[dependabot]

Bumps the python group with 7 updates in the / directory:

Package	From	To
aws-cdk-lib	2.266.0	2.273.0
boto3	1.43.78	1.43.114
eoapi-cdk	11.6.4	11.8.0
pydantic-settings[yaml]	2.15.0	2.16.0
pydantic	2.13.4	2.14.1
pre-commit	4.6.2	4.7.0
pypgstac	0.9.11	0.10.0

Updates aws-cdk-lib from 2.266.0 to 2.273.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.273.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-appstream: AWS::AppStream::StackFleetAssociation: FleetName property is now immutable. aws-appstream: AWS::AppStream::StackFleetAssociation: StackName property is now immutable. aws-appsync: AWS::AppSync::ApiCache: AtRestEncryptionEnabled property is now immutable. aws-appsync: AWS::AppSync::ApiCache: TransitEncryptionEnabled property is now immutable. aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: OutputConfig attribute removed. aws-cloud9: AWS::Cloud9::EnvironmentEC2: Id attribute removed. aws-config: AWS::Config::ConfigurationRecorder: Id attribute removed. aws-config: AWS::Config::OrganizationConfigRule: Id attribute removed. aws-datazone: AWS::DataZone::PolicyGrant: Detail property is now required. aws-datazone: AWS::DataZone::PolicyGrant: Principal property is now required. aws-directoryservice: AWS::DirectoryService::MicrosoftAD: Id attribute removed. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.NetworkProtocol property is now required. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.SecurityGroupIds property is now required.

Features

• update L1 CloudFormation resource definitions (#38969) (ed0df78)
• batch: add ConsumableResource L2 construct (#36971) (a12f3a1)
• bedrockagentcore: support runtime platformVersion (#38924) (227423f)
• cloudfront: default Distribution behaviors to redirect HTTP to HTTPS (#38721) (6ede006), closes #38599
• opensearchservice: add useLatestServiceSoftwareForBlueGreen support (#38499) (6aa03e5), closes #38664 #38664
• pipelines: add executionMode support in CodePipeline L3 construct (#35022) (7283d38), closes #35014

Bug Fixes

• bump bundled brace-expansion to 5.0.12 (#38929) (ff25def), closes #38932
• applicationautoscaling: target tracking silently ignores custom metric account and region (#36503) (5d10288), closes #36401
• bedrockagentcore: accept aws-cn ECR image URIs in Runtime container URI validation (#38948) (49ac618), closes #38947
• cloudfront-origins: missing OAC permissions for Function URL (#35919) (d213cc7), closes #35872 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L577 #35725
• core: validation E2001 inadvertently not enabled (#38920) (0b763a7)
• eks: allow access policies on AccessEntryType.EC2 access entries (#38782) (e507e07), closes #37496
• s3-deployment: Source.data objectKey can write outside the staging directory (#38921) (53439f9)

---

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

• redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
• redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

• redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

• redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
• redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

• redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

Bug Fixes

• redshift-alpha: reject PUBLIC user names (#38935) (3335407)

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead

... (truncated)

Commits

• 60329ee chore(release): 2.273.0 (#38997)
• 22a8ee5 chore: update analytics metadata blueprints
• f911ee4 chore(release): 2.273.0
• ed0df78 feat: update L1 CloudFormation resource definitions (#38969)
• 873b82b docs: add cdk-review skills (#38942)
• 07c059f docs(events): add examples for RuleTargetInput and EventField (#38470)
• 7292cc7 chore(bedrock): add Claude Opus 5, Mythos 5, and Fable 5 foundation models (#...
• 2915b0d chore(ec2): interface VPC endpoint for eks-proxy (#38385)
• a12f3a1 feat(batch): add ConsumableResource L2 construct (#36971)
• 6aa03e5 feat(opensearchservice): add useLatestServiceSoftwareForBlueGreen support (#3...
• Additional commits viewable in compare view

Updates boto3 from 1.43.78 to 1.43.114

Commits

• 432fa17 Merge branch 'release-1.43.114'
• bf4aed7 Bumping version to 1.43.114
• fa3e3f2 Add changelog entries from botocore
• 69ed308 Merge branch 'release-1.43.113'
• 3abaa49 Merge branch 'release-1.43.113' into develop
• 741f8d9 Bumping version to 1.43.113
• ad1c6b5 Add changelog entries from botocore
• 9ca5e36 Merge branch 'release-1.43.112'
• f5581ba Merge branch 'release-1.43.112' into develop
• 6f065c3 Bumping version to 1.43.112
• Additional commits viewable in compare view

Updates eoapi-cdk from 11.6.4 to 11.8.0

Release notes

Sourced from eoapi-cdk's releases.

v11.8.0

11.8.0 (2026-09-30)

Features

• add s3Prefix for stac-browser (#314) (985aa22)

v11.7.1

11.7.1 (2026-09-19)

Bug Fixes

• ingest type=Catalog along with collections in stac-loader (#310) (2437790)

v11.7.0

11.7.0 (2026-09-10)

Features

• upgrade core runtime dependencies (stac-fastapi-pgstac 6.4, titiler-pgstac 3.1, tipg 1.6) (#302) (f9cccc0)

v11.6.5

11.6.5 (2026-09-09)

Bug Fixes

• pin to affine<3 in stactools item generator (#300) (81fe4a3)

Changelog

Sourced from eoapi-cdk's changelog.

11.8.0 (2026-09-30)

Features

• add s3Prefix for stac-browser (#314) (985aa22)

11.7.1 (2026-09-19)

Bug Fixes

• ingest type=Catalog along with collections in stac-loader (#310) (2437790)

11.7.0 (2026-09-10)

Features

• upgrade core runtime dependencies (stac-fastapi-pgstac 6.4, titiler-pgstac 3.1, tipg 1.6) (#302) (f9cccc0)

11.6.5 (2026-09-09)

Bug Fixes

• pin to affine<3 in stactools item generator (#300) (81fe4a3)

Commits

• ca1a90c chore(main): release 11.8.0 (#315)
• 985aa22 feat: add s3Prefix for stac-browser (#314)
• ca0925c chore(main): release 11.7.1 (#312)
• 2437790 fix: ingest type=Catalog along with collections in stac-loader (#310)
• 48d214c chore(deps): bump the all-dependencies group across 2 directories with 4 upda...
• 5295d9d chore(main): release 11.7.0 (#304)
• 29cf622 chore(deps): remediate npm security advisories (#305)
• f9cccc0 feat: upgrade core runtime dependencies (stac-fastapi-pgstac 6.4, titiler-pgs...
• 0ed9556 chore(deps-dev): bump the all-dependencies group with 3 updates (#303)
• c5d1b0c chore(deps): bump JamesIves/github-pages-deploy-action (#293)
• Additional commits viewable in compare view

Updates pydantic-settings[yaml] from 2.15.0 to 2.16.0

Release notes

Sourced from pydantic-settings[yaml]'s releases.

v2.16.0

Highlights

Breaking changes and behavior changes

• Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
• python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
• Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
• validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
• CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
• JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
• Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

• Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
• Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
• AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
• env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
• CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

• CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
• Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
• Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
• cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
• CliSubCommand aliases keep their case with case_sensitive=False (#989).
• Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
• CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

• Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
• Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
• A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
• collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
• A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
• Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

• With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
• secrets_case_sensitive=True is now honored on Windows (#1001).
• An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
• TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

• Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
• Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
• NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits

• 8c259f4 Prepare release 2.16.0 (#1043)
• 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
• f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
• cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
• 081d39f Fix config file and CLI values being ignored when alias differs from validati...
• c46ebc4 Expand home paths when checking TOML table headers (#1034)
• 6ea85e6 Decode optional Annotated named union aliases (#1041)
• ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
• b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
• bedb60e Honor explicit empty TOML table header overrides (#1027)
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates pypgstac from 0.9.11 to 0.10.0

Release notes

Sourced from pypgstac's releases.

v0.10.0

Commits

• bc774b1: Move images to trixie, update CI actions and ruff (David W Bitner) #491
• 854fd97: Emit progress and trace messages at DEBUG instead of NOTICE (David W Bitner) #491
• b538cfb: Fix run_queued_queries error carry-over and live DROPs in 000_idempotent_pre (David W Bitner) #491
• 5e2429f: Retry queued statements instead of discarding them (David W Bitner) #491
• d2b8015: Queue partition maintenance during migration and drain it from pypgstac (David W Bitner) #491
• 68fb813: Read partition bounds under a pinned DateStyle and honour existing partition alignment (David W Bitner) #491
• 6664645: Version base items and fix collection delete for pgstac_ingest (David W Bitner) #491
• 9edd222: Manage queryables through functions and match indexes by definition (David W Bitner) #491
• affe101: Resolve CQL2 properties through queryable() and honour both temporal operands (David W Bitner) #491
• c727d00: Fix paging, default sort, limit validation, free text terms and collection_search prev link (David W Bitner) #491
• 1d9db70: Tag loaded items with their base item and load queryables through upsert_queryable (David W Bitner) #491
• 43cde41: Make makemigration wait for the database and keep generated .sql.out files (David W Bitner) #491
• 9e5c1e7: Finish 0.10.0 release notes (David W Bitner) #491
• e04c419: Stage the 0.10.0 release (David W Bitner) #491
• bc68ee4: update versions to get ci to pass when using python 3.13 (David W Bitner) #491
• 7a6f5bb: fix json schema pointer for geojson in queryables (David W Bitner) #491
• 3ea8fcd: add tests to verify that stac_items behaves as expected with the base_items table (David W Bitner) #491

v0.9.12

Commits

• 3c462c4: fixes for concurrency issues (#473) (David Bitner) #473

Changelog

Sourced from pypgstac's changelog.

[v0.10.0]

Upgrading

• 0.10.0 is a breaking release. Upgrade pypgstac and the database together: pypgstac 0.10.x refuses to load into a 0.9.x database, and vice versa.
• Deploy API instances that hydrate client-side (stac-fastapi-pgstac) onto a release that understands the pgstac:base_item tag before editing item_assets or stac_version on a collection that already has items.
• queryables rows are rewritten into one stored spelling: names lose the properties. prefix, an empty collection_ids becomes global, rows that now conflict are reduced to the oldest, and property_path is converted from a path expression to the keys it named. A queryable whose property_wrapper is not registered, or whose index PostgreSQL cannot build, halts the migration until it is fixed.
• Queryables scoped to collections that no longer exist are pruned, and one scoped only to such collections is removed. 0.9.12's collection delete did not touch queryables, so these are the ordinary state of a long-lived catalog.
• Where two rows now conflict the older survives, completed from the one being removed rather than replacing it: a bare stub is usually older than a hand-configured row.
• Indexes whose definition changed — dotted names, names read from the item root, and definitions with no explicit wrapper — are rebuilt correctly, and the old index is left as an orphan until maintain_partitions(dropindexes => true). Every other index is left alone. See Indexing.
• Paging tokens change format and a token issued by an earlier release is no longer accepted. Both halves are now hex-encoded, so a collection or item id containing a colon can no longer make a token ambiguous. A client holding a token across the upgrade has to start its paging again; tokens are cursors, not durable identifiers.
• Searches return different results where the fixes below change them.

Fixed

• Filters and sorts on start_datetime work again; cql2_query() resolves every property through queryable(), which also fixes properties.-prefixed spellings and geometry outside spatial operators. (#452)
• Temporal operators honour both operands. Every t_* operator hardcoded the item's datetime span as the left operand and ignored a literal in the first position, so a filter on any other property silently filtered on the item datetime, and t_overlaps failed outright. Intervals on either side, property-to-property comparisons and date-only operands all work; a non-temporal property now raises rather than producing a nonsense predicate. (#281)
• Queryables whose name contains a dot, or that name assets, links, bbox, stac_version or stac_extensions, are indexed on the path the filter actually reads. Such an index previously matched nothing and was duplicated on every maintain_partitions() run. A queryable with no explicit wrapper is indexed through the wrapper its filter uses, not to_text. (#483, #465)
• Paging no longer truncates a result set when the same item id exists in more than one collection, and a token whose collection id prefixes another, or whose item id contains a colon, can be read back. search() emits no paging link for an empty page, and a

... (truncated)

Commits

• 51b64ff update for ci release issue
• 3ea8fcd add tests to verify that stac_items behaves as expected with the base_items t...
• 7a6f5bb fix json schema pointer for geojson in queryables
• bc68ee4 update versions to get ci to pass when using python 3.13
• e04c419 Stage the 0.10.0 release
• 9e5c1e7 Finish 0.10.0 release notes
• 43cde41 Make makemigration wait for the database and keep generated .sql.out files
• 1d9db70 Tag loaded items with their base item and load queryables through upsert_quer...
• c727d00 Fix paging, default sort, limit validation, free text terms and collection_se...