[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
beautifulsoup4 (changelog)	==4.12.3 → ==4.15.0
lxml (source, changelog)	==6.1.0 → ==6.1.3
pandas (changelog)	==2.2.3 → ==2.3.3
requests (changelog)	==2.33.0 → ==2.34.2

---

Release Notes

lxml/lxml (lxml)

v6.1.3

Compare Source

==================

Bugs fixed

• LP#2165901: External parameter entity parsing was allowed by default
  (with resolve_entities="internal").
  Issue found by Tomer Fichman.

v6.1.2

Compare Source

==================

• GH#526: Some build files were missing in the sdist.
  Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

v6.1.1

Compare Source

==================

Bugs fixed

• The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
  which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
  GHSA-4jhm-jv67-739f

• The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

• The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

pandas-dev/pandas (pandas)

v2.3.3: Pandas 2.3.3

Compare Source

We are pleased to announce the release of pandas 2.3.3.
This release includes some improvements and fixes to the future string data type (preview feature for the upcoming pandas 3.0). We recommend that all users upgrade to this version.

See the full whatsnew for a list of all the changes.
Pandas 2.3.3 supports Python 3.9 and higher, and is the first release to support Python 3.14.

The release will be available on the conda-forge channel:

conda install pandas --channel conda-forge

Or via PyPI:

python3 -m pip install --upgrade pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

v2.3.2: Pandas 2.3.2

Compare Source

We are pleased to announce the release of pandas 2.3.2.
This release includes some improvements and fixes to the future string data type (preview feature for the upcoming pandas 3.0). We recommend that all users upgrade to this version.

See the full whatsnew for a list of all the changes.
Pandas 2.3.2 supports Python 3.9 and higher.

The release will be available on the conda-forge channel:

conda install pandas --channel conda-forge

Or via PyPI:

python3 -m pip install --upgrade pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

v2.3.1: Pandas 2.3.1

Compare Source

We are pleased to announce the release of pandas 2.3.1.
This release includes some improvements and fixes to the future string data type (preview feature for the upcoming pandas 3.0). We recommend that all users upgrade to this version.

See the full whatsnew for a list of all the changes.
Pandas 2.3.1 supports Python 3.9 and higher.

The release will be available on the conda-forge channel:

conda install pandas --channel conda-forge

Or via PyPI:

python3 -m pip install --upgrade pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

v2.3.0: Pandas 2.3.0

Compare Source

We are pleased to announce the release of pandas 2.3.0.
This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

See the full whatsnew for a list of all the changes.
Pandas 2.3.0 supports Python 3.10 and higher.

The release will be available on the defaults and conda-forge channels:

conda install -c conda-forge pandas

Or via PyPI:

python3 -m pip install --upgrade pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

v2.33.1

Compare Source

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
  files in the tmp directory. (#​7305)
• Fixed Content-Type header parsing for malformed values. (#​7309)
• Improved error consistency for malformed header values. (#​7308)

---

Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

• Branch creation
  • "before 6am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.