IMPALA-15026: Update Python infra dependencies for CVEs

Updates infra/python/deps to address CVEs highlighted by dependabot.

Omits updating pytest because going to version 9 requires more work.

Testing: tested adls and gcovr requirements with

    env TARGET_FILESYSTEM=adls azure_client_id=a azure_tenant_id=b
    azure_client_secret=c azure_data_lake_store_name=d
    ./buildall.sh -notests -codecoverage

Change-Id: I7d2811cec99dd21d201faaae413b37e44f5f051e
Reviewed-on: http://gerrit.cloudera.org:8080/24333
Reviewed-by: Jason Fehr <jfehr@cloudera.com>
Tested-by: Impala Public Jenkins <impala-public-jenkins@cloudera.com>

Author: MikaelSmith

infra/python/README

@@ -1,7 +1,6 @@
 To install new packages:
 
-1) Add your package to deps/requirements.txt, or deps/compiled-requirements.txt if the
-   the package needs a C/C++ compiler to build . You should specify the version number
+1) Add your package to deps/requirements.txt. You should specify the version number
    using the "foo == x.y.z" notation so future upgrades can be done automatically.
 2) Run deps/download_requirements, it will download the package to the deps dir.
 3) Run the "impala-python3" command, this should detect that requirements.txt changed and

infra/python/deps/adls-requirements.txt

@@ -19,8 +19,20 @@
 # is bootstrapped and all requirements in requirements.txt and compiled-requirements.txt
 # are installed into the virtualenv.
 
-pycparser == 2.17
-cffi==1.10.0
-cryptography==1.8.1
-  scandir == 1.5
-azure-datalake-store == 0.0.9
+pycparser == 2.23
+cffi==2.0.0
+cryptography==46.0.7
+  maturin==1.13.3
+    setuptools-rust==1.12.1
+      semantic_version==2.10.0
+    puccinialin==0.1.12
+      filelock==3.29.0
+      httpx==0.28.1
+        anyio==4.13.0
+          typing_extensions==4.15.0
+        hatch-fancy-pypi-readme==25.1.0
+        httpcore==1.0.9
+          h11==0.16.0
+      platformdirs==4.9.6
+      tqdm==4.67.3
+azure-datalake-store == 1.0.1

infra/python/deps/extended-test-requirements.txt

@@ -21,8 +21,8 @@
 Fabric==1.14.0
 # The leopard framework, which runs a webui to view random query generator
 # reports, requires Flask.
-Flask==1.0.2
+Flask==3.1.3
 # Fabric depends on Paramiko. Additionally, the stress test uses
 # Paramiko directly to keep a persistent SSH connection open to each
 # Impalad host to run in-test monitoring.
-paramiko==2.4.2
+paramiko==5.0.0

infra/python/deps/gcovr-requirements.txt

@@ -18,12 +18,12 @@
 # Requirements for gcovr, which are only needed for coverage runs
 
 gcovr == 7.2
-  Jinja2 == 3.1.4
+  Jinja2 == 3.1.6
     flit-core == 3.9.0
-  lxml == 5.2.2
-    Cython == 3.0.10
+  lxml == 6.1.0
+    Cython == 3.2.4
   colorlog == 6.8.2
-  Pygments == 2.13.0
+  Pygments == 2.20.0
     MarkupSafe == 2.1.5
   tomli == 2.0.1
     packaging == 24.1

infra/python/deps/requirements.txt

@@ -55,7 +55,7 @@ pytest == 6.2.5
   pytest-timeout == 2.2.0
   pytest-xdist == 3.5.0
     execnet == 2.1.2
-      hatchling == 1.28.0
+      hatchling == 1.29.0
       pathspec == 1.0.4
       trove-classifiers == 2026.1.14.14
         calver == 2025.10.20
@@ -64,18 +64,19 @@ pytest == 6.2.5
 python-magic == 0.4.27
 pywebhdfs == 0.3.2
   pbr == 7.0.3
-requests == 2.32.5
-  charset_normalizer == 3.4.4
-  idna == 3.11
-  urllib3 == 2.6.3
-  certifi == 2026.1.4
+requests == 2.34.2
+  charset_normalizer == 3.4.7
+  idna == 3.15
+  urllib3 == 2.7.0
+  certifi == 2026.5.20
 sasl == 0.4a1
 six == 1.17.0
+# Can't upgrade until https://github.com/andialbrecht/sqlparse/issues/814 is fixed.
 sqlparse == 0.3.1
 avro==1.12.1
 thrift==0.16.0
 distro==1.9.0
 
 # Required for Kudu:
   Cython == 0.29.37
-  pytz == 2025.2
+  pytz == 2026.2

infra/python/deps/setuptools-requirements.txt

@@ -15,9 +15,9 @@
 # specific language governing permissions and limitations
 # under the License.
 
-# Newer versions of setuptools don't support Python 2.7
+# Newer versions of setuptools don't provide pkg_resources for Kudu/Impyla.
 setuptools == 80.10.2
-  wheel == 0.46.3
+  wheel == 0.47.0
     flit-core == 3.12.0
-  packaging == 26.0
+  packaging == 26.2
 setuptools-scm == 9.2.2