chore(deps): update all dependencies

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@angular/build	21.2.9 → 21.2.13			devDependencies	patch
@angular/cli	21.2.9 → 21.2.13			devDependencies	patch
@angular/common (source)	21.2.11 → 21.2.15			dependencies	patch
@angular/compiler (source)	21.2.11 → 21.2.15			dependencies	patch
@angular/compiler-cli (source)	21.2.11 → 21.2.15			devDependencies	patch
@angular/core (source)	21.2.11 → 21.2.15			dependencies	patch
@angular/forms (source)	21.2.11 → 21.2.15			dependencies	patch
@angular/platform-browser (source)	21.2.11 → 21.2.15			dependencies	patch
@angular/router (source)	21.2.11 → 21.2.15			dependencies	patch
@babel/preset-env (source)	7.29.5 → 7.29.7			devDependencies	patch
SQLAlchemy (changelog)	==2.0.49 → ==2.0.50				patch
actions/checkout	v4 → v6			action	major
actions/setup-python	v5 → v6			action	major
aiohappyeyeballs (changelog)	==2.6.1 → ==2.6.2				patch
bigframes (source, changelog)	==2.39.0 → ==2.41.0				minor
cachetools (changelog)	==7.1.1 → ==7.1.4				patch
certifi	==2026.4.22 → ==2026.5.20				minor
click (changelog)	==8.3.3 → ==8.4.1				minor
dorny/paths-filter	v3 → v4			action	major
esbuild	^0.20.0 → ^0.28.0			devDependencies	minor
google-auth	==2.50.0 → ==2.53.0				minor
google-auth	==2.52.0 → ==2.53.0				minor
google-cloud-core (source)	==2.5.1 → ==2.6.0				minor
google-cloud-spanner (source)	==3.65.0 → ==3.66.0				minor
googleapis-common-protos (source)	==1.74.0 → ==1.75.0				minor
greenlet (changelog)	==3.5.0 → ==3.5.1				patch
idna (changelog)	==3.13 → ==3.17				minor
idna (changelog)	==3.15 → ==3.17				minor
ipython	==9.13.0 → ==9.14.0				minor
jsdom	^28.0.0 → ^29.0.0			devDependencies	major
npm (source)	11.7.0 → 11.16.0			packageManager	minor
opentelemetry-api	==1.41.1 → ==1.42.1				minor
opentelemetry-sdk	==1.41.1 → ==1.42.1				minor
pandas	==2.3.3 → ==3.0.3				major
pip (changelog)	==26.1.1 → ==26.1.2				patch
platformdirs (changelog)	==4.9.6 → ==4.10.0				minor
polars (changelog)	==1.40.1 → ==1.41.2				minor
proto-plus	==1.27.2 → ==1.28.0				minor
protobuf	==7.34.1 → ==7.35.0				minor
pytest-asyncio (changelog)	==1.3.0 → ==1.4.0				minor
python	3.10 → 3.14			uses-with	minor
python	3.12 → 3.14			uses-with	minor
requests (changelog)	==2.33.1 → ==2.34.2				minor
ruff (source, changelog)	==0.15.12 → ==0.15.15				patch
rules_cc	0.1.1 → 0.2.18			http_archive	minor
typescript (source)	~5.9.2 → ~6.0.0			devDependencies	major
virtualenv	==21.3.1 → ==21.4.2				minor
vitest (source)	4.1.5 → 4.1.7			devDependencies	patch
wrapt (changelog)	==2.1.2 → ==2.2.1				minor
yarl	==1.23.0 → ==1.24.2				minor
zipp	==3.23.1 → ==4.1.0				major

---

Release Notes

angular/angular-cli (@​angular/build)

v21.2.13

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
3c6d26a31	fix	remove unconditional CORS wildcard from webpack dev-server

@​angular/build

Commit	Type	Description
2b3e95517	fix	assert that asset input paths are within workspace root

v21.2.12

Compare Source

@​angular/build

Commit	Type	Description
cbad57579	fix	ignore virtual esbuild paths with (disabled):

v21.2.11

Compare Source

@​angular/cli

Commit	Type	Description
bbd63b7a5	fix	robustly parse npm manifest from array

@​angular/ssr

Commit	Type	Description
eafe1a719	fix	allow all hosts in common engine rendering options to prevent validation errors
7a116a80d	fix	remove stateful flag from URL_PARAMETER_REGEXP

v21.2.10

Compare Source

@​angular/cli

Commit	Type	Description
bb8611913	fix	restrict MCP workspace access to allowed client roots during resolution

angular/angular (@​angular/common)

v21.2.15

Compare Source

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68925)
eb1cbbf2eb	fix	prevent namespaced SVG <style> elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#​68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#​68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#​68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#​68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#​68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

v21.2.14

Compare Source

compiler

Commit	Type	Description
68282dff9f	fix	strip namespaced SVG script elements during template compilation

core

Commit	Type	Description
c0f52272ed	fix	do not insert todo when migrating void @​Output
938a7f3edd	fix	makes resource URL sanitizer lookup case-insensitive
0fb2724194	fix	reject script element as a dynamic component host
49113ac0ef	fix	visit ICU expressions in signal migration schematics

router

Commit	Type	Description
099bf577ee	fix	skip scroll-to-top on initial navigation when hydrating

v21.2.13

Compare Source

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

v21.2.12

Compare Source

core

Commit	Type	Description
fe13bb669d	fix	allow explicit read generic with signal input transforms
3430251fef	fix	i18n flags leaking on errors
1aeebbe304	fix	respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57	fix	sanitizer typings
7a05a9a71a	fix	validate security-sensitive attributes in i18n bindings
c37f6ca42f	fix	visit ng-let expression value in signal migration schematics

forms

Commit	Type	Description
03ad53863b	fix	prohibit concurrent submits in signal forms

babel/babel (@​babel/preset-env)

v7.29.7

Compare Source

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

actions/checkout (actions/checkout)

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

v6.0.0

Compare Source

v6

Compare Source

v5.0.1

Compare Source

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in #​2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

Compare Source

What's Changed

• Update actions checkout to use node 24 by @​salmanmkc in #​2226
• Prepare v5.0.0 release by @​salmanmkc in #​2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v5

Compare Source

v4.3.1

Compare Source

What's Changed

• Port v6 cleanup to v4 by @​ericsciple in #​2305

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236
• Prepare release v4.3.0 by @​salmanmkc in #​2237

New Contributors

• @​motss made their first contribution in #​1971
• @​mouismail made their first contribution in #​1977
• @​benwells made their first contribution in #​2043
• @​nebuk89 made their first contribution in #​2194
• @​salmanmkc made their first contribution in #​2236

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

Compare Source

• url-helper.ts now leverages well-known environment variables by @​jww3 in #​1941
• Expand unit test coverage for isGhes by @​jww3 in #​1946

v4.2.1

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in #​1924

v4.2.0

Compare Source

• Add Ref and Commit outputs by @​lucacome in #​1180
• Dependency updates by @​dependabot- #​1777, #​1872

v4.1.7

Compare Source

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in #​1739
• Bump actions/checkout from 3 to 4 by @​dependabot in #​1697
• Check out other refs/* by commit by @​orhantoy in #​1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in #​1776

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in #​1732

v4.1.5

Compare Source

• Update NPM dependencies by @​cory-miller in #​1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in #​1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in #​1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in #​1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in #​1707

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in #​1692
• Add dependabot config by @​cory-miller in #​1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in #​1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in #​1643

v4.1.3

Compare Source

• Check git version before attempting to disable sparse-checkout by @​jww3 in #​1656
• Add SSH user parameter by @​cory-miller in #​1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in #​1650

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598

v4.1.1

Compare Source

• Correct link to GitHub Docs by @​peterbe in #​1511
• Link to release page from what's new section by @​cory-miller in #​1514

v4.1.0

Compare Source

• Add support for partial checkout filters

actions/setup-python (actions/setup-python)

v6.2.0

Compare Source

v6.1.0

Compare Source

What's Changed

Enhancements:

• Add support for pip-install input by @​gowridurgad in #​1201
• Add graalpy early-access and windows builds by @​timfel in #​880

Dependency and Documentation updates:

• Enhanced wording and updated example usage for allow-prereleases by @​yarikoptic in #​979
• Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @​dependabot in #​1139
• Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @​dependabot in #​1094
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @​dependabot in #​1199
• Upgrade requests from 2.32.2 to 2.32.4 by @​dependabot in #​1130
• Upgrade prettier from 3.5.3 to 3.6.2 by @​dependabot in #​1234
• Upgrade @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by @​dependabot in #​1235

New Contributors

• @​yarikoptic made their first contribution in #​979

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in #​1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

• Add support for pip-version by @​priyagupta108 in #​1129
• Enhance reading from .python-version by @​krystof-k in #​787
• Add version parsing from Pipfile by @​aradkdj in #​1067

Bug fixes:

• Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @​aparnajyothi-y in #​1183
• Change missing cache directory error to warning by @​aparnajyothi-y in #​1182
• Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @​aparnajyothi-y in #​1122
• Include python version in PyPy python-version output by @​cdce8p in #​1110
• Update docs: clarification on pip authentication with setup-python by @​priya-kinthali in #​1156

Dependency updates:

• Upgrade idna from 2.9 to 3.7 in /tests/data by @​dependabot[bot] in #​843
• Upgrade form-data to fix critical vulnerabilities #​182 & #​183 by @​aparnajyothi-y in #​1163
• Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @​aparnajyothi-y in #​1165
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​1181
• Upgrade @​actions/tool-cache from 2.0.1 to 2.0.2 by @​dependabot[bot] in #​1095

New Contributors

• @​krystof-k made their first contribution in #​787
• @​cdce8p made their first contribution in #​1110
• @​aradkdj made their first contribution in #​1067

Full Changelog: actions/setup-python@v5...v6.0.0

v6

Compare Source

v5.6.0

Compare Source

What's Changed

• Workflow updates related to Ubuntu 20.04 by @​aparnajyothi-y in #​1065
• Fix for Candidate Not Iterable Error by @​aparnajyothi-y in #​1082
• Upgrade semver and @​types/semver by @​dependabot in #​1091
• Upgrade prettier from 2.8.8 to 3.5.3 by @​dependabot in #​1046
• Upgrade ts-jest from 29.1.2 to 29.3.2

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates several dependencies across multiple packages, including bigframes, rules_cc, google-auth, requests, and pandas. A compatibility issue was identified in the BigQuery Storage sample requirements, where the version marker for pandas 3.0.3 needs to be updated to Python 3.10 or higher to prevent installation failures on Python 3.9.

[gemini-code-assist]

Pandas 3.0.0 and later versions require Python 3.10 or higher. The current environment marker python_version >= '3.9' will cause installation failures on Python 3.9. Since other dependencies updated in this pull request (such as google-cloud-core v2.6.0) are also dropping support for Python 3.9, this marker should be updated to reflect the new minimum requirement.

pandas==3.0.3; python_version >= '3.10'

[forking-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: packages/bigframes/bigframes/display/table_widget_angular/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: table-widget-angular@0.0.0
npm error Found: typescript@6.0.3
npm error node_modules/typescript
npm error   dev typescript@"~6.0.0" from the root project
npm error   peerOptional typescript@">=5.9 <6.1" from @angular/compiler-cli@21.2.15
npm error   node_modules/@angular/compiler-cli
npm error     dev @angular/compiler-cli@"^21.2.0" from the root project
npm error     peer @angular/compiler-cli@"^21.0.0" from @angular/build@21.2.13
npm error     node_modules/@angular/build
npm error       dev @angular/build@"^21.2.9" from the root project
npm error     2 more (@angular/localize, ng-packagr)
npm error
npm error Could not resolve dependency:
npm error peer typescript@">=5.9 <6.0" from @angular/build@21.2.13
npm error node_modules/@angular/build
npm error   dev @angular/build@"^21.2.9" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-05-31T21_16_05_816Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-05-31T21_16_05_816Z-debug-0.log