chore(deps)(deps): bump the python-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the python-dependencies group with 6 updates in the / directory:

Package	From	To
numpy	2.4.4	2.4.6
cvxpy	1.8.2	1.9.1
pandas	3.0.2	3.0.3
matplotlib	3.10.9	3.11.0
marimo	0.23.3	0.23.9
plotly	6.7.0	6.8.0

Updates numpy from 2.4.4 to 2.4.6

Release notes

Sourced from numpy's releases.

v2.4.6 (May 18, 2026)

NumPy 2.4.6 Release Notes

NumPy 2.4.6 is a quick release that fixes a regression discovered in the 2.4.5 release.

This release supports Python versions 3.11-3.14

Contributors

A total of 4 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• !EarlMilktea
• Charles Harris
• Sebastian Berg
• Warren Weckesser

Pull requests merged

A total of 4 pull requests were merged for this release.

• #31444: MAINT: Prepare 2.4.x for further development
• #31453: BUG: Fix regression in arr.conj()
• #31459: BUG: np.linalg.svd(..., hermitian=True) returns non-unitary...
• #31460: BUG: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator...

v2.4.5 (May 15, 2026)

NumPy 2.4.5 Release Notes

NumPy 2.4.5 is a patch release that fixes bugs discovered after the 2.4.4 release, has some typing improvements, and maintains infrastructure.

This release supports Python versions 3.11-3.14

Contributors

A total of 17 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Aleksei Nikiforov
• Anarion Zuo +
• Ankit Ahlawat
• Breno Favaretto +
• Charles Harris
• Igor Krivenko +
• Ijtihed Kilani +
• Joren Hammudoglu
• Maarten Baert +

... (truncated)

Commits

• b832a09 Merge pull request #31462 from charris/prepare-2.4.6
• 57cc147 REL: Prepare for the NumPy 2.4.6 release
• 0c72b0b Merge pull request #31459 from charris/backport-31347
• 9778d26 BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...
• e0e3876 BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...
• d1bffeb BUG: np.linalg.svd(..., hermitian=True) returns non-unitary vh (#31347)
• 8d8d7e5 Merge pull request #31453 from seberg/issue-31452
• bddaab7 BUG: Fix regression in arr.conj()
• 37a1ecc Merge pull request #31444 from charris/begin-2.4.6
• 3c0e043 MAINT: Prepare 2.4.x for further development
• Additional commits viewable in compare view

Updates cvxpy from 1.8.2 to 1.9.1

Release notes

Sourced from cvxpy's releases.

CVXPY 1.9.1

This patch release contains bug fixes and follow-up improvements for CVXPY 1.9.

Summary

This new release totaled 8 PRs from 3 contributors.

• @​brunoficoxpress | #3334
• @​PTNobel | #3332, #3335, #3338, #3340, #3341, #3345
• @​terryweng03 | #3336

CVXPY 1.9.0

CVXPY 1.9

This release is consistent with our semantic versioning guarantee. It comes packed with many new features, bug fixes, and performance improvements.

This version of CVXPY supports Python 3.11 through 3.14. We will support CVXPY 1.9 with bugfixes while developing the 1.10 release. CVXPY 1.8 and older are no longer supported.

Disciplined Nonlinear Programming (DNLP)

This release introduces Disciplined Nonlinear Programming (DNLP), a ruleset that extends CVXPY beyond convex optimization to a broad class of nonlinear problems. DNLP canonicalizes nonsmooth functions in the same way as DCP, but allows for general smooth functions to be used otherwise.

To use DNLP, pass nlp=True to problem.solve(...). Supported NLP solvers include IPOPT, KNITRO, UNO, and COPT. See the DNLP tutorial for more details and examples.

Variable bounds

Variable bounds can now be specified with expressions involving parameters, and also support sparse bound arrays (when the variable itself is sparse). Many solvers now natively use variable bounds when they are provided.

DPP for parametric quadratic objectives

quad_form(x, P) with a parametric PSD matrix P is now DPP-compliant on solvers that natively support quadratic objectives, allowing efficient re-solves when only P's value changes.

New features

• New solver interface: PDCS
• New tutorial: Performance tips
• New page: Solver benchmarks
• a ** x now works for positive constant a (canonicalized via exp(x * log(a)))
• axis argument support for sum_largest and sum_smallest
• N-D and tuple-axis support generalized across AxisAtom canonicalizers (max, norm_inf, log_sum_exp, cummax, ...)
• Support for zero-sized expressions
• Parameter values may now be ±inf
• Sparse Cholesky now uses QDLDL

Summary

This new release totaled 124 PRs from 25 contributors.

• @​armorbreak001 | #3289

... (truncated)

Commits

• 4489dd6 Release v1.9.1
• 424daad Patch/1.9.1 (#3345)
• b9189a5 Begin development of 1.9.1
• 261539f Release v1.9.0
• eb1fea2 Add comprehensive tests for scalarize transforms (#3254)
• f6c30b9 DNLP sync (#3326)
• 8971ea4 Prep for 1.9: release docs (#3309)
• 72440a2 Improve solver_path tests (#3327)
• 386e471 Make solver_path fall back on non-optimal statuses (#3324)
• 59cbc6c Add cp.nlp submodule namespace for NLP atoms (#3222)
• Additional commits viewable in compare view

Updates pandas from 3.0.2 to 3.0.3

Release notes

Sourced from pandas's releases.

pandas 3.0.3

We are pleased to announce the release of pandas 3.0.3. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• 72f2fea RLS: 3.0.3 (#65590)
• 2897590 Backport PR #65436 on branch 3.0.x (Account for privatization of matplotlib `...
• 49894b5 Backport PR #65499 on branch 3.0.x (BUG: fix check if pyarrow is installed in...
• 1c6d1e3 [backport 3.0.x] PERF: remove special casing for zoneinfo in tz_localize_to_u...
• 2a54711 Backport PR #64379 on branch 3.0.x (PERF: improve performance with ZoneInfo t...
• 036bb7c Backport PR #65482 on branch 3.0.x (PERF: don't call unique on dtypes for che...
• bf4c182 Backport PR #65410 on branch 3.0.x (TST: also convert str index to object in ...
• dd02d75 [backport 3.0.x] BUG: keep fsspec OpenFile alive for chained URL reads (#6547...
• aef3d0f [backport 3.0.x] CI: lowercase types-pymysql/types-pyyaml to fix mamba 2.6.0 ...
• bb8e248 Backport PR #65399 on branch 3.0.x (DOC: fix source link for classes in the r...
• Additional commits viewable in compare view

Updates matplotlib from 3.10.9 to 3.11.0

Release notes

Sourced from matplotlib's releases.

REL: v3.11.0

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. See the release notes for more information.

REL: v3.11.0rc2

This is the second release candidate for the meso release 3.11.0.

This release candidate fixes some problems with downstream packages, removes some missed deprecations, and corrects some additional minor bugs.

REL: v3.11.0rc1

After an extended development stretch, we are pleased to announce the first release candidate of Matplotlib 3.11.0.

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner. Due to the update to the font rendering stack, we cannot guarantee that text will be bit-for-bit perfect with previous releases, so if you are using Matplotlib for testing, it may be necessary to introduce/raise a tolerance within your tests.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. Final release notes are still being curated, but you may browse the list of new features, API changes, and all issues/pull requests on the milestone.

As a note for downstream packagers, the font libraries have only been tested against the versions bundled with the wheels. It may be possible to expand the range of requirements, or that a requirement is too broad. Please report any issues you have building against external dependencies.

Commits

• 69c7534 REL: v3.11.0
• b7d912b DOC: Set 3.11 as preferred stable release
• 7c3d502 Update Security Policy for 3.11
• 964e73d DOC: Prepare GitHub stats for 3.11 final
• bfa2633 Bump font manager version to final release
• d0603b2 Merge pull request #31873 from meeseeksmachine/auto-backport-of-pr-31706-on-v...
• edf5ebc Backport PR #31706: Fix clabel manual index
• c0e80b7 Merge pull request #31872 from meeseeksmachine/auto-backport-of-pr-31868-on-v...
• 2a14854 Backport PR #31868: DOC: Move errorbar examples to the statistics sections
• ea43d96 Merge pull request #31871 from meeseeksmachine/auto-backport-of-pr-31870-on-v...
• Additional commits viewable in compare view

Updates marimo from 0.23.3 to 0.23.9

Release notes

Sourced from marimo's releases.

0.23.9

What's Changed

This release makes opening a notebook in a second tab non-destructive, mo.ui.table adds new args for hidden_columns/visible_columns (mutually exclusive), and tightens sharing and error-output behavior across the board.

⭐️ Highlights

Open the same notebook in a second tab

Opening a notebook in a second browser tab no longer forcibly disconnects the first. The new tab joins as a live, read-only viewer, and you can take over editing from either side with a single click — no destructive modal and no reload required (#9746).

Show and hide table columns

mo.ui.table now supports column visibility. Hide and show columns from the column header menu, Column Explorer with a click, find columns fast with smart prefix-based search, and control initial visibility from Python. A hidden-count and "Unhide all" link keep things discoverable (#9687, #9696).

Cells with no output now show in slides

Because slides allow code edits, a slide edited to no longer produce an output used to disappear from the deck entirely. Such cells now appear in the slides minimap and viewer so you can edit them back in (they're still skipped during a presentation). Minimap thumbnails are also larger and more readable (#9771).

✨ Enhancements

• Add MARIMO_RESTRICT_SHARING env var machine-wide (#9756)
• Non-destructive local takeover (read-only viewer + bidirectional takeover) (#9746)
• Add cells with no output to the minimap & viewer (#9771)
• Add GET /api/kernel/status endpoint (#9768)
• Enforce sharing config as server-side security (#9578)
• Add filter param for regex and callable filtering (#9667)
• Slides config panel open by default (#9737)
• Add pair with agent link (#9738)
• Add Opus 4.8 and script to append models to the top (#9723)
• Remove mapping for 'src' to 'auto-mix-prep' (#9725)
• Add workflow to automate running llm-sync-models script (#9724)
• Automation script to pull models.yml (#9635)
• Support Dremio ADBC data source browsing (#9694)
• Add auto_close_pairs setting (#9711)
• WASM compatibility rule checks (#9587)
• Fix dropped error hints and improve error output UI (#9673)
• Column Explorer visibility controls + smart-search (#9696)
• Sort toml entries when writing config (#9686)

... (truncated)

Commits

• c3c0ee3 release: 0.23.9 (#9790)
• fdd55c8 fix: escape user-controlled file_key in service worker injection (#9789)
• dc35cdf feat(sharing): add MARIMO_RESTRICT_SHARING env var machine-wide (#9756)
• 6dcaff7 feat: non-destructive local takeover (read-only viewer + bidirectional takeov...
• d0352e2 slides: add cells with no output to the minimap & viewer (#9771)
• d9ab41a fix completions in slides view (#9769)
• c0f07c0 fix: arg/kwarg collision for local numpy vars in caching (#9751)
• 8d6e540 feat(server): add GET /api/kernel/status endpoint (#9768)
• e55e7ba fix(runtime): don't shadow builtin print unless mo.Thread is used (#9765) (#9...
• 4d47f09 fix(lsp): suppress marimo hover tooltip for all LSP providers, not just pylsp...
• Additional commits viewable in compare view

Updates plotly from 6.7.0 to 6.8.0

Release notes

Sourced from plotly's releases.

v6.8.0

Added

• Add optional font parameter for make_subplots [#5393], with thanks to @​Zomtir for the contribution!

Fixed

• Fix issue where user-specified color_continuous_scale was ignored when template had autocolorscale=True [#5439], with thanks to @​antonymilne for the contribution!
• Use presence of COLAB_NOTEBOOK_ID env var to enable Colab renderer instead of testing import of google.colab [#5473], with thanks to @​kevineger for the contribution!
• Fix incorrect annotation placement for add_vline, add_hline, add_vrect, and add_hrect on datetime axes [#5508], with thanks to @​mosh3eb for the contribution!
• Update tests to be compatible with numpy 2.4 [#5522], with thanks to @​thunze for the contribution!
• Fix issue where js/ directory was unintentionally installed as a top-level Python package when installing plotly [#5587]
• Add default headers to be passed in to Kaleido v1.3.0 to avoid blocked Open Street Map tiles [#5588]
• Propagate the requested default_height/default_width to the outer wrapper div produced by to_html so that responsive (percentage) dimensions inherit from a sized parent container instead of collapsing to the plotly.js 450px fallback [#5591], with thanks to @​SharadhNaidu for the contribution!

Updated

• The __eq__ method for graph_objects classes now returns NotImplemented to give the other operand an opportunity to handle the comparison [#5547], with thanks to @​RazerM for the contribution!
• Update plotly.js from version 3.5.0 to version 3.6.0. See the plotly.js release notes for more information [#5608]. Notable changes include:
  • Add support for arrays for the pie property legendrank, so that it can be configured per slice [#7723]
  • Add hoversort layout attribute to sort unified hover label items by value [#7734]

Changelog

Sourced from plotly's changelog.

[6.8.0] - 2026-06-03

Added

• Add optional font parameter for make_subplots [#5393], with thanks to @​Zomtir for the contribution!

Fixed

• Fix issue where user-specified color_continuous_scale was ignored when template had autocolorscale=True [#5439], with thanks to @​antonymilne for the contribution!
• Use presence of COLAB_NOTEBOOK_ID env var to enable Colab renderer instead of testing import of google.colab [#5473], with thanks to @​kevineger for the contribution!
• Fix incorrect annotation placement for add_vline, add_hline, add_vrect, and add_hrect on datetime axes [#5508], with thanks to @​mosh3eb for the contribution!
• Update tests to be compatible with numpy 2.4 [#5522], with thanks to @​thunze for the contribution!
• Fix issue where js/ directory was unintentionally installed as a top-level Python package when installing plotly [#5587]
• Add default headers to be passed in to Kaleido v1.3.0 to avoid blocked Open Street Map tiles [#5588]
• Propagate the requested default_height/default_width to the outer wrapper div produced by to_html so that responsive (percentage) dimensions inherit from a sized parent container instead of collapsing to the plotly.js 450px fallback [#5591], with thanks to @​SharadhNaidu for the contribution!

Updated

• The __eq__ method for graph_objects classes now returns NotImplemented to give the other operand an opportunity to handle the comparison [#5547], with thanks to @​RazerM for the contribution!
• Update plotly.js from version 3.5.0 to version 3.6.0. See the plotly.js release notes for more information [#5608]. Notable changes include:
  • Add support for arrays for the pie property legendrank, so that it can be configured per slice [#7723]
  • Add hoversort layout attribute to sort unified hover label items by value [#7734]

Commits

• ea4eca8 Address PR feedback
• e57adbd Fix broken example
• b8c2bf4 Update Jupyter Lab extension files
• 2de1059 Update docs for release
• f94e304 Version changes for v6.8.0
• 7f2eb35 Merge pull request #5608 from plotly/cam/update-plotly.js-3.6.0
• f57cf96 Update command to run npm install for updateplotlyjs
• 1f26820 Update lock file
• 8f699a3 chore: Update plotly.js to v3.6.0
• f0755e5 Merge pull request #5605 from plotly/cam/pin-python-frontmatter
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.