build(deps): bump the sandbox-python group in /sandbox with 4 updates

[dependabot]

Bumps the sandbox-python group in /sandbox with 4 updates: boto3, clickhouse-connect, eth-abi and eth-account.

Updates boto3 from 1.43.72 to 1.43.78

Commits

• bf8d343 Merge branch 'release-1.43.78'
• 4830df4 Bumping version to 1.43.78
• 921bb10 Add changelog entries from botocore
• cca5d6f Merge branch 'release-1.43.77'
• 2ff832b Merge branch 'release-1.43.77' into develop
• 8c3a6f7 Bumping version to 1.43.77
• ce5785b Add changelog entries from botocore
• 8a88b26 Merge branch 'release-1.43.76'
• ced31bb Merge branch 'release-1.43.76' into develop
• a1cecc3 Bumping version to 1.43.76
• Additional commits viewable in compare view

Updates clickhouse-connect from 1.7.1 to 1.7.2

Release notes

Sourced from clickhouse-connect's releases.

v1.7.2

clickhouse-connect v1.7.2

This patch release fixes SQLAlchemy reflection and SQL generation, query formatting, server-side parameter names, and HTTP proxy path handling.

What's Changed

Bug Fixes

• SQLAlchemy inspectors bound to an Engine now support get_columns() and reflect_table() on SQLAlchemy 2.x. Reflection also honors include_columns and exclude_columns. Closes #967.
• Queries ending with a semicolon, whitespace, or trailing comment now place client-appended FORMAT clauses correctly. Insert detection also follows SQL token rules. Closes #903.
• The async client now preserves explicit proxy_path values without adding extra slashes. Closes #963.
• The synchronous client now sends a normalized / request path through forwarding HTTP proxies when no proxy_path is configured. Closes #951.
• Server-side query placeholders now recognize $ in valid parameter names while preserving raw binary binding and ambiguity checks. Closes #936.
• SQLAlchemy ClickHouse types now implement the public literal processor contract for TypeDecorator and with_variant(). Closes #965.
• SQLAlchemy literals containing percent signs now compile safely alongside bound parameters and in server-side parameter mode. Closes #966.
• SQLAlchemy now applies ClickHouse backslash escaping to generic literal strings, defaults, aliases, TTL clauses, comments, and Alembic comment operations. Custom pre-escaping workarounds should be removed. Closes #975.
• SQLAlchemy union(), intersect(), and except_() now emit explicit DISTINCT operations. Use the corresponding _all() methods when duplicate-preserving behavior is required. Closes #973.
• SQLAlchemy Select.with_hint() now emits SAWarning when an applicable table hint would otherwise be ignored. Generated SQL remains unchanged. Closes #974.

Full Changelog: v1.7.1...v1.7.2

Installation

pip install clickhouse-connect

Changelog

Sourced from clickhouse-connect's changelog.

1.7.2, 2026-08-19

Bug Fixes

• SQLAlchemy inspectors bound to an Engine can now call get_columns() and reflect_table() directly on SQLAlchemy 2.x. These methods now acquire and reuse one connection for each reflection operation, while inspectors already bound to a Connection continue to reuse it. Table reflection also honors positional include_columns and exclude_columns filters passed by SQLAlchemy instead of silently reflecting every column. Closes #967.
• Queries ending in a semicolon now keep the client-appended FORMAT clause inside the statement, including when the semicolon is followed by whitespace or a trailing comment. This fixes query, query_arrow, and raw_query with fmt for both sync and async clients. A lone directly trailing semicolon keeps the existing fast binding path, and inserts carrying inline data are never passed through the SQL lexer. Insert detection now follows SQL token rules, so quoted text such as ' INSERT INTO ' in a SELECT no longer misroutes the query, and identifiers named insert are not mistaken for the keyword. Closes #903.
• The async client now preserves an explicit proxy_path when constructing request URLs. It previously appended / unconditionally, changing /clickhouse to /clickhouse/ and /clickhouse/ to /clickhouse//, which could break exact-path proxy routing. Bare authority URLs still use /. Closes #963.
• The synchronous client now normalizes an empty request path to / when no proxy_path is configured, so requests routed through a forwarding HTTP proxy (http_proxy/HTTP_PROXY) use the normal absolute-form request-target (http://host:8123/?query=...) instead of the RFC-valid but non-normalized http://host:8123?query=..., which some proxies reject with HTTP 400 and others forward with the query string silently dropped. Direct connections are unaffected because urllib3 already normalizes the empty path, and an explicit proxy_path is left exactly as-is. This matches the async client, which already sent the path. Closes #951.
• Query placeholders now recognize $ in server-valid parameter names such as {id$x:Int32} or {$x$:String}. Previously these names were missed, which omitted their server-side values and could also drop DateTime64 precision and timezone hints. Placeholder detection is otherwise unchanged from 1.x. A $name$ dictionary key with a buffer value such as bytes, bytearray, or memoryview stays a raw binary bind. A non-buffer value for such a key can bind through a single {name:Type} placeholder, and ambiguous or repeated uses of the name raise ProgrammingError. SQLAlchemy server_side_params accepts the same names and rejects the reserved $name$ form. Closes #936.
• SQLAlchemy ClickHouse types now implement the public literal processor contract, so TypeDecorator wrappers and with_variant() render ClickHouse literals with proper quoting and escaping. Closes #965.
• SQLAlchemy ClickHouse type literals containing percent signs now compile safely alongside remaining bound parameters, and server-side parameter mode preserves consecutive percent signs in literals. Closes #966.
• SQLAlchemy now applies ClickHouse backslash escaping to generic literal_binds strings, string DEFAULT, MATERIALIZED, ALIAS, and TTL clauses, CREATE comments, and Alembic table and column comment operations. Backslash values now round-trip verbatim instead of being reinterpreted or terminating a quoted literal. ClickHouse-native literal processors and percent handling are unchanged. If custom TypeDecorator.process_literal_param or UserDefinedType code pre-escaped backslashes as a workaround, remove that workaround because the dialect now applies ClickHouse escaping. Closes #975.
• SQLAlchemy union(), intersect(), and except_() now compile to explicit UNION DISTINCT, INTERSECT DISTINCT, and EXCEPT DISTINCT, preserving SQLAlchemy's duplicate-removing semantics instead of relying on ClickHouse defaults. Their union_all(), intersect_all(), and except_all() counterparts remain explicit ALL operations. Users relying on previous duplicate-preserving behavior from union_default_mode='ALL' or ClickHouse's default intersect_default_mode='ALL' and except_default_mode='ALL' should switch to the corresponding _all() method. Closes #973.
• SQLAlchemy Select.with_hint() now emits an SAWarning when an applicable table hint would otherwise be silently ignored. The generated SQL remains unchanged for 1.x compatibility. Applications that promote SAWarning to an error will now stop at compilation instead of executing without the requested hint. Use the typed final(), sample(), prewhere(), and limit_by() methods for those ClickHouse clauses. Raw with_statement_hint() tail directives remain supported. Closes #974.

Commits

• 9283654 release prep for 1.7.2 (#980)
• 836e12e fix SQLAlchemy engine-bound table reflection (#979)
• 1b7b0af fix SQLAlchemy DISTINCT set operations (#978)
• c76037d warn on ignored SQLAlchemy table hints (#977)
• 6ca829b Joe/fix arrow trailing semicolon (#970)
• f110acc update review instructions and arch metadata (#976)
• 289f42a Fix SQLAlchemy DDL string literal escaping for comments and string defaults (...
• 9c24d33 Joe/fix chsqlatype literal bugs (#969)
• 2f34aa5 use centralized docs drift checker (#961)
• 8e15d09 async explicit proxy_path preservation (#964)
• Additional commits viewable in compare view

Updates eth-abi from 5.2.0 to 6.0.0

Release notes

Sourced from eth-abi's releases.

v6.0.0

What's Changed

• add funding.json by @​wolovim in ApeWorX/eth-abi#242
• docs: fix the installation package by @​matrixise in ApeWorX/eth-abi#243
• Template upgrades by @​kclowes in ApeWorX/eth-abi#250
• feat: optimize encode and decode by @​BobTheBuidler in ApeWorX/eth-abi#246
• refactor: drop <3.10; add <=3.14; migrate to prek and ruff; use Github Actions by @​fubuloubu in ApeWorX/eth-abi#268

New Contributors

• @​wolovim made their first contribution in ApeWorX/eth-abi#242
• @​matrixise made their first contribution in ApeWorX/eth-abi#243
• @​BobTheBuidler made their first contribution in ApeWorX/eth-abi#246

Full Changelog: ApeWorX/eth-abi@v5.2.0...v6.0.0

Changelog

Sourced from eth-abi's changelog.

Release Notes

.. towncrier release notes start

eth-abi v6.0.0-beta.1 (2025-12-17)

Breaking Changes

- Drop support for Python 3.8 & 3.9 (`[#250](https://github.com/ApeWorX/eth-abi/issues/250) <https://github.com/ApeWorX/eth-abi/issues/250>`__)
Improved Documentation

• Fix typo in index ([#243](https://github.com/ApeWorX/eth-abi/issues/243) <https://github.com/ApeWorX/eth-abi/issues/243>__)

Features

- Add support for Python 3.14 (`[#250](https://github.com/ApeWorX/eth-abi/issues/250) <https://github.com/ApeWorX/eth-abi/issues/250>`__)

Commits

• c0d2d0f refactor: drop <3.10; add <=3.14; migrate to prek and ruff; use Github Action...
• afa145a newsfragment for #246
• a92aff7 feat: optimize encode and decode
• cdc7e65 Bump version: 5.2.0 → 6.0.0-beta.1
• 484a3cf Compile release notes for v6.0.0-beta.1
• a7e0aad Merge pull request #250 from kclowes/template-upgrades
• 303b4d7 Fix docs/contributing
• 404786a Add newsfragments for #250
• 0eac8dd Remove hypothesis warnings
• d4c9a81 Fix typing
• Additional commits viewable in compare view

Updates eth-account from 0.13.7 to 0.14.0

Release notes

Sourced from eth-account's releases.

v0.14.0

What's Changed

• Fix BaseModel typing error on Pydantic >= 2.12 by @​kclowes in ApeWorX/eth-account#326
• Template upgrade by @​kclowes in ApeWorX/eth-account#328
• Bump eth-utils to allow for CamelModel usage by @​kclowes in ApeWorX/eth-account#329
• Add cell proofs for peerdas compat (Fusaka) by @​fselmo in ApeWorX/eth-account#327
• Bump golang.org/x/crypto from 0.36.0 to 0.45.0 in /tests/_scripts/go-kzg-verify by @​dependabot[bot] in ApeWorX/eth-account#330
• Bump github.com/consensys/gnark-crypto from 0.18.0 to 0.18.1 in /tests/_scripts/go-kzg-verify by @​dependabot[bot] in ApeWorX/eth-account#331
• Inherit from eth-utils CamelModel for pydantic types: by @​fselmo in ApeWorX/eth-account#320
• Breaking/add remaining breaking changes for major by @​fselmo in ApeWorX/eth-account#333
• refactor: drop <3.10; add <=3.14; migrate to prek and ruff; use Github Actions by @​fubuloubu in ApeWorX/eth-account#342

Full Changelog: ApeWorX/eth-account@v0.13.7...v0.14.0

Changelog

Sourced from eth-account's changelog.

Release Notes

.. towncrier release notes start

eth-account v0.14.0-beta.1 (2025-12-18)

Breaking Changes

- Drop support for Python 3.8 and 3.9 (`[#328](https://github.com/ApeWorX/eth-account/issues/328) <https://github.com/ethereum/eth-account/issues/328>`__)
- Bump eth-utils requirement to >=5.3.0 to allow for CamelModel usage (`[#329](https://github.com/ApeWorX/eth-account/issues/329) <https://github.com/ethereum/eth-account/issues/329>`__)
Features

- Add support for Python 3.14 (`[#328](https://github.com/ApeWorX/eth-account/issues/328) &lt;https://github.com/ethereum/eth-account/issues/328&gt;`__)
Internal Changes - for eth-account Contributors

</code></pre>

<ul>

<li>Fix mypy errors with BaseModel.model_json_schema introduced with Pydantic 2.12 (<code>#326 &lt;https://github.com/ethereum/eth-account/issues/326&amp;gt;&lt;/code&gt;__)&lt;/li>

</ul>

</blockquote>

</details>

<details>

<summary>Commits</summary>
<ul>

<li><a href="https://github.com/ApeWorX/eth-account/commit/7972dcd2b565315882fd1be5082cb1aa2a856689&quot;&gt;&lt;code&gt;7972dcd&lt;/code&gt;&lt;/a> refactor: drop &lt;3.10; add &lt;=3.14; migrate to prek and ruff; use Github Action...</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/20757b1138419e01da56ab4d79f09bb5b95fc079&quot;&gt;&lt;code&gt;20757b1&lt;/code&gt;&lt;/a> Breaking/add remaining breaking changes for major (<a href="https://redirect.github.com/ApeWorX/eth-account/issues/333&quot;&gt;#333&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/63a9fc5dcf0fe25cb79dbbdaeb09dea49e4ebf35&quot;&gt;&lt;code&gt;63a9fc5&lt;/code&gt;&lt;/a> parametrized sets -&gt; ordered list so we can run with xdist</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/7fe8e016da979e90030b7ef0ba9bad22ccac0195&quot;&gt;&lt;code&gt;7fe8e01&lt;/code&gt;&lt;/a> remove deprecated method, no longer needed after eth-utils bump</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/f5653f32371422248f0d21b37ce95643db1da3e5&quot;&gt;&lt;code&gt;f5653f3&lt;/code&gt;&lt;/a> Inherit from eth-utils CamelModel for pydantic types:</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/b8fc03a99d9b4f7b5601e4c5b496c518f9a32b67&quot;&gt;&lt;code&gt;b8fc03a&lt;/code&gt;&lt;/a> re-generate test vectors after go dep updates</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/e94fd3b5fb51b6e8f948e3a5e2810a90d3c011d1&quot;&gt;&lt;code&gt;e94fd3b&lt;/code&gt;&lt;/a> Bump github.com/consensys/gnark-crypto in /tests/_scripts/go-kzg-verify</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/c52a8ed5510a8b16e9ea9f7459a21e8691854d24&quot;&gt;&lt;code&gt;c52a8ed&lt;/code&gt;&lt;/a> re-generate test vectors after go dep updates</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/04bb3633e986524365a77b9905d17ab01072ee1f&quot;&gt;&lt;code&gt;04bb363&lt;/code&gt;&lt;/a> Bump golang.org/x/crypto in /tests/_scripts/go-kzg-verify</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/5eb3acb6f25de657310ff81f55b5d1e90a03f032&quot;&gt;&lt;code&gt;5eb3acb&lt;/code&gt;&lt;/a> move test scripts into</li>

<li>Additional commits viewable in <a href="https://github.com/ApeWorX/eth-account/compare/v0.13.7...v0.14.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[redpandabot]

Summary

Dependency bump for the sandbox Python image: boto3 and clickhouse-connect are patch-level, eth-account (0.13.7->0.14.0) and eth-abi (5.2.0->6.0.0) are major bumps that also force major transitive bumps (eth-keyfile, eth-keys, eth-rlp, hexbytes). I verified the only in-repo consumer (modules/evm/python/evm.py) uses APIs present in eth-account 0.14.0, and OSV reports no known vulnerabilities for any bumped version. One concern: the lock newly pins the pre-release py-ecc 9.0.0b1.

Issues

• 🟡 sandbox/requirements.txt:1489 — lockfile ships pre-release py-ecc 9.0.0b1 as a new transitive dep — see the thread on that line

---

_{Reviewed @ 71530aac
"If you don't have time to do it right, when will you have time to do it over?" — John Wooden}

[redpandabot]

🟡 lockfile ships pre-release py-ecc 9.0.0b1 as a new transitive dep

The bump drags in py-ecc==9.0.0b1 (a beta) via eth-keyfile 0.10.0, but eth-keyfile's published metadata only requires py_ecc>=5.2.0 and a stable py-ecc 8.0.0 satisfies that — a default resolver would not pick a pre-release. Shipping a beta transitive library in the hash-locked sandbox image is churn beyond the bump; confirm it is intentional (e.g. a deliberate --pre allow) or pin the stable 8.0.0.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.