[dependabot]

Updates the requirements on cython to permit the latest version.

Changelog

Sourced from cython's changelog.

3.3.1 (2026-11-01)

Most of the bugs fixed in this release were regressions in 3.3.0.

Features added

• Declarations for the C99 bool type in <stdbool.h> were added. (Github issue :issue:8011)

• Fused function objects are slightly smaller in the Limited API. (Github issue :issue:7967)

• Cython warns when enabling subinterpreter support for modules that cannot currently support it for technical reasons. (Github issue :issue:8006)

• The shared module is now automatically declared as freethreading_compatible and sets subinterpretes_compatible as applicable (currently depending on memoryview usage). Both are overridable by users as usual. (Github issue :issue:8037)

Bugs fixed

• Constant folding of multiplied sequences could return incorrect results. Patch by orztrickster. (Github issue :issue:8021)

• Cython 3.3.0 incorrectly assumed that Python integer powers always return integers. Patch by Clay Dugo. (Github issue :issue:7989)

• The return value of optimised calls to dict.get(), dict.pop() and dict.setdefault() were inferred independent of their default values, leading to incorrect C code being generated. (Github issue :issue:7991)

• Some redeclarations of annotated variables were incorrectly rejected. They are now generally allowed and Cython only warns about obviously incorrect cases. (Github issue :issue:7920)

• Type inference now respects annotation_typing=False for local variable annotations. Patch by GruffElixir. (Github issue :issue:7994)

• Type inference depended on arbitrary set ordering when circular references are involved. As an effect, the Cython.Compiler.FlowControl module was translated to slightly non-deterministic C code. (Github issue :issue:8002)

• Assigning different slices of the same memoryview to different extension type attributes could generate incorrect refcounting code.

... (truncated)

Commits

• 59e1b91 Fix several CyCache cleanup issues. (GH-8090)
• f3690a3 Update changelog.
• 86d6869 Update changelog.
• 92ca11d Update changelog.
• 9b2d20b Update documentation and test for passing "--module-name" to "cython generate...
• f7fea5a Shared module: ensure build directory path is stripped from source filename a...
• 6827d3a Update changelog.
• bb7c995 Prepare release of 3.3.1.
• 68ba6a6 Avoid unused is_unsigned warning when converting large enums (#8087)
• 1be89f9 Manual dependency update for cibuildwheel (#8074)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

📋 Review Summary

This automated Dependabot PR tightens the cython build-system requirement lower bound in sdks/python/pyproject.toml from >=3.2.6,<4 to >=3.3.1,<4. Because the existing range >=3.2.6,<4 already allows Cython 3.3.1 while preserving compatibility with earlier 3.2.x build environments, tightening the minimum requirement without a specific feature or bugfix dependency is unnecessary.

🔍 General Feedback

• Consistent with how previous Dependabot cython lower-bound bump PRs (#39496, #39891) were handled, this PR can likely be closed unless a feature or fix specifically introduced in Cython 3.3.1 is required.
• Consider adding a versioning-strategy: increase-if-necessary setting (or an ignore rule for cython minor/patch version increases) under the /sdks/python pip ecosystem in .github/dependabot.yml to prevent recurring lower-bound bump PRs.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[derrickaw]

No benefit currently on restricting this more.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.