deps(python): bump the python-minor group with 7 updates

[dependabot]

Bumps the python-minor group with 7 updates:

Package	From	To
alembic	1.17.2	1.18.0
numpy	2.4.0	2.4.1
scipy	1.16.3	1.17.0
pillow	12.0.0	12.1.0
ruff	0.14.10	0.14.11
plotly	6.5.0	6.5.1
bokeh	3.8.1	3.8.2

Updates alembic from 1.17.2 to 1.18.0

Release notes

Sourced from alembic's releases.

1.18.0

Released: January 9, 2026

feature

• [feature] [operations] When alembic is run in "verbose" mode, alembic now logs a message to indicate from which file is used to load the configuration.

  References: #1737

• [feature] [autogenerate] Autogenerate reflection sweeps now use the "bulk" inspector methods introduced in SQLAlchemy 2.0, which for selected dialects including PostgreSQL and Oracle use batched queries to reflect whole collections of tables using O(1) queries rather than O(N).

  References: #1771

• [feature] [autogenerate] Release 1.18.0 introduces a plugin system that allows for automatic loading of third-party extensions as well as configurable autogenerate compare functionality on a per-environment basis.

  The Plugin class provides a common interface for extensions that register handlers among Alembic's existing extension points such as Operations.register_operation() and Operations.implementation_for(). A new interface for registering autogenerate comparison handlers, Plugin.add_autogenerate_comparator(), provides for autogenerate compare functionality that may be custom-configured on a per-environment basis using the new EnvironmentContext.configure.autogenerate_plugins parameter.

  The change does not impact well known Alembic add-ons such as alembic-utils, which continue to work as before; however, such add-ons have the option to provide plugin entrypoints going forward.

  As part of this change, Alembic's autogenerate compare functionality is reorganized into a series of internal plugins under the alembic.autogenerate namespace, which may be individually or collectively identified for inclusion and/or exclusion within the EnvironmentContext.configure() call using a new parameter EnvironmentContext.configure.autogenerate_plugins. This parameter is also where third party comparison plugins may also be indicated.

  See alembic.plugins.toplevel for complete documentation on the new Plugin class as well as autogenerate-specific usage instructions.

... (truncated)

Commits

• See full diff in compare view

Updates numpy from 2.4.0 to 2.4.1

Release notes

Sourced from numpy's releases.

2.4.1 (Jan 10, 2026)

NumPy 2.4.1 Release Notes

The NumPy 2.4.1 is a patch release that fixes bugs discoved after the 2.4.0 release. In particular, the typo SeedlessSequence is preserved to enable wheels using the random Cython API and built against NumPy < 2.4.0 to run without errors.

This release supports Python versions 3.11-3.14

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Alexander Shadchin
• Bill Tompkins +
• Charles Harris
• Joren Hammudoglu
• Marten van Kerkwijk
• Nathan Goldbaum
• Raghuveer Devulapalli
• Ralf Gommers
• Sebastian Berg

Pull requests merged

A total of 15 pull requests were merged for this release.

• #30490: MAINT: Prepare 2.4.x for further development
• #30503: DOC: numpy.select: fix default parameter docstring...
• #30504: REV: Revert part of #30164 (#30500)
• #30506: TYP: numpy.select: allow passing array-like default...
• #30507: MNT: use if constexpr for compile-time branch selection
• #30513: BUG: Fix leak in flat assignment iterator
• #30516: BUG: fix heap overflow in fixed-width string multiply (#30511)
• #30523: BUG: Ensure summed weights returned by np.average always are...
• #30527: TYP: Fix return type of histogram2d
• #30594: MAINT: avoid passing ints to random functions that take double...
• #30595: BLD: Avoiding conflict with pygit2 for static build
• #30596: MAINT: Fix msvccompiler missing error on FreeBSD
• #30608: BLD: update vendored Meson to 1.9.2
• #30620: ENH: use more fine-grained critical sections in array coercion...
• #30623: BUG: Undo result type change of quantile/percentile but keep...

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the requirements/*_requirements.txt files to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

• Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.
• You can use the keyring app to store the PyPI password for twine. See the online twine documentation for details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Commits

• d24bb7f Merge pull request #30624 from charris/prepare-for-2.4.1
• d3bfd6d REL: Prepare for the NumPy 2.4.1 release
• abe3d86 Merge pull request #30623 from charris/backport-30601
• 5d89078 TST: Add test showing that q promotes (for "interpolating ones")
• 16890ce BUG: Fix result type change and make weak q safe
• bf7ef0b Merge pull request #30620 from charris/backport-30514
• 3d3af25 ENH: use more fine-grained critical sections in array coercion internals (#30...
• 8b7f197 Merge pull request #30608 from charris/update-vendored-meson
• 30999f6 BLD: update vendored Meson to 1.9.2
• e6bea65 Merge pull request #30596 from charris/remove-msvccompiler-check
• Additional commits viewable in compare view

Updates scipy from 1.16.3 to 1.17.0

Release notes

Sourced from scipy's releases.

SciPy 1.17.0 Release Notes

SciPy 1.17.0 is the culmination of 6 months of hard work. It contains many new features, numerous bug-fixes, improved test coverage and better documentation. There have been a number of deprecations and API changes in this release, which are documented below. All users are encouraged to upgrade to this release, as there are a large number of bug-fixes and optimizations. Before upgrading, we recommend that users check that their own code does not use deprecated SciPy functionality (to do so, run your code with python -Wd and check for DeprecationWarning s). Our development attention will now shift to bug-fix releases on the 1.17.x branch, and on adding new features on the main branch.

This release requires Python 3.11-3.14 and NumPy 1.26.4 or greater.

Highlights of this release

• Many SciPy functions have gained native support for batching of N-dimensional array input and additional support for the array API standard. An overall summary of the latter is now available in a set of tables.
• In scipy.sparse, coo_array now supports indexing. This includes integers, slices, arrays, np.newaxis, Ellipsis, in 1D, 2D and the relatively new nD. In scipy.sparse.linalg, ARPACK and PROPACK rewrites from Fortran77 to C now empower the use of external pseudorandom number generators, e.g. from numpy.
• In scipy.spatial, transform.Rotation and transform.RigidTransform have been extended to support N-D arrays. geometric_slerp now has support for extrapolation.
• scipy.stats has gained the matrix t and logistic distributions and many performance and accuracy improvements.
• Initial support for 64-bit integer (ILP64) BLAS and LAPACK libraries has been added, including for MKL and Apple Accelerate. Please report any issues with ILP64 you encounter.

New features

scipy.integrate improvements

• The integration routines dopri5, dopri853, LSODA, vode, and zvode have been ported from Fortran77 to C.
• scipy.integrate.quad now has a fast path for returning 0 when the integration interval is empty.
• The BDF, DOP853, RK23, RK45, OdeSolver, DenseOutput, ode, and complex_ode classes now support subscription, making them generic types, for compatibility with scipy-stubs.

... (truncated)

Commits

• 8c75ae7 REL: 1.17.0 "final" release commit [wheel build]
• 9d7f110 Merge pull request #24298 from tylerjereddy/treddy_prep_1.17.0_final
• 94373b6 MAINT: test wheels [wheel build]
• 723f4e2 DOC: update 1.17.0 relnotes
• bf042f0 CI: ensure we use pinned scipy-openblas version also in ILP64 job
• 3e00a04 CI: fix issue with ILP64 job; point to fixed numpy/meson commit
• 39bceab BUG: stats: fix va_args memory corruption bug
• 8f56387 DOC: update 1.17.0 release notes
• c50e9c0 Merge pull request #24304 from ev-br/edit_relnotes_for_ILP64
• b204495 DOC: clarify ILP64 support caveats in the release notes, remove mentions of O...
• Additional commits viewable in compare view

Updates pillow from 12.0.0 to 12.1.0

Release notes

Sourced from pillow's releases.

12.1.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html

Deprecations

• Deprecate getdata(), in favour of new get_flattened_data() #9292 [@​radarhere]

Documentation

• Specify APNG duration type when opening #9368 [@​radarhere]
• Added release notes for #9350 #9366 [@​radarhere]
• Update ImageMorph documentation #9349 [@​radarhere]
• Docs: update major bump cadence #9334 [@​hugovk]
• Add release notes for #9070 #9320 [@​radarhere]
• Updated Ubuntu version #9306 [@​radarhere]
• Update macOS tested Pillow versions #9265 [@​radarhere]

Dependencies

• Update harfbuzz to 12.3.0 #9355 [@​radarhere]
• Update xz to 5.8.2 #9343 [@​radarhere]
• Updated libjpeg-turbo to 3.1.3 #9333 [@​radarhere]
• Updated zlib-ng to 2.3.2 #9324 [@​radarhere]
• Updated libpng to 1.6.53 #9325 [@​radarhere]
• Update actions/checkout action to v6 #9323 [@renovate[bot]]
• Update dependency mypy to v1.19.0 #9322 [@renovate[bot]]
• Updated libpng to 1.6.51 #9305 [@​radarhere]
• Updated brotli to 1.2.0 #9284 [@​radarhere]
• Update libimagequant to 4.4.1 #9301 [@​radarhere]
• Update zlib-ng to 2.3.1, except on manylinux2014 aarch64 #9312 [@​radarhere]
• Updated harfbuzz to 12.2.0 #9289 [@​radarhere]
• Update github-actions #9277 [@renovate[bot]]

Testing

• Replace pre-commit with prek #9360 [@​hugovk]
• Test PyQt6 on Python 3.14 on Windows #9353 [@​radarhere]
• Test 32-bit Windows on Windows Server 2022 #9345 [@​radarhere]
• Correct variable type #9335 [@​radarhere]
• Fix ResourceWarnings in selftest.py #9332 [@​hugovk]
• Fix testing good P mode BMP images #9319 [@​radarhere]
• Test Python 3.15 pre-release #9331 [@​hugovk]
• Test ImageFont.ImageFont, in case freetype2 is not supported #9287 [@​radarhere]
• Add Fedora 43 #9290 [@​radarhere]
• Remove Fedora 41 #9260 [@​radarhere]

Type hints

• Add ImageFile context manager #9367 [@​radarhere]
• Assert fp is not None #8617 [@​radarhere]

... (truncated)

Commits

• 46f45f6 12.1.0 version bump
• c9ac097 Simplify band splitting (#9291)
• 3baedf2 Deprecate getdata(), in favour of new get_flattened_data() (#9292)
• b51a036 Specify APNG duration type when opening (#9368)
• 8d08e31 Add release notes for #9348 (#9369)
• 432707e Added release notes for #9348
• 2d58910 Specify APNG duration type when opening
• 8dee8dd Add ImageFile context manager (#9367)
• b2d9bc3 Support saving APNG float durations (#9365)
• f130c10 Allow 1 mode images in MorphOp (#9348)
• Additional commits viewable in compare view

Updates ruff from 0.14.10 to 0.14.11

Release notes

Sourced from ruff's releases.

0.14.11

Release Notes

Released on 2026-01-08.

Preview features

• Consolidate diagnostics for matched disable/enable suppression comments (#22099)
• Report diagnostics for invalid/unmatched range suppression comments (#21908)
• [airflow] Passing positional argument into airflow.lineage.hook.HookLineageCollector.create_asset is not allowed (AIR303) (#22046)
• [refurb] Mark FURB192 fix as always unsafe (#22210)
• [ruff] Add non-empty-init-module (RUF067) (#22143)

Bug fixes

• Fix GitHub format for multi-line diagnostics (#22108)
• [flake8-unused-arguments] Mark **kwargs in TypeVar as used (ARG001) (#22214)

Rule changes

• Add help: subdiagnostics for several Ruff rules that can sometimes appear to disagree with ty (#22331)
• [pylint] Demote PLW1510 fix to display-only (#22318)
• [pylint] Ignore identical members (PLR1714) (#22220)
• [pylint] Improve diagnostic range for PLC0206 (#22312)
• [ruff] Improve fix title for RUF102 invalid rule code (#22100)
• [flake8-simplify]: Avoid unnecessary builtins import for SIM105 (#22358)

Configuration

• Allow Python 3.15 as valid target-version value in preview (#22419)
• Check required-version before parsing rules (#22410)
• Include configured src directories when resolving graphs (#22451)

Documentation

• Update T201 suggestion to not use root logger to satisfy LOG015 (#22059)
• Fix iter example in unsafe fixes doc (#22118)
• [flake8_print] better suggestion for basicConfig in T201 docs (#22101)
• [pylint] Restore the fix safety docs for PLW0133 (#22211)
• Fix Jupyter notebook discovery info for editors (#22447)

Contributors

• @​charliermarsh
• @​ntBre
• @​cenviity
• @​njhearp
• @​cbachhuber
• @​jelle-openai
• @​AlexWaygood

... (truncated)

Changelog

Sourced from ruff's changelog.

0.14.11

Released on 2026-01-08.

Preview features

• Consolidate diagnostics for matched disable/enable suppression comments (#22099)
• Report diagnostics for invalid/unmatched range suppression comments (#21908)
• [airflow] Passing positional argument into airflow.lineage.hook.HookLineageCollector.create_asset is not allowed (AIR303) (#22046)
• [refurb] Mark FURB192 fix as always unsafe (#22210)
• [ruff] Add non-empty-init-module (RUF067) (#22143)

Bug fixes

• Fix GitHub format for multi-line diagnostics (#22108)
• [flake8-unused-arguments] Mark **kwargs in TypeVar as used (ARG001) (#22214)

Rule changes

• Add help: subdiagnostics for several Ruff rules that can sometimes appear to disagree with ty (#22331)
• [pylint] Demote PLW1510 fix to display-only (#22318)
• [pylint] Ignore identical members (PLR1714) (#22220)
• [pylint] Improve diagnostic range for PLC0206 (#22312)
• [ruff] Improve fix title for RUF102 invalid rule code (#22100)
• [flake8-simplify]: Avoid unnecessary builtins import for SIM105 (#22358)

Configuration

• Allow Python 3.15 as valid target-version value in preview (#22419)
• Check required-version before parsing rules (#22410)
• Include configured src directories when resolving graphs (#22451)

Documentation

• Update T201 suggestion to not use root logger to satisfy LOG015 (#22059)
• Fix iter example in unsafe fixes doc (#22118)
• [flake8_print] better suggestion for basicConfig in T201 docs (#22101)
• [pylint] Restore the fix safety docs for PLW0133 (#22211)
• Fix Jupyter notebook discovery info for editors (#22447)

Contributors

• @​charliermarsh
• @​ntBre
• @​cenviity
• @​njhearp
• @​cbachhuber
• @​jelle-openai
• @​AlexWaygood
• @​ValdonVitija

... (truncated)

Commits

• c920cf8 Bump 0.14.11 (#22462)
• bb757b5 [ty] Don't show diagnostics for excluded files (#22455)
• 1f49e8e Include configured src directories when resolving graphs (#22451)
• 701f513 [ty] Only consider fully static pivots when deriving transitive constraints (...
• eea9ad8 Pin maturin version (#22454)
• eeac2bd [ty] Optimize union building for unions with many enum-literal members (#22363)
• 7319c37 docs: fix jupyter notebook discovery info for editors (#22447)
• 805503c [ruff] Improve fix title for RUF102 invalid rule code (#22100)
• 68a2f6c [ty] Fix super() with TypeVar-annotated self and cls parameter (#22208)
• abaa735 [ty] Improve UnionBuilder performance by changing Type::is_subtype_of cal...
• Additional commits viewable in compare view

Updates plotly from 6.5.0 to 6.5.1

Release notes

Sourced from plotly's releases.

v6.5.1

Fixed

• Fix issue where Plotly Express ignored trace-specific color sequences defined in templates via template.data.<trace_type> [#5437], with thanks to @​antonymilne for the contribution!

Updated

• Speed up validate_gantt function [#5386], with thanks to @​misrasaurabh1 for the contribution!
• Update plotly.js from version 3.3.0 to version 3.3.1. See the plotly.js release notes for more information. [#5456]. Notable changes include:
  • Add support for arrays for the pie properties showlegend and legend, so that these can be configured per slice. [#7580]

Changelog

Sourced from plotly's changelog.

[6.5.1] - 2025-11-17

Fixed

• Fix issue where Plotly Express ignored trace-specific color sequences defined in templates via template.data.<trace_type> [#5437], with thanks to @​antonymilne for the contribution!

Updated

• Speed up validate_gantt function [#5386], with thanks to @​misrasaurabh1 for the contribution!
• Update plotly.js from version 3.3.0 to version 3.3.1. See the plotly.js release notes for more information. [#5456]. Notable changes include:
  • Add support for arrays for the pie properties showlegend and legend, so that these can be configured per slice. [#7580]

Commits

• d2aa044 Version changes for v6.5.1
• f4236c2 Merge pull request #5456 from plotly/cam/update-plotly.js-v3.3.1
• ca6e55e Update Jupyter support files
• 6f13fb0 Add missing lock file
• 6f94d9c Update plotly.js to v3.3.1 and associated files
• f265d9b Merge pull request #5448 from palmerusaf/update-contrib-docs
• 27b5bba Update editable installs ref in CONTRIBUTING doc
• fa4db1d Merge pull request #5442 from plotly/fix-docs-build-bug-2
• a5f469a update call to color_discrete_sequence with new call signature
• adfdfcd Merge pull request #5437 from antonymilne/main
• Additional commits viewable in compare view

Updates bokeh from 3.8.1 to 3.8.2

Changelog

Sourced from bokeh's changelog.

2026-01-06 3.8.2:

• bugfixes:

  • #14768 [component: server] Incomplete Origin Validation in WebSockets in Bokeh server applications

• tasks:

  • #14767 Backports for 3.8.2

Commits

• e5ce879 Deployment updates for release 3.8.2
• 2b3ee10 Don't validate npm credentials due to OICD limitations in npm (#14769)
• 756e3ae Migrate from NPM tokens to trusted providers for publishing in CI (#14766)
• 2f225a1 Update dependencies in build environment (#14758)
• 69d197c update switcher.json
• d915c8b update to latest ruff (#14661)
• 5f9f7b6 update release notes
• cedd113 handle wildcard host with port correctly
• a961ab7 small CI fixes for advisory fork merge
• d62939a Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions