chore(deps): update dependency geopandas to v1.1.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
geopandas	==1.1.0 → ==1.1.2

---

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

CVE-2025-69662 / GHSA-6497-prx7-gpmq

More information

Details

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-69662
• https://github.com/geopandas/geopandas/pull/3681
• https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas
• https://github.com/geopandas/geopandas/issues/3679
• https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419
• https://github.com/geopandas/geopandas/releases/tag/v1.1.2
• https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html
• https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml
• https://github.com/advisories/GHSA-6497-prx7-gpmq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

geopandas/geopandas (geopandas)

v1.1.2

Compare Source

Bug fixes:

• Fix an issue that caused an error in GeoDataFrame.from_features when there is no properties field (#​3599).
• Fix read_file and to_file errors (#​3682)
• Fix read_parquet with to_pandas_kwargs for complex (list/struct) arrow types (#​3640)
• value_counts on GeoSeries now preserves CRS in index (#​3669)
• Fix f-string placeholders appearing in error messages when pyogrio cannot be imported (#​3682).
• Fix read_parquet with to_pandas_kwargs for complex (list/struct) arrow types (#​3640).
• .to_json now provides a clearer error message when called on a GeoDataFrame without an active geometry
  column (#​3648).
• Calling del gdf["geometry"] now will downcast to a pd.DataFrame if there are no geometry columns left
  in the dataframe (#​3648).
• Fix SQL injection in to_postgis via geometry column name (#​3681).

v1.1.1

Compare Source

Bug fixes:

• Fix regression in the GeoDataFrame constructor when np.nan is given as an only geometry (#​3591).
• Fix regression in overlay with how="identity" when input dataframes have column
  names that are equal (#​3596).

---

Configuration

📅 Schedule: (in timezone America/Vancouver)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.