build(deps): bump the python-minor-and-patch group across 1 directory with 12 updates

[dependabot]

Bumps the python-minor-and-patch group with 12 updates in the / directory:

Package	From	To
pandas	3.0.3	3.0.5
matplotlib	3.11.0	3.11.1
plotly	6.8.0	6.9.0
yfinance	1.4.1	1.5.2
jupyterlab	4.6.0	4.6.2
numba	0.65.1	0.66.0
numexpr	2.14.1	2.14.2
cvxpy	1.9.1	1.9.2
mkdocs-material	9.7.6	9.7.7
hypothesis	6.155.6	6.161.6
ruff	0.15.18	0.16.0
pyright	1.1.410	1.1.411

Updates pandas from 3.0.3 to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• 8188eb1 RLS: 3.0.4 (#66079)
• bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
• 6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
• 70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
• 57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
• f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
• Additional commits viewable in compare view

Updates matplotlib from 3.11.0 to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Fix tight layout of multiple subplots with sharey=True
• Fix NoNorm cursor formatting for uint8 images
• Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
• Fix clipped Axis labels on 3D plots with tight layout
• Fix inverted Axis on 3D plots
• Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
• Fix missing glyphs when subsetting Type 1 fonts in PDF
• Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits

• 3c1757a REL: v3.11.1
• 792c6b5 DOC: Prepare for 3.11.1
• aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
• d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
• 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
• 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
• c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
• 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
• a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
• 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
• Additional commits viewable in compare view

Updates plotly from 6.8.0 to 6.9.0

Release notes

Sourced from plotly's releases.

v6.9.0

Fixed

• Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!

Updated

• Update plotly.js from version 3.6.0 to version 3.7.0. See the plotly.js release notes for more information [#5639]. Notable changes include:
  • Rename sendDataToCloud modebar button to sendChartToCloud, and update to upload chart to Plotly Cloud [#7802, #7852, #7854]. NOTE: The Plotly Cloud endpoint for receiving charts is not yet functional, so this button won't complete the upload.
  • Fix stale scattergl error bars after toggling traces with mixed error bar visibility [#7773], with thanks to @​JulienIcon for the contribution!
  • Fix geo fitbounds to choose a compact longitude range when point data straddles the antimeridian [#7837], with thanks to @​SharadhNaidu for the contribution!

Full Changelog: plotly/plotly.py@v6.8.0...v6.9.0

Changelog

Sourced from plotly's changelog.

[6.9.0] - 2026-07-09

Fixed

• Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!
• Read and write figure JSON files as UTF-8 in read_json/write_json so figures containing non-ASCII text are handled correctly on platforms whose default encoding is not UTF-8 (e.g. cp1252 on Windows) [#5633]

Updated

• Update plotly.js from version 3.6.0 to version 3.7.0. See the plotly.js release notes for more information [#5639]. Notable changes include:
  • Rename sendDataToCloud modebar button to sendChartToCloud, and update to upload chart to Plotly Cloud [#7802, #7852, #7854]. NOTE: The Plotly Cloud endpoint for receiving charts is not yet functional, so this button won't complete the upload.
  • Fix stale scattergl error bars after toggling traces with mixed error bar visibility [#7773], with thanks to @​JulienIcon for the contribution!
  • Fix geo fitbounds to choose a compact longitude range when point data straddles the antimeridian [#7837], with thanks to @​SharadhNaidu for the contribution!

Commits

• 495134a update date
• 2e824d8 version changes for v6.9.0
• c27c986 Merge pull request #5639 from plotly/update-plotlyjs-3.7.0
• 3d63d05 typos
• fd7e3f1 update commands.py and CONTRIBUTING.md to reflect the fact that JS build arti...
• 9a753fe update changelog
• 4ff6656 update built JS artifacts
• b3facc7 update plotly.js to v3.7.0
• 5cdb606 Merge pull request #5630 from eugen-goebel/fix-marginal-error-message-spacing
• 8d47808 Add missing space in unsupported-marginal error message
• Additional commits viewable in compare view

Updates yfinance from 1.4.1 to 1.5.2

Release notes

Sourced from yfinance's releases.

1.5.2

Fix yfinance breaking with curl_cffi>=0.16

Thanks @​dokson

1.5.1

Version 1.5.0 retracted - I forgot to merge in dev branch

Minor changes

• Handle fundamentals fetch time-out
• Optimise valuation-measures fetch

Patches

• Login, info, price repair

Full changelog #2862

Thanks @​dokson @​avesed @​gyx09212214-prog @​HaozheZhang6 @​parthdongre @​joaopedroassad @​he-yufeng

Changelog

Sourced from yfinance's changelog.

Changelog

Unreleased

Commits

• beac22d Version 1.5.2
• e8f005e Merge pull request #2910 from dokson/fix/curl-cffi-cache-attr-detection
• e5f9079 Fix: don't treat curl_cffi>=0.16 sessions as caching (presence of .cache != a...
• 38c73ce Version 1.5.1
• 9eef6c1 Merge pull request #2862 from ranaroussi/dev
• 4fedcfd docs: changelog entry for 125b12e
• 80a768c docs: changelog entry for 15ba022
• 33cb3ab Merge branch 'main' into dev
• f10e765 docs: changelog entry for b375cd8
• b375cd8 Version 1.5.0
• Additional commits viewable in compare view

Updates jupyterlab from 4.6.0 to 4.6.2

Release notes

Sourced from jupyterlab's releases.

v4.6.2

4.6.2

(Full Changelog)

Security patches

• GHSA-gx64-gj6p-pc4c: Image viewer allows XSS when opening malicious image in new browser tab
• GHSA-89vp-jrxv-24w8: PyPI extension blocklist package-name canonicalization bypass
• GHSA-h5v5-8746-g7mm: PluginManager lock-rule enforcement bypass
• GHSA-pppj-hq3g-57pj: Cross-site scripting (XSS) via crafted settings file (overrides.json)
• GHSA-whvh-wf3x-g77j: Allowlist/blocklist check in PyPIExtensionManager.install() not enforced for direct callers (missing await)

Bugs fixed

• Backport of security patches to 4.6.x branch #19185 (@​krassowski, @​MUFFANUJ)
• Fix resolving platform-specific shortcuts in keyboard shortcuts #19112 (@​krassowski)
• Clear stale Table of Contents error markers #19143 (@​MUFFANUJ)
• Fix stale document load after rename during initialization #19144 (@​MUFFANUJ)
• Fix notebook initialization stealing focus #19149 (@​MUFFANUJ)
• Fix spurious 3s kernel restart delay #19126 (@​afshin)
• Stabilize Open in Terminal Galata test on Firefox #19152 (@​MUFFANUJ)
• Fix bottom activity bar restoring as collapsed #19136 (@​MUFFANUJ)
• Handle invalid file browser drag target #19122 (@​GagandeepSingh20)
• Stabilize flaky Firefox notebook Galata tests #19008 (@​MUFFANUJ)

Maintenance and upkeep improvements

• Update Jupyter Releaser GitHub Actions #19145 (@​jtpio)

Documentation improvements

• Fix a typo in release notes #19116 (@​krassowski)
• Update migration guide - 4.6 was released #19108 (@​krassowski)

Other merged PRs

• Bump brace-expansion from 1.1.11 to 1.1.16 in /jupyterlab/tests/mock_packages/test_no_hyphens #19179 (@​dependabot[bot])
• Bump axios from 1.16.0 to 1.18.1 #19178 (@​dependabot[bot])

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​afshin (activity) | @​GagandeepSingh20 (activity) | @​jtpio (activity) | @​krassowski (activity) | @​MUFFANUJ (activity)

... (truncated)

Commits

• 150ba51 [ci skip] Publish 4.6.2
• f1beab4 Backport of security patches to 4.6.x branch (#19185)
• abdd427 Backport PR #19112 on branch 4.6.x (Fix resolving platform-specific shortcuts...
• 98a615c Backport PR #19143 on branch 4.6.x (Clear stale Table of Contents error marke...
• 1ec91a4 Backport PR #19179 on branch 4.6.x (Bump brace-expansion from 1.1.11 to 1.1.1...
• 8d66183 Backport PR #19178 on branch 4.6.x (Bump axios from 1.16.0 to 1.18.1) (#19180)
• 34ca550 Backport PR #19144 on branch 4.6.x (Fix stale document load after rename duri...
• 172a7f6 Backport PR #19149 on branch 4.6.x (Fix notebook initialization stealing focu...
• 34e1782 Backport PR #19126 on branch 4.6.x (Fix spurious 3s kernel restart delay) (#1...
• 57e5afd Backport PR #19152 on branch 4.6.x (Stabilize Open in Terminal Galata test on...
• Additional commits viewable in compare view

Updates numba from 0.65.1 to 0.66.0

Release notes

Sourced from numba's releases.

0.66.0

Major Numba release. Numba now upgrades to llvmlite 0.48 with LLVM 22. For detailed release notes, please refer: https://numba.readthedocs.io/en/stable/release/0.66.0-notes.html

Commits

• aacf444 Merge pull request #10674 from swap357/release0.66
• 701fcd7 update release notes and version support table 0.66
• 95516b7 Merge pull request #10665 from swap357/release0.66
• cafb1c8 remove redundant numpy version requirement from setup.py install_requires
• f7395f4 Merge pull request #10655 from swap357/release0.66
• 2710950 update release date for 0.66.0rc2
• b30e3b9 Merge pull request #10654 from swap357/cherry_pick_0.66.0rc2
• f20d837 update release notes for 0.66.0rc2 changes
• cf768a6 Merge pull request #10649 from swap357/fix_mean_issue_10647
• 5a7693a Merge pull request #10567 from kc611/kc/pseudo_broadcast
• Additional commits viewable in compare view

Updates numexpr from 2.14.1 to 2.14.2

Changelog

Sourced from numexpr's changelog.

Changes from 2.14.2 to 2.14.3

• Under development.

Commits

• 3b5ddaa Getting ready for release 2.14.2
• d48823a Fix constsig leak on itemsizes allocation failure in NumExpr_init. Closes #561.
• 371d064 Merge branch 'master' of github.com:pydata/numexpr
• 2059974 Return the actual result code from run_interpreter()
• d5f712d Merge pull request #559 from uwezkhan/shift-count-guard
• 462d4d1 Merge pull request #562 from pydata/pre-commit-ci-update-config
• 3e2bdd1 [pre-commit.ci] pre-commit autoupdate
• caa29dc Guard out-of-range shift counts in integer opcodes
• ca91acf Drop support for Python 3.10
• b065396 Merge pull request #560 from gaoflow/fix-558-out-cache-weakref
• Additional commits viewable in compare view

Updates cvxpy from 1.9.1 to 1.9.2

Commits

• 7cb26d3 Release v1.9.2
• bcad203 Patch/1.9.2
• fac9f6f CI: install Moreau from PyPI instead of private Fury index
• a89e5cf Fix N-D parametric matmul in the COO and SCIPY canonicalization backends (#3401)
• c6ac6c7 Add missing numpy_numeric decorator to entr.numeric (#3379)
• 6ba794a Fix scrambled ExpCone duals for matrix-shaped arguments (#3377)
• eeddbb7 fix cone head lb (#3364)
• 20ae79d Dedup identical subtrees in Dcp2Cone canonicalization (#3355)
• eeb13c3 Updates to the wishlist (#3421)
• 951e8b8 Fix factor-2 error in Hermitian PSD constraint dual recovery (#3388)
• Additional commits viewable in compare view

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates.

The path forward is Zensical, our next-generation static site generator built from first principles. If you’re planning a new documentation project or thinking about your long-term setup, we encourage you to start exploring Zensical.

Organizations requiring support beyond this date can get in touch to discuss options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

• Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

• Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

• Limited version range of mkdocs to <2
• Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

• Hardened social cards plugin by switching to sandboxed environment
• Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

• Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

• Opened up version ranges of optional dependencies for forward-compatibility
• Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

• Updated requests to 2.30+ to mitigate CVE in urllib
• Fixed privacy plugin not picking up protocol-relative URLs
• Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

• b3e6dd8 Prepare 9.7.7 release
• 52fb6be Merge commit from fork
• 901e633 Added SECURITY.md with EOL notice
• 5b36f2a Bump js-yaml from 4.1.1 to 4.2.0 (#8598)
• 2d11e7b Bump form-data from 3.0.4 to 3.0.5 (#8597)
• ae05a53 Bump esbuild from 0.27.2 to 0.28.1 (#8596)
• 434af93 Bump shell-quote from 1.7.3 to 1.8.4 (#8593)
• 4447cda Documentation (#8590)
• 8f8d551 Updated copyright year (#8588)
• 08d8514 Bump fast-uri from 3.0.3 to 3.1.2 (#8587)
• Additional commits viewable in compare view

Updates hypothesis from 6.155.6 to 6.161.6

Commits

• d3155b0 Bump hypothesis version to 6.161.6 and update changelog
• c58346f Merge pull request #4828 from Liam-DeVoe/worktree-fix-release-windows-shell
• f0662ac use bash shell for release
• d1afb4a Merge pull request #4824 from Zac-HD/claude/constant-valued-functions-c8t4j0
• f2d611f Add tests for constant-lambda display: parameter defaults and output snapshots
• 83aaed3 Show constant-valued generated functions as constant lambdas
• 61cb14a Merge pull request #4820 from Liam-DeVoe/zizmor
• bfecc27 Merge remote-tracking branch 'upstream/master' into plait/review-hypothesis-4820
• 6c5ec2a Bump hypothesis version to 6.161.5 and update changelog
• d92f4d2 Merge pull request #4821 from Zac-HD/claude/snapshots-ci-and-test-fixes-xzo6qq
• Additional commits viewable in compare view

Updates ruff from 0.15.18 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates pyright from 1.1.410 to 1.1.411

Commits

• 392b6ba Pyright NPM Package update to 1.1.411 (#363)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.