chore(deps): update python-nonmajor

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
SQLAlchemy (changelog)	==2.0.51 → ==2.0.52
certifi	==2026.6.17 → ==2026.7.22
filelock	==3.32.0 → ==3.32.2
google-auth (source)	==2.56.1 → ==2.56.3
packaging	==26.2 → ==26.3
pip (changelog)	==26.1.2 → ==26.2.1
virtualenv	==21.7.0 → ==21.7.4

---

Release Notes

certifi/python-certifi (certifi)

v2026.7.22

Compare Source

tox-dev/py-filelock (filelock)

v3.32.2

Compare Source

What's Changed

• Fix test failures on NetBSD (#​689) by @​gaborbernat in tox-dev/filelock#693
• 🧪 test(soft-rw): deflake writer phase-2 peer-marker test by @​gaborbernat in tox-dev/filelock#694
• hand back the claim when a heartbeat thread fails to start by @​dxbjavid in tox-dev/filelock#691
• 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by @​gaborbernat in tox-dev/filelock#695

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

googleapis/google-cloud-python (google-auth)

v2.56.3: google-auth: v2.56.3

Compare Source

Bug Fixes

• auth: avoid creating mTLS SSL context for custom async transports (#​17825) (fbe33f9), refs #​17622
• auth: only trigger mTLS certificate rotation on mTLS endpoints (#​17928) (f7b49ea)
• auth: properly extract stdout from gnubby webauthn plugin failures (#​17885) (744e826)
• deduplicate x-goog-api-client headers (#​17616) (6167e41)
• oauth2: avoid redundant JWKS network fetches (#​17891) (de53298)

Performance Improvements

• auth: use generator expression in any() to allow short-circuiting (735e565)
• auth: use generator expression in any() to allow short-circuiting (#​17937) (735e565)

v2.56.2: google-auth: v2.56.2

Compare Source

Bug Fixes

• auth: centralize cert discovery logic and steps (#​17696) (edc0423)
• auth: exit early when agent cert config is outside well-known directory (#​17762) (61e795a)
• transport: propagate mTLS adapter to auth session and fix connection leaks (#​17689) (8289d32)
• update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix (#​17748) (b60bb04)

pypa/packaging (packaging)

v26.3

Compare Source

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#​1267, #​1270, #​1298)
• PEP 808: accept Metadata-Version: 2.6. (#​1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#​1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#​1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#​1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#​1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#​1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#​160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#​1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#​1241)
• Fix an AttributeError when hashing internally trimmed versions. (#​1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#​1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#​1232)
• Normalize requested extra names before comparing or hashing requirements. (#​644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#​1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#​1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#​1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#​1213)
• Keep the parentheses of a nested group when serializing markers. (#​1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#​1246, #​1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#​1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#​1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#​1249)
• Reject requirements and markers with a trailing line break. (#​1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#​1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#​1330)
• Reject malformed Description-Content-Type values. (#​1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#​1327)
• Route multipart email payloads to unparsed instead of asserting. (#​1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#​1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#​1356)
• Raise InvalidLicenseExpression for misplaced WITH clauses and empty LicenseRef- names. (#​1266)
• Raise InvalidLicenseExpression instead of KeyError for a LicenseRef- with a + suffix. (#​1219)

Fixes for tags and filenames

• Raise InvalidTag from parse_tag() for tags with the wrong number of components. (#​1238)
• Reject empty tag components in parse_wheel_filename() and parse_tag(). (#​1234)
• Reject an empty project name in the wheel and sdist filename parsers. (#​1305)
• Reject wheel filenames with a trailing newline. (#​1341)
• Reject wheel tags whose interpreter component is not an identifier. (#​577)
• is_normalized_name now rejects names with collapsed double hyphens like a--b. (#​1230)
• Fix duplicate explicit abi3t tags. (#​1245)
• Forward the warn argument to generic_tags() in sys_tags(). (#​1264)
• Raise SystemError for an empty or malformed CPython EXT_SUFFIX. (#​1271, #​1301)
• Fix a typo in the macOS fat3 architecture name (was fat32). (#​1199)

Fixes for pylock, direct URLs, and dependency groups

• Percent-decode pylock artifact file names derived from a url so that local versions (e.g. a wheel with 2.12.1+cu130 encoded as 2.12.1%2Bcu130) yield a valid file name. (#​1314)
• Use an explicitly empty tags sequence in Pylock.select() instead of falling back to sys_tags(). (#​1349)
• Fix Pylock.select() on Python builds that report a non-PEP 440 python_full_version (e.g. 3.15.0+). (#​1179)
• Reject TOML booleans where integers are expected in pylock files. (#​1244)
• Add PylockSelectError to packaging.pylock.__all__. (#​1202)
• Fix DirectUrl credential stripping for passwords containing @. (#​1218)
• Parse the URL scheme case-insensitively when checking for file URLs in direct_url. (#​1240)
• Require absolute file URLs for local directories in direct_url. (#​1297)
• Collect InvalidRequirement errors while resolving dependency groups instead of leaking them. (#​1302)
• Don't cache malformed dependency group parses. (#​1248)

Performance

• Implement Specifier and SpecifierSet filtering with the new range engine. (#​1120, #​1259)
• Cache the default marker environment. (#​1250)
• Cache the _manylinux module lookup process-wide. (#​1254)
• Add __slots__ to Requirement and the token classes. (#​1320, #​1258)
• Keep range caches across canonicalization, precompile the wheel project-name pattern, simplify parse_tag(), and skip platform.mac_ver() when the version and arch are given. (#​1253, #​1256, #​1236, #​1255)

Documentation

• Describe the validation scope of packaging.pylock. (#​1339)
• Explain which packaging.metadata fields are validated. (#​1342)
• Document RFC822Policy in the low-level packaging.metadata interface. (#​1222)
• Enable nitpicky mode and render missing classes and fields in the API reference. (#​1196, #​1225, #​1277)
• Add missing versionadded / versionchanged directives and many small docstring fixes across the API reference. (#​1205, #​1207, #​1208, #​1209, #​1211, #​1216, #​1217, #​1223, #​1272, #​1273, #​1274, #​1291, #​1300, #​1303, #​1317, #​1344)

Internal

• Add Python 3.15 to the test matrix. (#​1190)
• Add a musl/Alpine test job and make the test suite pass on musl. (#​1226, #​1227)
• Expand the downstream test matrix by ten projects. (#​1261)
• Update to mypy 2. (#​1191)
• Use nox's uv integration. (#​1057)

New Contributors

• @​Sean-Kenneth-Doherty made their first contribution in #​1187
• @​jsirois made their first contribution in #​1199
• @​Alan-K-Biju-7 made their first contribution in #​1217
• @​facutuesca made their first contribution in #​1218
• @​NovaLux12 made their first contribution in #​1317
• @​atsuoishimoto made their first contribution in #​1314
• @​gaoflow made their first contribution in #​1291
• @​jacobdr made their first contribution in #​608
• @​deepakganesh78 made their first contribution in #​1351
• @​rajath201 made their first contribution in #​1356

Full Changelog: pypa/packaging@26.2...26.3

pypa/pip (pip)

v26.2.1

Compare Source

v26.2

Compare Source

pypa/virtualenv (virtualenv)

v21.7.4

Compare Source

What's Changed

• Upgrade embedded pip/setuptools/wheel by @​github-actions[bot] in #​3208

Full Changelog: pypa/virtualenv@21.7.3...21.7.4

v21.7.3

Compare Source

What's Changed

• 🐛 fix(config): return a real list from ListType.split_values by @​darrenhuai in #​3207

New Contributors

• @​darrenhuai made their first contribution in #​3207

Full Changelog: pypa/virtualenv@21.7.2...21.7.3

v21.7.2

Compare Source

What's Changed

• Upgrade embedded pip/setuptools/wheel by @​github-actions[bot] in #​3206

Full Changelog: pypa/virtualenv@21.7.1...21.7.2

v21.7.1

Compare Source

What's Changed

• 📝 docs(branding): clarify official logo vs favicon by @​gaborbernat in #​3200
• Upgrade embedded pip/setuptools/wheel by @​github-actions[bot] in #​3201

Full Changelog: pypa/virtualenv@21.7.0...21.7.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun