build(deps): bump the sandbox-python group across 1 directory with 6 updates

[dependabot]

Bumps the sandbox-python group with 6 updates in the /sandbox directory:

Package	From	To
boto3	1.43.20	1.43.67
clickhouse-connect	1.1.1	1.6.0
matplotlib	3.10.9	3.11.1
pandas	3.0.3	3.0.5
plotly	6.7.0	6.9.0
pytz	2026.2	2026.3.post1

Updates boto3 from 1.43.20 to 1.43.67

Commits

• ca719c8 Merge branch 'release-1.43.67'
• fc8af6b Bumping version to 1.43.67
• 254a8c9 Add changelog entries from botocore
• f53e30a Merge branch 'release-1.43.66'
• e08b015 Merge branch 'release-1.43.66' into develop
• 7ac6cf8 Bumping version to 1.43.66
• c69aee1 Add changelog entries from botocore
• b74eb20 Merge branch 'release-1.43.65'
• 75469d6 Merge branch 'release-1.43.65' into develop
• d25fa39 Bumping version to 1.43.65
• Additional commits viewable in compare view

Updates clickhouse-connect from 1.1.1 to 1.6.0

Release notes

Sourced from clickhouse-connect's releases.

v1.6.0

What's Changed

clickhouse-connect 1.6.0 adds an experimental in-process chDB backend, resolves several sync/async client parity bugs, and replaces the zstandard dependency with the standard library/a backport. Internally, the sync and async HTTP clients were unified onto a shared backend core, which is what enables the chDB backend and fixes the async issues below.

Features

• Added an experimental in-process chDB backend. get_client(interface='chdb') or a chdb:// DSN returns a standard client that runs queries against an embedded chDB engine instead of a ClickHouse server, supporting the full query, insert, streaming, and Arrow client surface. Use the path argument or a chdb:///on/disk/path DSN for a persistent database. Requires the chdb package, installable with pip install clickhouse-connect[chdb]. chDB allows one engine per process, has no async client, and does not support external data. (#872)

Bug Fixes

• AsyncClient initialization no longer overwrites user-supplied session settings with generated defaults which no matches the sync client. (#872)
• An AsyncClient created with both client certificates and an access token now sends the mutual TLS authentication headers and the Authorization: Bearer header together which now also matches the sync client. (#872)
• Dict-valued settings such as additional_table_filters no longer crash with DB::Exception: Cannot parse quoted string when passed through query()'s settings parameter. Closes #501.

Improvements

• Async clients now emit URL query parameters in the same order as the sync client on every request. (#872)
• Client creation no longer fails when the client_protocol_version capability probe errors on the sync client; it now falls back gracefully and logs at debug level, matching the async client.
• Replaced the zstandard dependency with the stdlib compression.zstd module (Python 3.14+) and backports.zstd (Python 3.10-3.13), giving a single consistent call surface across all supported Python versions. zstd compression remains fully supported on all standard Python installs. Closes #577.

Under the hood

• The sync and async HTTP clients were refactored onto a shared, internal pluggable-backend core (asyncclient.py shrank by roughly 1,200 lines of duplicated logic). This is an internal change with no public API surface, but it's the basis for the chDB backend and the sync/async parity fixes above. (#872)

Installation

pip install clickhouse-connect

v1.5.0

clickhouse-connect 1.5.0

This is a feature release focused on the SQLAlchemy and Alembic integration, alongside two important correctness fixes on the core driver. Alembic gains first-class support for ClickHouse-specific DDL, SQLAlchemy gains per-query settings and typed ClickHouse query chainables, and Variant columns gain a new lossless read format. On the driver side, this release fixes a data-corruption bug when decoding large varints on the compiled path and a QBit corruption bug for dimensions greater than 8.

Highlights

Features

• Alembic support for ClickHouse-specific DDL. New runtime Alembic operations cover skip indexes, projections, table settings, materialized views, and dictionaries, including plural add/drop helpers for indexes and projections. The plural helpers emit a single comma-joined ALTER TABLE so replicated deployments avoid the Code: 517 CANNOT_ASSIGN_ALTER race. Helpers render valid SQL in offline --sql mode. #839
• Per-query ClickHouse settings in SQLAlchemy. execution_options(settings={...}) now forwards per-query settings through the dialect and DB-API cursor for Core and text() statements, execute, executemany, and the bulk-insert path. Settings set at the connection or engine level compose with per-statement settings, and per-statement values take precedence, so a connection-level default applies to implicit ORM queries such as selectinload and lazy loads. #838, #846
• Chainable JOIN modifiers. A new Select.ch_join() lets ClickHouse JOIN modifiers be written in normal SQLAlchemy chaining style. It takes the strictness modifiers ALL, ANY, ASOF, SEMI, and ANTI, the GLOBAL distribution modifier, plus USING and CROSS as keyword arguments. The existing ch_join() factory is unchanged. #827
• Typed ClickHouse select. cc_sqlalchemy.select() returns a ClickHouseSelect exposing ch_join, final, sample, array_join, prewhere, and limit_by as typed methods, so static type checkers accept them without suppressions. The standard sqlalchemy.select() path is unchanged. #837
• typed read format for Variant columns. When two members of a Variant share a Python type, such as Variant(Float32, Float64), reading with the typed format wraps each value as a TypedVariant carrying both the value and its type_name, and these feed straight back into inserts. Enable per query with query_formats={'Variant': 'typed'} or globally with set_read_format('Variant', 'typed'). The default native format is unchanged. #825

Bug Fixes

• Fixed corruption of QBit columns with a dimension greater than 8 on native inserts and reads. Data written by earlier clients was stored incorrectly and should be re-inserted. See the upgrade note below. #866
• The compiled Cython response buffer now decodes LEB128 varint values of 2^31 and larger correctly. Each 7-bit group was shifted in signed 32-bit arithmetic before being widened, so any varint of 2^31 or more was truncated or corrupted. This affected string and nullable string column lengths and every other varint read on the compiled path. The pure Python reader was already correct. #828
• command() now returns an empty string for a read that produces an empty result set, instead of a truthy QuerySummary that made if result: misleading. #865
• DB API Cursor.executemany no longer falls off the bulk-insert fast path when an INSERT names backtick-quoted dotted columns such as the wire form of Nested sub-columns. unescape_identifier now removes backtick quoting from compound identifiers correctly, which previously degraded the operation to slow per-row execution and could raise ProgrammingError with dict rows and pyformat placeholders. #820

SQLAlchemy Bug Fixes

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.6.0, 2026-07-23

Bug Fixes

• AsyncClient initialization no longer overwrites user-supplied session settings with generated defaults. A client created with settings={'date_time_input_format': 'basic'} previously had that value replaced by the generated best_effort default. User settings now always win, matching the sync client.
• An AsyncClient created with both client certificates and an access token now sends the mutual TLS authentication headers and the Authorization: Bearer header together, matching the sync client. The certificates previously suppressed the token at construction, while the token_provider option re-added its token right after initialization, so the two async token paths disagreed with each other. The server resolves the credential precedence.
• Dict-valued settings such as additional_table_filters no longer crash with DB::Exception: Cannot parse quoted string when passed through query()'s settings parameter. The value was rendered with Python's own str()/repr() of the dict, which mixes single and double quotes and is not valid ClickHouse map-literal syntax; it is now rendered as a properly single-quoted, escaped ClickHouse map literal. Closes #501.

Improvements

• Async clients now emit URL query parameters in the same order as the sync client on every request. The parameter names and values are unchanged, so this is only visible to systems that match or sign the exact request URL.
• Client creation no longer fails when the client_protocol_version capability probe errors on the sync client. The client falls back to running without the newer native protocol features and logs the probe failure at debug level, matching the async client.
• Added an experimental in-process chDB backend. get_client(interface='chdb') or a chdb:// DSN returns a standard client that runs queries against an embedded chDB engine instead of a ClickHouse server, supporting the full query, insert, streaming, and Arrow client surface. Use the path argument or a chdb:///on/disk/path DSN for a persistent database. Requires the chdb package, installable with pip install clickhouse-connect[chdb]. chDB allows one engine per process, has no async client, and does not support external data.
• Replaced the zstandard dependency with the stdlib compression.zstd module (Python 3.14+) and backports.zstd (Python 3.10-3.13), which provides the same API as the stdlib module. This gives a single consistent call surface across all supported Python versions and removes a dependency that diverges from the standard library. zstd compression remains fully supported on all standard Python installs. In the rare case of a custom CPython 3.14+ interpreter compiled without zstd support, the driver now still imports, drops zstd from the advertised compression methods, and raises a clear error only if zstd is explicitly requested. Closes #577.

1.5.0, 2026-07-15

Bug Fixes

• SQLAlchemy: the Alembic op.rename_table now emits RENAME TABLE old TO new. It previously emitted the standard ALTER TABLE old RENAME TO new, which ClickHouse rejects. Standard SQLAlchemy indexes are now filtered from ClickHouse autogenerate output, and Column(index=True), Index(...), op.create_index, and op.drop_index raise a clear Alembic error before partially applying DDL. Use the ClickHouse-specific op.add_clickhouse_index and op.drop_clickhouse_index helpers for data-skipping indexes. Part of #839.
• SQLAlchemy: fixed several Alembic ClickHouse DDL helper edge cases. Raw SQL fragments containing :name are no longer parsed as SQLAlchemy bind parameters, dictionary comments now escape backslashes correctly, explicit schemas are honored for legal dotted table names, CREATE MATERIALIZED VIEW no longer accepts a misleading clickhouse_settings suffix that ClickHouse stores inside the SELECT definition, and custom ClickHouse operation objects now render through Alembic autogenerate instead of raising ValueError. Part of #839.
• SQLAlchemy: ClickHouseSelect now keeps its typed ClickHouse chainables after column-shape methods such as add_columns(), with_only_columns(), column(), and reduce_columns(). cc_sqlalchemy.select() also works on SQLAlchemy 1.4. Closes #844.
• SQLAlchemy: wrapping a ClickHouse type in a SQLAlchemy TypeDecorator no longer raises TypeError: result_processor() takes 0 positional arguments but 2 were given when reading results. Closes #847.
• SQLAlchemy: MergeTree engine key clauses (order_by, partition_by, primary_key, sample_by, ttl) now accept arbitrary SQL expressions such as col.desc(), func.cityHash64(a, b), tuple_(...), and interval TTL expressions, in scalar and list forms. Expressions were previously either rejected with a TypeError in list form or rendered through the wrong dialect in scalar form. Plain strings, text(), and bare Column inputs render exactly as before, and expression engines round-trip through repr() for Alembic autogeneration. Closes #845.
• SQLAlchemy: has_database() now uses EXISTS DATABASE instead of querying system.databases. On ClickHouse servers from 25.10 through 26.4 system.databases omitted DataLakeCatalog and other remote databases by default, so has_database() reported False for databases that actually exist and broke schema-existence checks. EXISTS DATABASE consults the database catalog directly and is correct on every server version. Closes #849.
• SQLAlchemy: MATERIALIZED and ALIAS columns now keep their comment, codec, and ttl options in generated DDL. Column clauses are also now emitted in the order ClickHouse requires, COMMENT then CODEC then TTL, which fixes a separate pre-existing case where any column that combined a codec with a comment produced invalid SQL that the server rejected. DEFAULT, MATERIALIZED, and ALIAS remain mutually exclusive. Closes #856.
• DB API Cursor.executemany no longer silently falls off the bulk insert fast path when an INSERT names backtick-quoted dotted columns, the wire form of Nested sub-columns such as `directory`.`id`. unescape_identifier stripped only the outermost backtick pair, so the normalized column names kept their inner backticks and never matched the row dict keys. The comparison always failed, so the operation degraded to slow per-row execution, and with dict rows and pyformat placeholders it could raise ProgrammingError. unescape_identifier now removes backtick quoting from compound identifiers correctly. Closes #820.
• The compiled Cython response buffer now decodes LEB128 varint values of 2^31 and larger correctly. Each 7-bit group was shifted in signed 32-bit arithmetic before being widened to the 64-bit accumulator, so any varint of 2^31 or more was truncated or corrupted. This affected string and nullable string column lengths and every other varint read on the compiled path. The pure Python reader was already correct. Closes #828.
• command() now returns an empty string for a read that produces an empty result set, instead of a truthy QuerySummary that made if result: misleading. Closes #865.
• Native inserts and reads of QBit columns with a dimension greater than 8 no longer corrupt the vector. Data written by earlier clients was stored incorrectly and should be re-inserted. Closes #866.

Improvements

• SQLAlchemy: added runtime Alembic operations for ClickHouse-specific DDL. The new helpers cover skip indexes, projections, table settings, materialized views, and dictionaries, including plural add/drop helpers for indexes and projections. The plural index and projection helpers emit a single comma-joined ALTER TABLE, so replicated deployments avoid the Code: 517 CANNOT_ASSIGN_ALTER race that separate statements can trigger. Helpers render valid SQL in offline --sql mode, and helpers whose signature includes clickhouse_settings render that mapping as an inline SETTINGS clause. Closes #839.
• SQLAlchemy: added a chainable Select.ch_join() so ClickHouse JOIN modifiers can be written in normal SQLAlchemy chaining style instead of nesting the ch_join() helper inside select_from(). It takes the strictness modifiers ALL, ANY, ASOF, SEMI, and ANTI, the GLOBAL distribution modifier, plus USING and CROSS, all as keyword arguments, and chains so multi-join queries stay readable. The existing ch_join() factory is unchanged. Closes #827.
• SQLAlchemy: added cc_sqlalchemy.select() which returns a ClickHouseSelect. It exposes the ClickHouse chainable modifiers such as ch_join, final, sample, array_join, prewhere, and limit_by as typed methods so static type checkers accept them without suppressions. The existing sqlalchemy.select() path keeps working unchanged. Closes #837.
• SQLAlchemy: execution_options(settings={...}) now forwards per-query ClickHouse settings through the dialect and DB-API cursor instead of silently ignoring them. This works for Core and text() statements, connection-level execution options, execute, executemany, and the bulk-insert path, while continuing to use the existing client settings validation. Settings set at the connection or engine level compose with per-statement settings, with the per-statement value taking precedence for any key set at both levels, so a connection or engine level default applies to every execution including implicit ORM queries such as selectinload and lazy attribute loads without overriding explicit per-query settings. Closes #838 and #846.
• Added a typed read format for Variant columns. When two members of a Variant share a Python type, such as Variant(DateTime, DateTime64(3)) or Variant(Float32, Float64), the decoded value alone did not record which member produced it, so the originating ClickHouse type was unrecoverable. Reading with the typed format wraps each value as a TypedVariant carrying both the value and its type_name, and these values feed straight back into inserts. The default read format stays native and returns bare values as before, so existing behavior is unchanged. Enable it per query with query_formats={'Variant': 'typed'} or globally with set_read_format('Variant', 'typed'). Closes #825.

1.4.2, 2026-07-06

Bug Fixes

• Async inserts and queries with an in-memory body larger than 1 MiB no longer emit an aiohttp ResourceWarning about sending a large body directly with raw bytes. Closes #850.

1.4.1, 2026-06-30

Bug Fixes

• SQLAlchemy: importing the ClickHouse Alembic integration no longer changes Alembic autogenerate output for other database dialects. The ClickHouse renderers for CreateTableOp, AddColumnOp, and DropTableOp were registered as process-wide replacements with no dialect guard, because Alembic renderers have no per-dialect dispatch. Any non-ClickHouse autogenerate run in the same process then used the ClickHouse renderers, which dropped the nullable argument from columns whose nullability was not set explicitly and injected cc_sqlalchemy imports. The renderers now fall back to Alembic's built-in rendering for non-ClickHouse dialects. Closes #832.
• Several public AsyncClient methods now carry the return-type annotations their sync Client counterparts already had. close, close_connections, query_np, query_df, query_arrow, set_client_setting, and set_access_token were missing them, so downstream projects running mypy with --disallow-untyped-calls got no-untyped-call errors on calls like await client.close() once the package began shipping py.typed in 1.4.0. The async client surface is now fully annotated. This is a type-only change with no runtime effect. Closes #831.

1.4.0, 2026-06-29

Bug Fixes

... (truncated)

Commits

• 2417137 release prep for v1.6.0 (#893)
• 437a7d6 docs refresh (#891)
• 98371b7 Replace zstandard with backports.zstd / stdlib compression.zstd (#577) (#877)
• a29cf10 publish wheels to PyPI with trusted publishing instead of API tokens (#888)
• f57a134 Refactor: implement pluggable backend architecture (#872)
• 47dbad3 fix test failing on head (#876)
• 91c8ef9 Docs: move integration metadata from index.mdx comment to docs/_meta.yml (#875)
• 8a60e11 fix: escape dict-valued settings as ClickHouse map literals (#501) (#874)
• 44ec560 adding metadata comment for website usage (#873)
• 4c7f046 Update additional-options.mdx (#871)
• Additional commits viewable in compare view

Updates matplotlib from 3.10.9 to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Fix tight layout of multiple subplots with sharey=True
• Fix NoNorm cursor formatting for uint8 images
• Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
• Fix clipped Axis labels on 3D plots with tight layout
• Fix inverted Axis on 3D plots
• Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
• Fix missing glyphs when subsetting Type 1 fonts in PDF
• Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

REL: v3.11.0

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. See the release notes for more information.

REL: v3.11.0rc2

This is the second release candidate for the meso release 3.11.0.

This release candidate fixes some problems with downstream packages, removes some missed deprecations, and corrects some additional minor bugs.

REL: v3.11.0rc1

After an extended development stretch, we are pleased to announce the first release candidate of Matplotlib 3.11.0.

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner. Due to the update to the font rendering stack, we cannot guarantee that text will be bit-for-bit perfect with previous releases, so if you are using Matplotlib for testing, it may be necessary to introduce/raise a tolerance within your tests.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. Final release notes are still being curated, but you may browse the list of new features, API changes, and all issues/pull requests on the milestone.

As a note for downstream packagers, the font libraries have only been tested against the versions bundled with the wheels. It may be possible to expand the range of requirements, or that a requirement is too broad. Please report any issues you have building against external dependencies.

Commits

• 3c1757a REL: v3.11.1
• 792c6b5 DOC: Prepare for 3.11.1
• aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
• d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
• 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
• 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
• c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
• 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
• a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
• 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
• Additional commits viewable in compare view

Updates pandas from 3.0.3 to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• 8188eb1 RLS: 3.0.4 (#66079)
• bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
• 6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
• 70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
• 57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
• f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
• Additional commits viewable in compare view

Updates plotly from 6.7.0 to 6.9.0

Release notes

Sourced from plotly's releases.

v6.9.0

Fixed

• Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!

Updated

• Update plotly.js from version 3.6.0 to version 3.7.0. See the plotly.js release notes for more information [#5639]. Notable changes include:
  • Rename sendDataToCloud modebar button to sendChartToCloud, and update to upload chart to Plotly Cloud [#7802, #7852, #7854]. NOTE: The Plotly Cloud endpoint for receiving charts is not yet functional, so this button won't complete the upload.
  • Fix stale scattergl error bars after toggling traces with mixed error bar visibility [#7773], with thanks to @​JulienIcon for the contribution!
  • Fix geo fitbounds to choose a compact longitude range when point data straddles the antimeridian [#7837], with thanks to @​SharadhNaidu for the contribution!

Full Changelog: plotly/plotly.py@v6.8.0...v6.9.0

v6.8.0

Added

• Add optional font parameter for make_subplots [#5393], with thanks to @​Zomtir for the contribution!

Fixed

• Fix issue where user-specified color_continuous_scale was ignored when template had autocolorscale=True [#5439], with thanks to @​antonymilne for the contribution!
• Use presence of COLAB_NOTEBOOK_ID env var to enable Colab renderer instead of testing import of google.colab [#5473], with thanks to @​kevineger for the contribution!
• Fix incorrect annotation placement for add_vline, add_hline, add_vrect, and add_hrect on datetime axes [#5508], with thanks to @​mosh3eb for the contribution!
• Update tests to be compatible with numpy 2.4 [#5522], with thanks to @​thunze for the contribution!
• Fix issue where js/ directory was unintentionally installed as a top-level Python package when installing plotly [#5587]
• Add default headers to be passed in to Kaleido v1.3.0 to avoid blocked Open Street Map tiles [#5588]
• Propagate the requested default_height/default_width to the outer wrapper div produced by to_html so that responsive (percentage) dimensions inherit from a sized parent container instead of collapsing to the plotly.js 450px fallback [#5591], with thanks to @​SharadhNaidu for the contribution!

Updated

• The __eq__ method for graph_objects classes now returns NotImplemented to give the other operand an opportunity to handle the comparison [#5547], with thanks to @​RazerM for the contribution!
• Update plotly.js from version 3.5.0 to version 3.6.0. See the plotly.js release notes for more information [#5608]. Notable changes include:
  • Add support for arrays for the pie property legendrank, so that it can be configured per slice [#7723]
  • Add hoversort layout attribute to sort unified hover label items by value [#7734]

Changelog

Sourced from plotly's changelog.

[6.9.0] - 2026-07-09

Fixed

• Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!
• Read and write figure JSON files as UTF-8 in read_json/write_json so figures containing non-ASCII text are handled correctly on platforms whose default encoding is not UTF-8 (e.g. cp1252 on Windows) [#5633]

Updated

• Update plotly.js from version 3.6.0 to version 3.7.0. See the plotly.js release notes for more information [#5639]. Notable changes include:
  • Rename sendDataToCloud modebar button to sendChartToCloud, and update to upload chart to Plotly Cloud [#7802, #7852, #7854]. NOTE: The Plotly Cloud endpoint for receiving charts is not yet functional, so this button won't complete the upload.
  • Fix stale scattergl error bars after toggling traces with mixed error bar visibility [#7773], with thanks to @​JulienIcon for the contribution!
  • Fix geo fitbounds to choose a compact longitude range when point data straddles the antimeridian [#7837], with thanks to @​SharadhNaidu for the contribution!

[6.8.0] - 2026-06-03

Added

• Add optional font parameter for make_subplots [#5393], with thanks to @​Zomtir for the contribution!

Fixed

• Fix issue where user-specified color_continuous_scale was ignored when template had autocolorscale=True [#5439], with thanks to @​antonymilne for the contribution!
• Use presence of COLAB_NOTEBOOK_ID env var to enable Colab renderer instead of testing import of google.colab [#5473], with thanks to @​kevineger for the contribution!
• Fix incorrect annotation placement for add_vline, add_hline, add_vrect, and add_hrect on datetime axes [#5508], with thanks to @​mosh3eb for the contribution!
• Update tests to be compatible with numpy 2.4 [#5522], with thanks to @​thunze for the contribution!
• Fix issue where js/ directory was unintentionally installed as a top-level Python package when installing plotly [#5587]
• Add default headers to be passed in to Kaleido v1.3.0 to avoid blocked Open Street Map tiles [#5588]
• Propagate the requested default_height/default_width to the outer wrapper div produced by to_html so that responsive (percentage) dimensions inherit from a sized parent container instead of collapsing to the plotly.js 450px fallback [#5591], with thanks to @​SharadhNaidu for the contribution!

Updated

• The __eq__ method for graph_objects classes now returns NotImplemented to give the other operand an opportunity to handle the comparison [#5547], with thanks to @​RazerM for the contribution!
• Update plotly.js from version 3.5.0 to version 3.6.0. See the plotly.js release notes for more information [#5608]. Notable changes include:
  • Add support for arrays for the pie property legendrank, so that it can be configured per slice [#7723]
  • Add hoversort layout attribute to sort unified hover label items by value [#7734]

Commits

• 495134a update date
• 2e824d8 version changes for v6.9.0
• c27c986 Merge pull request #5639 from plotly/update-plotlyjs-3.7.0
• 3d63d05 typos
• fd7e3f1 update commands.py and CONTRIBUTING.md to reflect the fact that JS build arti...
• 9a753fe update changelog
• 4ff6656 update built JS artifacts
• b3facc7 update plotly.js to v3.7.0
• 5cdb606 Merge pull request #5630 from eugen-goebel/fix-marginal-error-message-spacing
• 8d47808 Add missing space in unsupported-marginal error message
• Additional commits viewable in compare view

Updates pytz from 2026.2 to 2026.3.post1

Commits

• 661bca9 Bump version numbers to 2026.3.post1 for python2 fix
• 1e31a16 Log python version running tests, force python2
• b3ca7c3 Unix line endings
• b55039a Replace non-ASCII character in comment to fix build with Python 2
• 5420ee2 Replace non-ASCII character in comment
• 2c139e8 Merge branch 'fix/localize-overflow-at-datetime-extremes' of https://github.c...
• c843864 Run zdump tests quietly
• 518500c Reduce noise when collecting zdump info dumps
• 081f935 Merge branch 'kytta-fix-dst' into 2026c
• 8c9d69b Merge branch 'master' into 2026c
• Additional commits viewable in compare view

[redpandabot]

Summary

Routine dependabot group bump for the sandbox Python image (boto3, clickhouse-connect, matplotlib, pandas, plotly, pytz), with requirements.in lower bounds updated in lockstep. OSV reports no vulnerabilities in any of the six new versions; clickhouse-connect 1.6.0's zstandard→backports-zstd swap is consistent (no repo code uses zstd directly and cp311 linux wheels exist for backports-zstd); all new versions accept the image's Python 3.11. CI (docker.yml, triggered on sandbox/**) builds and smoke-tests the image, so build correctness is covered. The only anomaly is cosmetic: duplicated hash lines in the matplotlib and pandas lock entries.

Issues

• 🟢 sandbox/requirements.txt:1109 — every hash duplicated in matplotlib and pandas lock entries — For both matplotlib==3.11.1 (line 1109) and pandas==3.0.5 (line 1301) each sha256 hash appears twice consecutively (46 unique per package, both listed). Harmless to pip/uv --require-hashes (the hash list is treated as a set), but it's a dependabot group-merge artifact — a clean uv pip compile emits each hash once. The marker/provenance churn elsewhere (cytoolz/toolz markers dropped, tzdata removed, # via -r requirements.in) has no effect on the Linux CPython image build.

---

_{Reviewed @ 3b87c476
"Premature optimization is the root of all evil." — Donald Knuth}