				patch
cachetools	==6.2.6 → ==7.0.5				major
cachetools	==6.2.1 → ==7.0.5				major
certifi	==2025.10.5 → ==2026.2.25				major
charset-normalizer (changelog)	==3.4.4 → ==3.4.7				patch
click (changelog)	==8.3.1 → ==8.3.2				patch
click (changelog)	==8.3.0 → ==8.3.2				patch
cmake	==3.31.6 → ==4.3.1				major
colorlog	==6.9.0 → ==6.10.1				minor
db-dtypes (source)	==1.5.0 → ==1.5.1				patch
dorny/paths-filter	v3 → v4			action	major
filelock	==3.19.1 → ==3.25.2				minor
google-api-core	==2.26.0 → ==2.30.3				minor
google-api-core	==2.28.1 → ==2.30.3				minor
google-auth	==2.41.1 → ==2.49.2				minor
google-auth	==2.48.0 → ==2.49.2				minor
google-auth	==2.43.0 → ==2.49.2				minor
google-cloud-bigquery	==3.40.1 → ==3.41.0				minor
google-cloud-bigquery-storage (source)	==2.36.2 → ==2.37.0				minor
google-cloud-core (source)	==2.4.3 → ==2.5.1				minor
google-cloud-spanner (source)	==3.58.0 → ==3.65.0				minor
google-cloud-testutils (source)	==1.6.4 → ==1.7.1				minor
google-cloud-testutils (source)	==1.7.0 → ==1.7.1				patch
google-cloud-testutils (source)	==1.4.0 → ==1.7.1				minor
googleapis-common-protos (source)	==1.71.0 → ==1.74.0				minor
googleapis-common-protos (source)	==1.72.0 → ==1.74.0				minor
greenlet (changelog)	==3.3.2 → ==3.4.0				minor
grpc-google-iam-v1	==0.14.3 → ==0.14.4				patch
grpcio	==1.75.1 → ==1.80.0				minor
grpcio	==1.76.0 → ==1.80.0				minor
grpcio-status	==1.75.1 → ==1.80.0				minor
importlib-metadata	==8.7.1 → ==9.0.0				major
ipython	==9.10.0 → ==9.12.0				minor
jest (source)	^29.7.0 → ^30.0.0			devDependencies	major
jest-environment-jsdom (source)	30.2.0 → 30.3.0			devDependencies	minor
jsdom	^24.1.0 → ^29.0.0			devDependencies	major
mcr.microsoft.com/devcontainers/python	3.13 → 3.14			final	minor
multidict	==6.7.0 → ==6.7.1				patch
nox	==2025.5.1 → ==2026.4.10				major
opentelemetry-api	==1.40.0 → ==1.41.0				minor
opentelemetry-sdk	==1.40.0 → ==1.41.0				minor
packaging	==25.0 → ==26.0				major
pandas	==2.3.3 → ==3.0.2				major
parameterized	==0.8.1 → ==0.9.0				minor
pip (changelog)	==25.0.1 → ==26.0.1				major
platformdirs (changelog)	==4.4.0 → ==4.9.6				minor
polars (changelog)	==1.24.0 → ==1.39.3				minor
proto-plus	==1.27.1 → ==1.27.2				patch
proto-plus	==1.26.1 → ==1.27.2				minor
protobuf	==6.33.5 → ==7.34.1				major
pyarrow	==21.0.0 → ==23.0.1				major
pypandoc	==1.16 → ==1.17				minor
pytest (changelog)	==8.4.1 → ==9.0.3				major
pytest (changelog)	==9.0.2 → ==9.0.3				patch
pytest (changelog)	==8.3.2 → ==9.0.3				major
pytest-dependency (changelog)	==0.6.0 → ==0.6.1				patch
python	3.10 → 3.14			uses-with	minor
python	3.12 → 3.14			uses-with	minor
python	3.9 → 3.14			uses-with	minor
python	3.8 → 3.14			uses-with	minor
requests (changelog)	==2.33.0 → ==2.33.1				patch
requests (changelog)	==2.32.5 → ==2.33.1				minor
ruff (source, changelog)	==0.14.14 → ==0.15.10				minor
rules_cc	0.1.1 → 0.2.17			http_archive	minor
setuptools (changelog)	==78.1.0 → ==82.0.1				major
sphinx (changelog)	==4.5.0 → ==9.1.0				major
sphinxcontrib-applehelp (changelog)	==1.0.4 → ==2.0.0				major
sphinxcontrib-devhelp (changelog)	==1.0.2 → ==2.0.0				major
sphinxcontrib-htmlhelp (changelog)	==2.0.1 → ==2.1.0				minor
sphinxcontrib-qthelp (changelog)	==1.0.3 → ==2.0.0				major
sphinxcontrib-serializinghtml (changelog)	==1.1.5 → ==2.0.0				major
sqlalchemy (changelog)	==2.0.48 → ==2.0.49				patch
sqlparse (changelog)	==0.5.3 → ==0.5.5				patch
tomli (changelog)	==2.4.0 → ==2.4.1				patch
tomli (changelog)	==2.2.1 → ==2.4.1				minor
urllib3 (changelog)	==2.5.0 → ==2.6.3				minor
virtualenv	==20.34.0 → ==21.2.3				major
wheel (changelog)	==0.45.1 → ==0.46.3				minor
wrapt (changelog)	==1.17.3 → ==2.1.2				major
yarl	==1.22.0 → ==1.23.0				minor
zipp	==3.23.0 → ==3.23.1				patch

---

Release Notes

babel/babel (@​babel/preset-env)

v7.29.2

Compare Source

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

actions/cache (actions/cache)

v5

Compare Source

actions/checkout (actions/checkout)

v6

Compare Source

actions/setup-go (actions/setup-go)

v6

Compare Source

actions/setup-python (actions/setup-python)

v6

Compare Source

aio-libs/aiohttp (aiohttp)

v3.13.5

Compare Source

===================

Bug fixes

• Skipped the duplicate singleton header check in lax mode (the default for response
  parsing). In strict mode (request parsing, or -X dev), all RFC 9110 singletons
  are still enforced -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12302.

---

kislyuk/argcomplete (argcomplete)

v3.6.3

Compare Source

===============================

• Make RE PCRE compatible. Fixes #​539

• Only execute Python interpreters (#​536)

• fish: set variable scope to local to avoid clobbering global or
  universal variables (#​534)

• Documentation and help improvements

python-attrs/attrs (attrs)

v26.1.0

Compare Source

Backwards-incompatible Changes

• Field aliases are now resolved before calling field_transformer, so transformers receive fully populated Attribute objects with usable alias values instead of None.
  The new Attribute.alias_is_default flag indicates whether the alias was auto-generated (True) or explicitly set by the user (False).
  #​1509

Changes

• Fix type annotations for attrs.validators.optional(), so it no longer rejects tuples with more than one validator.
  #​1496
• The attrs.validators.disabled() contextmanager can now be nested.
  #​1513
• Frozen classes can set on_setattr=attrs.setters.NO_OP in addition to None.
  #​1515
• It's now possible to pass attrs instances in addition to attrs classes to attrs.fields().
  #​1529

googleapis/python-bigquery-dataframes (bigframes)

v2.39.0

Compare Source

Documentation

• Rename Blob column references to ObjectRef column (#​2535) (44e0ffd947e9db66ab612f92de6e31f1085e7968)
• gemini retouch of the index page for seo (#​2514) (2e5311e2242b039da4c8e37b7b48942fa8ed34c2)

Features

• expose DataFrame.bigquery in both pandas and bigframes DataFrames (#​2533) (69fe317612a69aa92f06f0c418c67aa1f9488bd2)
• support full round-trip persistence for multimodal reference cols (#​2511) (494a0a113b1ba6dcdc9f9b85a4f750d093f5652f)
• add df.bigquery.ai.forecast method to pandas dataframe accessor (#​2518) (1126cec9cdfcc1ec1062c60e5affbe1b60223767)

Bug Fixes

• handle aggregate operations on empty selections (#​2510) (34fb5daa93726d0d3ff364912a3c1de0fc535fb2)
• Localize BigQuery log suppression for gbq.py (#​2541) (af49ca29399aa2c63753d9045fd382e30334d134)
• to_gbq may swap data columns when replace table (#​2532) (17ecc65e1c0397ef349fca4afcf5a77af72aa798)
• Respect remote function config changes even if logic unchanged (#​2512) (b9524284ad3b457b15598f546bac04c76b3e27b8)
• support melting empty DataFrames without crashing (#​2509) (e8c46032154e186042314d97aa813301413d8a13)

v2.38.0

Compare Source

Documentation

• add notebooks to user guide page (#​2505) (5cf37888bc0b4b1b0993dadd1e0fe5ee08341ef4)
• Fix typo in ExperimentOptions class docstring (#​2498) (077cb2ebe515fc5e07bcbb5dc663edd28d3eaf00)

Features

• add df.bigquery pandas accessor (#​2513) (91b6c245521218bb78b543885e1b9424278ce2ab)
• use EUC for AI IF, CLASSIFY, and SCORE when connection is not provided (#​2507) (fe94910abff28e244dd79e1540a6c2184a12eb44)
• Add bigframes.bigquery.rand() function (#​2501) (5c43efb745118f506ecc30196da68e9d6f4346dc)
• add bigquery.ml.get_insights function (#​2493) (d29a60953ac989bb2c95e6eec3010620ac776a3c)
• Add str, dt accessors to pd.col Expression objects (#​2488) (ce5de57019449ca77d308946df72f04289343b51)

Bug Fixes

• handle unsupported types and empty results in describe (#​2506) (2326ad6aec15c20a66756eff093b50be484b3ba8)
• no longer automatically use anywidget in the %%bqsql magics (#​2504) (43353e2bc9ffbc38b7383c24ecaac80d3b8bab32)

v2.37.0

Compare Source

Documentation

• Fix recall_score doc example (#​2477) (a6f499c1e225a962b53621158f9d4a19ca220ccd)
• add code sample and docstring for bpd.options.experiments.sql_compiler (#​2474) (867951bcabcff12e2fce88143b45d929d3237088)
• use direct API for image (#​2465) (8a1a82f7a0fd224f2b075c68ab116d1f580d1d82)
• add bigframes default connection warning (#​2471) (f1bbba23667f01d3b8e7c51b18fe64641a4b135f)
• Move readme content to new User Guide section (#​2464) (61a948451baeb1caa323e721ad88b31c7cd0b3cb)
• Skip inherited methods, use autosummary only for big classes (#​2470) (a9512498ef39b9d5260cad2ca0513c701a6d3592)
• Add code examples to configuration docstrings (#​2352) (3c21993e6fca474c32f3c2371c41ef2be146267e)

Features

• Add cloud_function_cpus option to remote_function (#​2475) (4caf74ccaeb9608d91da864bb80eddf1148a1502)
• Support pd.col simple aggregates (#​2480) (cb00daabce49f067be8e16627166dda00d5d8134)
• add display.render_mode to control DataFrame/Series visualization (#​2413) (7813eaa6fa2ae42943b90583e600c95beaf5d75e)
• add support for Python 3.14 (#​2232) (c25a6d0151380dde74368a35e13deb7a930b494f)
• Support pd.col expressions with .loc and getitem (#​2473) (ae5c8b322765aef51eed016bfacaff5a7a917a7b)
• add dt.tz_localize() (#​2469) (f70f93a1227add1627d522d7e55a37f42fc3549e)
• Update bigquery.ai.generate_table output_schema to allow Mapping type (#​2463) (f7fd1895e64a133fe63eddeb90f57a42a35c29b2)

Bug Fixes

• upload local data through write API if nested JSONs detected (#​2478) (01dc5a34e09171351575d5cbdc9f301e505e1567)
• allow IsInOp with same dtypes regardless nullable (#​2466) (1d81b414acbc964502ca624eae72cdb8c14e1576)

v2.36.0

Compare Source

Documentation

• update multimodal dataframe notebook to use public APIs (#​2456) (342fa723c4631d371364a87ae0ddd6fa03360a4b)
• use direct API for pdf chunk and pdf extract (#​2452) (543ce52c18269eab2a89886f226d1478dbabf9ba)
• fix generate_text and generate_table input docs (#​2455) (078bd32ebd28af0d2cfba6bb874ba79e904183e2)
• Update multimodal notebook to use public runtime helpers (#​2451) (e36dd8b492fd7ab433fa4cac732b31774c1e428b)
• use direct API for audio transcription (#​2447) (59cbc5db66fd178ecce03bf4b8b4a504d7ef3e9f)
• Add EXIF metadata extraction example to multimodal notebook (#​2429) (84c6f883aef8048e7013a8b3c03a1bde47e94eea)

Features

• Initial support for biglake iceberg tables (#​2409) (ae35a9890a2f9903b12e431488362c091118bbdd)
• add bigquery.ai.generate_table function (#​2453) (b925aa243dad0e42ad126c9397f42be0aad7152d)

v2.35.0

Compare Source

Documentation

• fix cast method shown on public docs (#​2436) (ad0f33c65ee01409826c381ae0f70aad65bb6a27)

Features

• remove redundant "started." messages from progress output (#​2440) (2017cc2f27f0a432af46f60b3286b231caa4a98b)
• Add bigframes.pandas.col with basic operators (#​2405) (12741677c0391efb5d05281fc756445ccbb1387e)
• Disable progress bars in Anywidget mode (#​2444) (4e2689a1c975c4cabaf36b7d0817dcbedc926853)
• Disable progress bars in Anywidget mode to reduce notebook clutter (#​2437) (853240daf45301ad534c635c8955cb6ce91d23c2)
• add bigquery.ai.generate_text function (#​2433) (5bd0029a99e7653843de4ac7d57370c9dffeed4d)
• Add a bigframes cell magic for ipython (#​2395) (e6de52ded6c5091275a936dec36f01a6cf701233)
• add bigframes.bigquery.ai.generate_embedding (#​2343) (e91536c8a5b2d8d896767510ced80c6fd2a68a97)
• add bigframe.bigquery.load_data function (#​2426) (4b0f13b2fe10fa5b07d3ca3b7cb1ae1cb95030c7)

Bug Fixes

• suppress JSONDtypeWarning in Anywidget mode and clean up progress output (#​2441) (e0d185ad2c0245b17eac315f71152a46c6da41bb)
• exlcude gcsfs 2026.2.0 (#​2445) ([311de31e79227408515f087dafbab7edc54ddf1b](https://redirect.github.com/googleapis/python-bigquery-dataframes/commit

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates dependencies across several packages, including Bigframes, GAPIC generator, Google Auth, and Spanner, and upgrades the Python variant in the Spanner devcontainer to 3.14. Feedback was provided concerning the Sphinx update in the Google Auth package, noting that version 9.1.0 introduces breaking changes that conflict with existing documentation regarding Sphinx 4.x compatibility.

[gemini-code-assist]

The update to Sphinx 9.1.0 and its associated extensions (v2.0.0+) directly contradicts the existing comment on lines 7-9, which states that these versions are pinned to maintain compatibility with Sphinx 4.x. Sphinx 9.x introduces numerous breaking changes from the 4.x series. If the project still relies on sphinx-docfx-yaml or other tools that require Sphinx 4.x compatibility (as referenced in the linked issues), this update will likely break the documentation build. Please verify compatibility and update or remove the outdated comment.