chore(deps): bump the templates-examples-pip-minor-patch group across 8 directories with 5 updates

[dependabot]

Bumps the templates-examples-pip-minor-patch group with 5 updates in the /templates directory:

Package	From	To
kafka-python-ng	2.2.2	2.2.3
clickhouse-connect	0.11.0	0.15.1
requests	2.32.4	2.33.1
faker	40.8.0	40.15.0
fastapi	0.135.1	0.136.1

Bumps the templates-examples-pip-minor-patch group with 3 updates in the /templates/python directory: kafka-python-ng, clickhouse-connect and requests.
Bumps the templates-examples-pip-minor-patch group with 3 updates in the /templates/python-cluster directory: kafka-python-ng, clickhouse-connect and requests.
Bumps the templates-examples-pip-minor-patch group with 3 updates in the /templates/python-empty directory: kafka-python-ng, clickhouse-connect and requests.
Bumps the templates-examples-pip-minor-patch group with 3 updates in the /templates/python-fastapi directory: kafka-python-ng, clickhouse-connect and requests.
Bumps the templates-examples-pip-minor-patch group with 3 updates in the /templates/python-fastapi-client-only directory: kafka-python-ng, clickhouse-connect and requests.
Bumps the templates-examples-pip-minor-patch group with 3 updates in the /templates/python-tests directory: kafka-python-ng, clickhouse-connect and requests.
Bumps the templates-examples-pip-minor-patch group with 5 updates in the /templates/python-webapp directory:

Package	From	To
kafka-python-ng	2.2.2	2.2.3
clickhouse-connect	0.11.0	0.15.1
requests	2.32.4	2.33.1
faker	40.8.0	40.15.0
fastapi	0.135.1	0.136.1

Updates kafka-python-ng from 2.2.2 to 2.2.3

Release notes

Sourced from kafka-python-ng's releases.

v2.2.3

What's Changed

• Patch pylint warnings so tests pass again by @​wbarnha in wbarnha/kafka-python-ng#184
• Avoid busy retry by @​orange-kao in wbarnha/kafka-python-ng#192
• Fix SCRAM username character escape by @​debuggings in wbarnha/kafka-python-ng#196
• Improve test/test_consumer_integration.py in GitHub runner by @​orange-kao in wbarnha/kafka-python-ng#194

New Contributors

• @​orange-kao made their first contribution in wbarnha/kafka-python-ng#192
• @​debuggings made their first contribution in wbarnha/kafka-python-ng#196

Full Changelog: kafka-python-ng/kafka-python-ng@v2.2.2...v2.2.3

Commits

• 6104623 Improve test/test_consumer_integration.py in GitHub runner (#194)
• 9bee9fc fix scram username character escape (#196)
• 31a6b92 Avoid busy retry (#192)
• 401896b Update README.rst to close #179
• 5e461a7 Patch pylint warnings so tests pass again (#184)
• 448017e Merge branch 'dpkp:master' into master
• deebd8f Fix badge typo in README.rst
• See full diff in compare view

Updates clickhouse-connect from 0.11.0 to 0.15.1

Release notes

Sourced from clickhouse-connect's releases.

v0.15.1

Bug Fixes

• Use timezone from parameter type hint instead of server_tz when formatting tz-aware datetimes in {param:Type} bind expressions. Fixes #697

v0.15.0

Improvements

• Comprehensive ClickHouse JOIN support in SQLAlchemy via ch_join() with all strictness/distribution modifiers and USING syntax (#635, #636)
• Multi-column array_join() for parallel array expansion (#633)
• Add missing Replicated engine variants (ReplicatedReplacingMergeTree, etc.) (#687)
• Lazy imports for numpy, pandas, pyarrow, and polars, ~4x faster bare import time (#589)

Bug Fixes

• Fix .final() and .sample() silently overwriting each other when chained (#658)
• Fix sqlalchemy.values() to emit ClickHouse VALUES table function syntax (#681)
• Fix GraphiteMergeTree to properly quote config_section argument

Other

• Remove py.typed marker that was causing false type errors for mypy/pyright users (#691)

Full Changelog: ClickHouse/clickhouse-connect@v0.14.1...v0.15.0

v0.14.1

Bug fixes

• Fixed JSON and Dynamic column read paths to properly decode shared variant data instead of returning raw binary with discriminator byte prefixes. Closes #599, #615, #674
• Fixed empty ORM/DBAPI SELECT results so cursor.description is still populated when ClickHouse Native format returns no data blocks. This restores correct handling for empty result sets, including parameterized and limited queries. Closes #675
• Reenabled the default Cython runtime path so compiled driverc modules are used again unless CLICKHOUSE_CONNECT_USE_C=0 is exoplicitly set. Closes #676

Full Changelog: ClickHouse/clickhouse-connect@v0.14.0...v0.14.1

v0.14.0

High level notes

This release is primarily focused on preparing the path to 1.0.0. It introduces a handful of breaking changes and deprecation warnings for APIs that will be removed or finalized in 1.0.0. If your code uses any of the deprecated parameters, you'll now see DeprecationWarnings with clear migration guidance and highly recommend addressing these before upgrading to 1.0.0 when it ships.

Breaking Changes

• apply_server_timezone renamed to tz_source. Options are "auto" (the default), "server", or "local". The old parameter currently still works with a deprecation warning. ClickHouse/clickhouse-connect#670
• utc_tz_aware renamed to tz_mode. Options are "naive_utc" (the default), "aware", or "schema". The old parameter still currently still works with a deprecation warning. ClickHouse/clickhouse-connect#664
• Removed Object('json') type. This was a legacy experimental JSON type has been removed in favor of the new JSON type in ClickHouse. ClickHouse/clickhouse-connect#666

Deprecations

• Pandas 1.x support is deprecated and will be removed in 1.0.0. ClickHouse/clickhouse-connect#667
• There's a async-native client based on clickhouse-connect v0.11.0 that is available for testing via pip install clickhouse_connect[async]==0.12.0rc1. A FutureWarning advertising this will now be emitted on creation of the (to be legacy) async client. ClickHouse/clickhouse-connect#672

Experimental

• Python 3.14 free-threading (cp314t) wheel builds for all platforms. ClickHouse/clickhouse-connect#660

Improvements

• Fix issue where sending redundant settings is skipped. ClickHouse/clickhouse-connect#639
• Add support for SAMPLE in SQLAlchemy dialect. ClickHouse/clickhouse-connect#656

New Contributors

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

0.15.1, 2026-03-30

Bug Fixes

• Use timezone from parameter type hint instead of server_tz when formatting tz-aware datetimes in {param:Type} bind expressions. Previously, bind_query always converted datetimes to the server timezone, ignoring explicit timezone declarations in type hints like DateTime64(6, 'UTC'). This caused incorrect query results when server_tz differed from the hint timezone. Handles LowCardinality, Nullable, and container type wrappers. Fixes #697

0.15.0, 2026-03-26

Improvements

• SQLAlchemy: Comprehensive ClickHouse JOIN support via the new ch_join() helper. All strictness modifiers (ALL, ANY, SEMI, ANTI, ASOF), the GLOBAL distribution modifier, and explicit CROSS JOIN are now available. Use with select_from() to generate ClickHouse-specific join syntax like GLOBAL ALL LEFT OUTER JOIN. Closes #635
• SQLAlchemy: array_join() now supports multiple columns for parallel array expansion. Pass a list of columns and a matching list of aliases to generate ARRAY JOIN col1 AS a, col2 AS b, col3 AS c. Single-column usage is unchanged. Closes #633
• SQLAlchemy: ch_join() now supports USING syntax via the new using parameter. Pass a list of column name strings to generate USING (col1, col2) instead of ON. This is important for FULL OUTER JOIN where USING merges the join column correctly while ON produces default values (0, '') for unmatched sides. Closes #636
• SQLAlchemy: Add missing Replicated table engine variants: ReplicatedReplacingMergeTree, ReplicatedCollapsingMergeTree, ReplicatedVersionedCollapsingMergeTree, and ReplicatedGraphiteMergeTree. Closes #687
• Lazy imports for optional dependencies (numpy, pandas, pyarrow, polars). If installed, these heavy libraries are no longer imported at import clickhouse_connect time. They are only imported when features that need them are actually used. The C/Numpy optimization bridge is also deferred. This speeds up bare import time of clickhouse-connect about 4X in environments where all four are installed. Closes #589

Other

• Remove py.typed marker file. The package does not have comprehensive type annotations, so the PEP 561 marker was causing false type errors for mypy/pyright users. Closes #691

Bug Fixes

• SQLAlchemy: Fix .final() and .sample() silently overwriting each other when chained. Both methods now store modifiers as custom attributes on the Select instance and render them during compilation, replacing the previous with_hint() approach that only allowed one hint per table. Chaining in either order (e.g. select(t).final().sample(0.1)) correctly produces FROM t FINAL SAMPLE 0.1. Also fixes rendering for aliased tables (FROM t AS u FINAL) and supports explicit table targeting in joins. Fixes #658
• SQLAlchemy: Fix sqlalchemy.values() to generate ClickHouse's VALUES table function syntax. The compiler now emits VALUES('col1 Type1, col2 Type2', ...) with the column structure as the first argument, instead of the standard SQL form that places column names after the alias. Generic SQLAlchemy types are mapped to ClickHouse equivalents (e.g. Integer to Int32, String to String). Also handles CTE usage by wrapping in SELECT * FROM VALUES(...). Fixes #681
• SQLAlchemy: Fix GraphiteMergeTree and ReplicatedGraphiteMergeTree to properly single-quote the config_section argument as ClickHouse requires.

0.14.1, 2026-03-11

Bug Fixes

• Fix JSON and Dynamic column read paths to properly decode shared variant data instead of returning raw binary with discriminator byte prefixes. Shared data values, used when paths exceed max_dynamic_paths or types exceed max_dynamic_types are now decoded from ClickHouse's binary variant encoding. Scalar types like integers, floats, strings, booleans, and nulls as well as nested objects are now fully decoded. Compound types like Array, Tuple, Map, DateTime, Date, Decimal, and UUID are not yet decoded and will be returned as raw bytes. Fixes #599, #615, and #674
• SQLAlchemy: Fixed empty ORM/DBAPI SELECT results so cursor.description is still populated when ClickHouse Native format returns no data blocks. This restores correct handling for empty result sets, including parameterized and limited queries. Closes #675
• Restore the default Cython runtime path so compiled driverc modules are used again unless CLICKHOUSE_CONNECT_USE_C=0 is set. Fix C/Python parity issues in streaming exception handling, FixedString string reads, nullable array helpers, and numpy conversion helpers, and expand CI and unit parity coverage to keep the optimized and pure-Python paths in sync. Addresses #676
• Simplify pivot in the Cython data conversion module to use tuple(zip(*...)) instead of a manual tuple-building loop which matches the pure-Python implementation and provides significant insert speedup.

0.14.0, 2026-03-09

Breaking Changes

• Renamed apply_server_timezone parameter to tz_source across Client and HttpClient. The new tz_source parameter accepts string values: "auto" (default, was None), "server" (was True or "always"), and "local" (was False). The old apply_server_timezone parameter is still accepted but emits a DeprecationWarning and will be removed in 1.0. Passing both tz_source and apply_server_timezone raises ProgrammingError. The "always" value (which had no distinct runtime behavior from True) maps to "server".
• Renamed utc_tz_aware parameter to tz_mode across Client, QueryContext, and all query methods. The new tz_mode parameter accepts string values: "naive_utc" (default, was False), "aware" (was True), and "schema" (unchanged). The old utc_tz_aware parameter is still accepted but emits a DeprecationWarning and will be removed in 1.0. Passing both tz_mode and utc_tz_aware raises ProgrammingError. Closes #654
• Removed the deprecated Object('json') type. This was the legacy experimental JSON type that has been superseded by the new JSON type in ClickHouse. Closes #556

Deprecations

• Pandas 1.x support is now deprecated and will be removed in v1.0.0. A DeprecationWarning is emitted at import time for pandas 1.x users.

Improvements

• Added support for the SAMPLE clause in SQLAlchemy statements. Note: Due to a SQLAlchemy limitation, only one hint (SAMPLE or FINAL) can be applied per table; chaining both will silently ignore one. For now, this change enables use of sample(), but chaining with final() is not yet supported. Closes #634
• Experimental: Added Python 3.14 free-threading (cp314t) wheel builds for all platforms. The full test suite currently (as of 2 MAR, 2026) passes under free-threaded Python, but is not added to the CI test matrix at this time nor has it been otherwise tested to any degree. Free-threading support should be considered experimental with no guarantees of correctness at this time. Closes #573

0.13.0, 2026-02-26

Improvements

• BREAKING CHANGE: Implement native write path for Variant data type with type-aware dispatching. Previously, all values inserted into a Variant column were stringified and sent to the server, which would store them in the String member if present, or attempt server-side conversion otherwise. Values

... (truncated)

Commits

• 05ec766 respect bind param tz type hints, bf release 0.15.1 prep
• c4c2a4e 0.15.0 release prep (#694)
• cd8cbf4 Joe/remove pytyped and other small cleanup issues (#693)
• 05859ef implement lazy loading of heavy optional deps (#689)
• 611161f SQLAlchemy core improvements (#688)
• 5fd16eb simple ddl support for a few new engine types (#690)
• a0e621c add Peter for reviews (#682)
• c40bbac 0.14.1 bugfix release prep (#680)
• 323b768 Reenable default Cython runtime path and reestablish C/Python parity (#679)
• 0114948 fix sqlalchemy empty result metadata for orm queries (#678)
• Additional commits viewable in compare view

Updates requests from 2.32.4 to 2.33.1

Release notes

Sourced from requests's releases.

v2.33.1

2.33.1 (2026-03-30)

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
• Fixed Content-Type header parsing for malformed values. (#7309)
• Improved error consistency for malformed header values. (#7308)

New Contributors

• @​ferdnyc made their first contribution in psf/requests#7277

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.1 (2026-03-30)

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
• Fixed Content-Type header parsing for malformed values. (#7309)
• Improved error consistency for malformed header values. (#7308)

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.

... (truncated)

Commits

• 111d2b7 v2.33.1
• f0198e6 Fix malformed value parsing for Content-Type (#7309)
• bc7dd0f Fix cosmetic header validity parsing regex (#7308)
• 4443b1a Fix unintended test extra (#7306)
• 389eea5 Cleanup extracted file after extract_zipped_path test (#7305)
• 7407309 Packaging: DRY out extras definition (#7277)
• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• Additional commits viewable in compare view

Updates faker from 40.8.0 to 40.15.0

Release notes

Sourced from faker's releases.

Release v40.15.0

See CHANGELOG.md.

Release v40.14.1

See CHANGELOG.md.

Release v40.14.0

See CHANGELOG.md.

Release v40.13.0

See CHANGELOG.md.

Release v40.12.0

See CHANGELOG.md.

Release v40.11.1

See CHANGELOG.md.

Release v40.11.0

See CHANGELOG.md.

Release v40.10.0

See CHANGELOG.md.

Release v40.9.0

See CHANGELOG.md.

Release v40.8.1

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.15.0 - 2026-04-17

• Add job providers for ar_DZ and fr_DZ locales (#2352). Thanks @​othmane099.
• Add company providers for ar_DZ and fr_DZ locales (#2351). Thanks @​othmane099.
• Add geo providers for ar_DZ and fr_DZ locales (#2350). Thanks @​othmane099.
• Add currency providers for ar_DZ and fr_DZ locales (#2349). Thanks @​othmane099.
• Add date_time provider for ar_DZ locale (#2348). Thanks @​othmane099.
• Add ssn providers for ar_DZ and fr_DZ locales (#2347). Thanks @​othmane099.

v40.14.1 - 2026-04-17

• Fix UnicodeEncodeError in CLI docs on non-UTF consoles (#2362). Thanks @​RedZapdos123.

v40.14.0 - 2026-04-17

• Fix: update placekitten URL to placekittens (#2364). Thanks @​reory.

v40.13.0 - 2026-04-06

• Fix: Ensure deterministic locale selection in multi-locale mode. Thanks @​just6660 and @​patakk.

v40.12.0 - 2026-03-30

• Add address providers for ar_DZ and fr_DZ locales (#2341). Thanks @​othmane099.

v40.11.1 - 2026-03-23

• Fix: rebind deepcopy proxies to copied Faker instances. Thanks @​SunS1eep1ng.

v40.11.0 - 2026-03-13

• Add major Swiss banks to de_CH bank provider. Thanks @​raphael-s.

v40.10.0 - 2026-03-13

• Fix: mixed-gender names in es_MX locale. Thanks @​rodrigobnogueira.

v40.9.0 - 2026-03-13

• Fix pt_PT postalcode format in address provider. Thanks @​filipemattar.

v40.8.1 - 2026-03-13

• Fix mutable default providers. Thanks @​Dhi13man.

Commits

• ff243c8 Bump version: 40.14.1 → 40.15.0
• 632981e 📝 Update CHANGELOG.md
• c8ee020 💄 Lint code
• ca29a01 Add job providers for ar_DZ and fr_DZ locales (#2352)
• 740812b Add company providers for ar_DZ and fr_DZ locales (#2351)
• 6a495ba Add geo providers for ar_DZ and fr_DZ locales (#2350)
• f595fb2 Add currency providers for ar_DZ and fr_DZ locales (#2349)
• 0c2aef9 add date_time provider for ar_DZ locale (#2348)
• 2bb97dc Add ssn providers for ar_DZ and fr_DZ locales (#2347)
• 75a8ae7 Bump version: 40.14.0 → 40.14.1
• Additional commits viewable in compare view

Updates fastapi from 0.135.1 to 0.136.1

Release notes

Sourced from fastapi's releases.

0.136.1

Upgrades

• ⬆️ Update Pydantic v2 code to address deprecations. PR #15101 by @​svlandeg.

Internal

• 🔨 Tweak translation script. PR #15174 by @​YuriiMotov.
• ⬆ Bump mkdocs-material from 9.7.1 to 9.7.6. PR #15408 by @​dependabot[bot].
• ⬆ Bump inline-snapshot from 0.31.1 to 0.32.6. PR #15409 by @​dependabot[bot].
• ⬆ Bump pytest-codspeed from 4.3.0 to 4.4.0. PR #15407 by @​dependabot[bot].
• ⬆ Bump pytest-cov from 7.0.0 to 7.1.0. PR #15406 by @​dependabot[bot].
• ⬆ Bump cloudflare/wrangler-action from 3.14.1 to 3.15.0. PR #15405 by @​dependabot[bot].
• ⬆ Bump mypy from 1.19.1 to 1.20.1. PR #15410 by @​dependabot[bot].
• ⬆ Bump python-dotenv from 1.2.1 to 1.2.2. PR #15400 by @​dependabot[bot].
• ⬆ Bump starlette from 0.52.1 to 1.0.0. PR #15397 by @​dependabot[bot].
• ⬆ Bump pygithub from 2.8.1 to 2.9.1. PR #15396 by @​dependabot[bot].
• ⬆ Bump pyjwt from 2.12.0 to 2.12.1. PR #15393 by @​dependabot[bot].
• ⬆ Bump zizmor from 1.23.1 to 1.24.1. PR #15394 by @​dependabot[bot].
• ⬆ Bump strawberry-graphql from 0.312.3 to 0.314.3. PR #15395 by @​dependabot[bot].
• ⬆ Bump python-multipart from 0.0.22 to 0.0.26. PR #15360 by @​dependabot[bot].
• ⬆ Bump authlib from 1.6.9 to 1.6.11. PR #15373 by @​dependabot[bot].
• ⬆ Bump aiohttp from 3.13.3 to 3.13.4. PR #15282 by @​dependabot[bot].
• ⬆ Bump pygments from 2.19.2 to 2.20.0. PR #15263 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 10.20.1 to 10.21.2. PR #15391 by @​YuriiMotov.
• ⬆ Bump pillow from 12.1.1 to 12.2.0. PR #15333 by @​dependabot[bot].
• ⬆ Bump pytest from 9.0.2 to 9.0.3. PR #15334 by @​dependabot[bot].
• ⬆ Bump actions/upload-artifact from 7.0.0 to 7.0.1. PR #15374 by @​dependabot[bot].
• ⬆ Bump actions/cache from 5.0.4 to 5.0.5. PR #15385 by @​dependabot[bot].
• 🔧 Update sponsors: remove Zuplo. PR #15369 by @​tiangolo.
• 🔧 Update sponsors: remove Speakeasy. PR #15368 by @​tiangolo.
• 🔒️ Add zizmor and fix audit findings. PR #15316 by @​YuriiMotov.

0.136.0

Upgrades

• ⬆️ Support free-threaded Python 3.14t. PR #15149 by @​svlandeg.

0.135.4

Refactors

• 🔥 Remove April Fool's @app.vibe() 🤪. PR #15363 by @​tiangolo.

Internal

• ⬆ Bump cryptography from 46.0.5 to 46.0.7. PR #15314 by @​dependabot[bot].
• ⬆ Bump strawberry-graphql from 0.307.1 to 0.312.3. PR #15309 by @​dependabot[bot].
• 🔨 Add pre-commit hook to ensure latest release header has date. PR #15293 by @​YuriiMotov.

0.135.3

... (truncated)

Commits

• e54e5a8 🔖 Release version 0.136.1
• 9a8a5fd 📝 Update release notes
• 7815a32 ⬆️ Update Pydantic v2 code to address deprecations (#15101)
• ef1c927 📝 Update release notes
• 38039e1 🔨 Tweak translation script (#15174)
• 4fa826c 📝 Update release notes
• c394156 ⬆ Bump mkdocs-material from 9.7.1 to 9.7.6 (#15408)
• ae230ad 📝 Update release notes
• d9eb39d ⬆ Bump inline-snapshot from 0.31.1 to 0.32.6 (#15409)
• 4f8b5d1 📝 Update release notes
• Additional commits viewable in compare view

Updates kafka-python-ng from 2.2.2 to 2.2.3

Release notes

Sourced from kafka-python-ng's releases.

v2.2.3

What's Changed

• Patch pylint warnings so tests pass again by @​wbarnha in wbarnha/kafka-python-ng#184
• Avoid busy retry by @​orange-kao in wbarnha/kafka-python-ng#192
• Fix SCRAM username character escape by @​debuggings in wbarnha/kafka-python-ng#196
• Improve test/test_consumer_integration.py in GitHub runner by @​orange-kao in wbarnha/kafka-python-ng#194

New Contributors

• @​orange-kao made their first contribution in wbarnha/kafka-python-ng#192
• @​debuggings made their first contribution in wbarnha/kafka-python-ng#196

Full Changelog: kafka-python-ng/kafka-python-ng@v2.2.2...v2.2.3

Commits

• 6104623 Improve test/test_consumer_integration.py in GitHub runner (#194)
• 9bee9fc fix scram username character escape (#196)
• 31a6b92 Avoid busy retry (#192)
• 401896b Update README.rst to close #179
• 5e461a7 Patch pylint warnings so tests pass again (#184)
• 448017e Merge branch 'dpkp:master' into master
• deebd8f Fix badge typo in README.rst
• See full diff in compare view

Updates clickhouse-connect from 0.11.0 to 0.15.1

Release notes

Sourced from clickhouse-connect's releases.

v0.15.1

Bug Fixes

• Use timezone from parameter type hint instead of server_tz when formatting tz-aware datetimes in {param:Type} bind expressions. Fixes #697

v0.15.0

Improvements

• Comprehensive ClickHouse JOIN support in SQLAlchemy via ch_join() with all strictness/distribution modifiers and USING syntax (#635, #636)
• Multi-column array_join() for parallel array expansion (#633)
• Add missing Replicated engine variants (ReplicatedReplacingMergeTree, etc.) (#687)
• Lazy imports for numpy, pandas, pyarrow, and polars, ~4x faster bare import time (#589)

Bug Fixes

• Fix .final() and .sample() silently overwriting each other when chained (#658)
• Fix sqlalchemy.values() to emit ClickHouse VALUES table function syntax (#681)
• Fix GraphiteMergeTree to properly quote config_section argument

Other

• Remove py.typed marker that was causing false type errors for mypy/pyright users (#691)

Full Changelog: ClickHouse/clickhouse-connect@v0.14.1...v0.15.0

v0.14.1

Bug fixes

• Fixed JSON and Dynamic column read paths to properly decode shared variant data instead of returning raw binary with discriminator byte prefixes. Closes #599, #615, #674
• Fixed empty ORM/DBAPI SELECT results so cursor.description is still populated when ClickHouse Native format returns no data blocks. This restores correct handling for empty result sets, including parameterized and limited queries. Closes #675
• Reenabled the default Cython runtime path so compiled driverc modules are used again unless CLICKHOUSE_CONNECT_USE_C=0 is exoplicitly set. Closes #676

Full Changelog: ClickHouse/clickhouse-connect@v0.14.0...v0.14.1

v0.14.0

High level notes

This release is primarily focused on preparing the path to 1.0.0. It introduces a handful of breaking changes and deprecation warnings for APIs that will be removed or finalized in 1.0.0. If your code uses any of the deprecated parameters, you'll now see DeprecationWarnings with clear migration guidance and highly recommend addressing these before upgrading to 1.0.0 when it ships.

Breaking Changes

• apply_server_timezone renamed to tz_source. Options are "auto" (the default), "server", or "local". The old parameter currently still works with a deprecation warning. ClickHouse/clickhouse-connect#670
• utc_tz_aware renamed to tz_mode. Options are "naive_utc" (the default), "aware", or "schema". The old parameter still currently still works with a deprecation warning. ClickHouse/clickhouse-connect#664
• Removed Object('json') type. This was a legacy experimental JSON type has been removed in favor of the new JSON type in ClickHouse. ClickHouse/clickhouse-connect#666

Deprecations

• Pandas 1.x support is deprecated and will be removed in 1.0.0. ClickHouse/clickhouse-connect#667
• There's a async-native client based on clickhouse-connect v0.11.0 that is available for testing via pip install clickhouse_connect[async]==0.12.0rc1. A FutureWarning advertising this will now be emitted on creation of the (to be legacy) async client. ClickHouse/clickhouse-connect#672

Experimental

• Python 3.14 free-threading (cp314t) wheel builds for all platforms. ClickHouse/clickhouse-connect#660

Improvements

• Fix issue where sending redundant settings is skipped. ClickHouse/clickhouse-connect#639
• Add support for SAMPLE in SQLAlchemy dialect. ClickHouse/clickhouse-connect#656

New Contributors

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

0.15.1, 2026-03-30

Bug Fixes

• Use timezone from parameter type hint instead of server_tz when formatting tz-aware datetimes in {param:Type} bind expressions. Previously, bind_query always converted datetimes to the server timezone, ignoring explicit timezone declarations in type hints like DateTime64(6, 'UTC'). This caused incorrect query results when server_tz differed from the hint timezone. Handles LowCardinality, Nullable, and container type wrappers. Fixes #697

0.15.0, 2026-03-26

Improvements

• SQLAlchemy: Comprehensive ClickHouse JOIN support via the new ch_join() helper. All strictness modifiers (ALL, ANY, SEMI, ANTI, ASOF), the GLOBAL distribution modifier, and explicit CROSS JOIN are now available. Use with select_from() to generate ClickHouse-specific join syntax like GLOBAL ALL LEFT OUTER JOIN. Closes #635
• SQLAlchemy: array_join() now supports multiple columns for parallel array expansion. Pass a list of columns and a matching list of aliases to generate ARRAY JOIN col1 AS a, col2 AS b, col3 AS c. Single-column usage is unchanged. Closes #633
• SQLAlchemy: ch_join() now supports USING syntax via the new using parameter. Pass a list of column name strings to generate USING (col1, col2) instead of ON<...

  Description has been truncated

  ---

  [!NOTE]
  Low Risk
  Low risk dependency-only changes limited to example/template requirements.txt files; primary risk is downstream compatibility changes from upgraded third-party libraries.

  Overview
  Updates Python template requirements.txt pins across the templates/ directory, bumping kafka-python-ng to 2.2.3, clickhouse-connect to 0.15.1, and requests to 2.33.1.

  For the python-webapp template, also bumps pinned faker to 40.15.0 and fastapi[standard] to 0.136.1.

  ^{Reviewed by Cursor Bugbot for commit 8c4b2568ccbea6243cbbe16357392cfb77082395. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Ready	Preview, Comment	May 9, 2026 3:04am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8c4b256. Configure here.}

[cursor]

Hardcoded dependency versions now inconsistent with templates

Low Severity

Templates now specify clickhouse-connect==0.15.1 and requests==2.33.1, but apps/framework-cli/src/project/python_project.rs (line 86-87) still hardcodes clickhouse_connect==0.11.0 and requests==2.32.4 in PythonProject::default(). This path is used when the CLI creates a Python project via PythonProject::new() (called from project.rs:486), causing newly CLI-created projects to get outdated versions compared to template-based ones. This violates the DRY principle — the versions should be kept in sync or derived from a single source of truth.

Additional Locations (1)

• templates/python-webapp/requirements.txt#L1-L3

 

^{Triggered by team rule: Pragmatic Developper}

^{Reviewed by Cursor Bugbot for commit 8c4b256. Configure here.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml