[dependabot]

Bumps the sandbox-python group with 4 updates in the /sandbox directory: boto3, clickhouse-connect, fastparquet and pytz.

Updates boto3 from 1.43.98 to 1.43.111

Commits

• c14ee96 Merge branch 'release-1.43.111'
• 2309640 Bumping version to 1.43.111
• 1d6d2d9 Add changelog entries from botocore
• d948ed5 Merge branch 'release-1.43.110'
• 9b19947 Merge branch 'release-1.43.110' into develop
• dedcde7 Bumping version to 1.43.110
• e09fb1d Add changelog entries from botocore
• 76f85a7 Bump https://github.com/astral-sh/ruff-pre-commit (#4856)
• 8afafec Merge branch 'release-1.43.109'
• 1a2fc5c Merge branch 'release-1.43.109' into develop
• Additional commits viewable in compare view

Updates clickhouse-connect from 1.8.0 to 1.10.0

Release notes

Sourced from clickhouse-connect's releases.

v1.10.0

clickhouse-connect v1.10.0

Rust codec performance

• NumPy and Pandas queries no longer require PyArrow. This covers buffered and streamed results and query(..., use_numpy=True). Strings use Arrow conversion when available and Rust object conversion otherwise. Invalid UTF-8 keeps its hex rendering. Explicit Arrow output and Arrow storage still require PyArrow.
• Supported numeric, Boolean, BFloat16, Interval, date, timestamp, and time columns now convert directly from decoded buffers. Selected nullable, Array, and LowCardinality shapes also use this path. Existing output dtypes stay unchanged, apart from the nanosecond correction described below.
• Large response chunks now feed the decoder in bounded slices, reducing temporary copies and peak memory for large NumPy, Pandas, and Python results.

Client improvements

• DB-API connections and cursors now support with blocks. They close on normal and exceptional exit. Connection contexts don't manage transactions thus commit() and rollback() are still no-ops.
• Async Arrow inserts move DataFrame conversion and Arrow encoding to a dedicated client worker, reducing event-loop stalls. #1054
• Large async external-data uploads use bounded writes to reduce event-loop stalls during TLS encryption. Upload payloads are replayable for eligible retries. #1057

Query and insert fixes

• QueryResult.result_rows works after materializing result_columns, including async queries with column_oriented=True.
• Dynamic shared-storage values and JSON paths beyond max_dynamic_types decode supported compound and scalar values to Python objects. Nullable defaults and typed JSON null paths work, and DataFrame results retain the decoded objects. #1070
• Internal DESCRIBE TABLE requests get their own query ID. Inserts retain the caller's ID, avoiding QUERY_WITH_SAME_ID_IS_ALREADY_RUNNING errors. #1066
• After a remote close or HTTP 429/503/504, SQL execution retries only recognized reads. Writes, DDL, mutations, SET, USE, and CHECK TABLE aren't replayed. This also applies through DB-API and SQLAlchemy. Read retries and insert API retries are still available. #1079

Streaming and temporal fixes

• Synchronous Native response cleanup waits for active reads and drains partially consumed HTTP chunks through the same parser. Early Rust stream closure drains the response before releasing its iterator, avoiding premature closure and subsequent SESSION_IS_LOCKED errors.
• Rust cleanup releases each response source once, handles closure during read-ahead startup, and releases decoder workers after cancelled pending reads.
• Async Rust stream cleanup finishes before cancellation is re-raised.
• Rust NumPy and Pandas results preserve nanoseconds in nullable scalar DateTime64(9) columns, including SimpleAggregateFunction aliases. Unsupported scalar precisions now fail consistently.
• Nullable SimpleAggregateFunction aliases of Time64 return correct durations and NaT for NULL values.

SQLAlchemy and Alembic fixes

• Importing the dialect preserves another provider's clickhouse:// registration. Generated schema metadata and Alembic revisions use clickhousedb_* options so copies and migrations work with both drivers installed. #1074
• GROUP BY uses aliases only for matching top-level expressions selected by the query. Unselected and nested expressions render in full. #1062
• Nullable() and LowCardinality() preserve the wrapped type in their return annotations. #1033
• Alembic accepts reflected AggregateFunction state versions when metadata omits the version, including nested types. Explicit versions still detect changes; legacy unversioned states match explicit version 0.

Installation

pip install clickhouse-connect

For the experimental Rust codec:

pip install "clickhouse-connect[rust]"

The Rust extra requires clickhouse-connect-core>=0.2.1,<0.3. The driver checks both binding and column-buffer APIs and reports upgrade guidance for older wheels.

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.10.0, 2026-10-07

Improvements

• The DB-API Connection and Cursor now support the context manager protocol, so with connect(...) as connection: and with connection.cursor() as cursor: work. Both call close() when the block exits, including when it raises. Connection contexts don't manage transactions. The DB-API commit and rollback remain no-ops.
• Rust codec NumPy and Pandas queries no longer require PyArrow. This includes buffered and streamed results and query(..., use_numpy=True). Pandas strings use the Arrow conversion when PyArrow is installed and the Rust object conversion otherwise. Invalid UTF-8 keeps its existing hex rendering. Explicit Arrow storage and Arrow methods still require PyArrow.
• The Rust codec now converts non-nullable 8-64-bit integers, Float32/64, Boolean, BFloat16, Interval, Date/Date32, DateTime/DateTime64, and Time/Time64 columns to NumPy/Pandas directly from its decoded buffers. Nullable BFloat16 and Time/Time64 also use direct buffers, as do arrays of Time/Time64 and LowCardinality(Time). Extended Pandas nullable integer, float, and Interval output uses direct buffers as well. Output dtypes are unchanged.
• The Rust codec now feeds large response chunks to the decoder in bounded slices. This reduces temporary decoder copies and the number of decoded blocks held during conversion, lowering peak memory for large query_np, query_df, and query() results. Output is unchanged.

Bug Fixes

• Alembic autogeneration now accepts server-pinned AggregateFunction state versions when metadata omits the version, including nested types. Explicit metadata versions still detect state version changes. Reflected legacy states match an explicit version 0.
• Importing the SQLAlchemy dialect no longer replaces another provider's clickhouse:// registration, including clickhouse-sqlalchemy. Generated schema metadata and Alembic revisions use clickhousedb_* options so metadata copies and migrations work with both packages installed. Closes #1074.
• QueryResult.result_rows now works after reading result_columns. Previously, accessing rows after materializing columns raised StreamClosedError even though the data was already cached. This also affected AsyncClient.query() with column_oriented=True, where result_rows always failed.
• After a remote connection close or HTTP 429/503/504, command(), query(), raw_query(), and raw_stream() now replay only statements the client recognizes as reads. Other statements, including SQL writes, DDL, mutations, SET, USE, and CHECK TABLE, are not replayed. This also covers their DB-API and SQLAlchemy wrappers. Read retries and retries through the insert APIs, including raw_insert(), remain available. Insert retries provide at-least-once delivery and can duplicate rows without server deduplication. Closes #1079.
• Values in Dynamic shared storage, including JSON paths that exceed max_dynamic_types, now decode to Python objects instead of encoded bytes or strings. This covers supported arrays, tuples, maps, nested JSON, and date, time, UUID and IP address scalars, including nullable defaults and typed JSON null paths. DataFrame results keep the decoded objects. Closes #1070.
• Inserts that resolve column types from the server now give the internal DESCRIBE TABLE its own server-generated query ID. The INSERT retains the caller's query_id from per-call settings or client defaults. This prevents QUERY_WITH_SAME_ID_IS_ALREADY_RUNNING errors when the server hasn't yet released the finished DESCRIBE. Closes #1066.
• Closing a synchronous Native-format HTTP response now waits for an active read before draining it, including Rust codec reads that outlast read-ahead shutdown. Cleanup also finishes partially consumed HTTP chunks with the same parser. This prevents concurrent response reads, premature connection closure, and SESSION_IS_LOCKED errors on the next query.
• AsyncClient now awaits response cleanup when a Rust codec stream closes, including when its consumer is cancelled. Cleanup finishes before cancellation is re-raised.
• SQLAlchemy Nullable() and LowCardinality() now preserve the wrapped type in their return annotations. Column declarations such as Column("hostname", LowCardinality(String)) now pass strict type checking. Runtime behavior is unchanged. Closes #1033.
• SQLAlchemy GROUP BY now uses aliases only for top-level labels that match an expression selected by the current query. Unselected and nested expressions render in full. Selected aliases, including independently rebuilt matching expressions, retain their names. This fixes unknown-identifier errors and incorrect grouping when a label collides with another column. Closes #1062.
• Async insert_arrow and insert_df_arrow now run DataFrame conversion and Arrow encoding in a dedicated worker owned by the client. This reduces event-loop stalls during large inserts. Closes #1054.
• Closing a Rust codec stream during read-ahead startup no longer lets a producer read from an already closed source. This applies to sync and async cleanup.
• Closing a sync Rust codec stream early now drains its HTTP response before releasing the response iterator. This fixes premature connection closure that could make the next query on the same client fail with SESSION_IS_LOCKED.
• Concurrent sync and async cleanup of a Rust codec stream now releases its response source only once.
• Cancelling a pending Rust codec stream read now releases the waiting decoder worker. Previously, closing the stream could leave a worker blocked and hang async executor shutdown.
• Rust codec NumPy and Pandas queries now preserve nanoseconds in nullable scalar DateTime64(9) columns, including SimpleAggregateFunction aliases. They also reject unsupported scalar DateTime64 precisions consistently for nullable columns and aliases.
• Rust codec NumPy and Pandas queries now return correct durations and NaT for NULL values in Nullable(SimpleAggregateFunction(..., Time64)) columns. Previously, columns with NULLs returned floating-point bit patterns interpreted as durations.
• Large async external-data uploads now use bounded writes to avoid long event-loop stalls during TLS encryption. Closes #1057.

Compatibility

• When clickhouse-sqlalchemy is installed, use clickhousedb:// or clickhousedb+connect:// for ClickHouse Connect. Bare clickhouse:// remains with its existing provider; the ClickHouse Connect alias is still available when no other provider claims it. In mixed installs, cc-only schema options such as clickhouse_engine, clickhouse_ttl, clickhouse_settings, and clickhouse_dictionary_* must use the clickhousedb_ prefix. Custom schema defaults for ClickHouse Connect should use Table.argument_for("clickhousedb", ...) or Column.argument_for("clickhousedb", ...). Newly generated schema metadata and Alembic revisions use clickhousedb_* option names. In cc-only installs, table.kwargs["clickhouse_engine"] now returns None after a positional engine or table reflection; read clickhousedb_engine instead, and read generated Dictionary options through their clickhousedb_* keys. Public reflection dictionaries retain their existing clickhouse_* keys.
• Type checkers now infer list[String] for [Nullable(String)]. If a collection also holds other ClickHouse types, annotate it as list[ChSqlaType] from clickhouse_connect.cc_sqlalchemy.datatypes.base.
• Rust NumPy object columns for nullable scalar DateTime64(9) now contain numpy.datetime64 cells at UTC nanosecond resolution instead of Python datetime cells. SQL NULL stays None. Use query_df to retain named timezone metadata. Pandas datetime output now uses nanoseconds instead of Pandas 3's microseconds, while existing object dtypes from all-null blocks remain.
• The Rust extra now requires clickhouse-connect-core>=0.2.1,<0.3. Rust codec setup checks the column buffer API separately from the binding API and reports upgrade guidance for older core wheels. See the core 0.2.1 release notes.

1.9.0, 2026-09-21

This stable release includes all changes from 1.9.0rc1, 1.9.0rc2, and 1.9.0rc3. See those entries below for the full async SQLAlchemy feature set, Rust codec performance improvements, and fixes included in 1.9.0.

Improvements

• Added native async SQLAlchemy support for SQLAlchemy 2.0.44 and later. Install clickhouse-connect[sqlalchemy-async] and use clickhousedb+async:// with create_async_engine(). It supports buffered Core and ORM execution, DDL and reflection through run_sync(), and async Alembic environments. Use the native AsyncClient for streaming and bulk inserts. Closes #576.
• Native Map reads now support the opt-in pairs format, which returns a list of key/value tuples and preserves duplicate keys and the sequence returned by the server. The default remains a dictionary. The format also applies to nested Maps and NumPy/Pandas results. Native Map inserts still require dictionaries and raise DataError for pair lists. Closes #949.

Bug Fixes

• Rust codec read-ahead threads now close their source iterator explicitly when they stop. Early stream cleanup no longer depends on prompt garbage collection, which can delay cleanup on free-threaded Python.
• Arrow insert_arrow / insert_df_arrow now quote table and database identifiers the same way insert() does, so hyphenated and other names that need backquotes work on both the sync and async clients. Closes #1014.

... (truncated)

Commits

• 090fb9a Release/1.10.0 (#1085)
• fec4e57 Fix Alembic comparison of server-pinned aggregate state versions (#1084)
• 6d73879 Fix SQLAlchemy dialect coexistence with clickhouse-sqlalchemy (#1082)
• a104e28 Fix row access after materializing query result columns (#1081)
• 08131dc Restrict HTTP retries to recognized reads and insert data (#1080)
• 122edfe Fix free-threaded insert concurrency test timeouts (#1078)
• 4c25bc1 release prep for core 0.2.2 (#1077)
• cac10b2 Fix Rust insert crashes on free-threaded Python (#1076)
• c9f8139 Fix decoding of Dynamic shared values (#1071)
• 8d3fe7b Keep the insert query_id off the internal DESCRIBE TABLE (#1067)
• Additional commits viewable in compare view

Updates fastparquet from 2026.5.0 to 2026.9.0

Commits

• f4beb59 fix pandas test regression (#982)
• fb5634c compat: numpy 2.5.0 (#981)
• d17427b Zero-pad last bitpacked group of categories (#980)
• b5e7921 BUG: fix default string dtype used for pandas 3 (#977)
• See full diff in compare view

Updates pytz from 2026.3.post1 to 2026.5

Commits

• 21be17f Add Python 3.14 to test suite
• fddd01c Bump version numbers to 2026.5 (2026e)
• 8f05ab3 IANA 2026e
• d79605f Squashed 'tz/' changes from d633fe7ed3..db07415c7d
• 1ac6e51 Bump version numbers to 2026.4 (2026d)
• 1672798 IANA 2026d
• 0b5995b Squashed 'tz/' changes from 71f28b9ab3..bac9223f4b
• e96461b Make deprecation notice louder
• 3c7af58 Merge branch 'nicoleman0-fix/timezone-non-string-input' into 2026d
• 234a247 Merge branch 'nicoleman0-fix/fixedoffset-basetzinfo' into 2026d
• Additional commits viewable in compare view