chore(deps)(deps): bump the python-versions group across 1 directory with 16 updates

[dependabot]

Bumps the python-versions group with 16 updates in the / directory:

Package	From	To
ipykernel	7.3.0	7.4.0
jupytext	1.19.5	1.19.6
nbconvert	7.17.1	7.17.2
kaleido	1.4.0	1.5.0
pydata-sphinx-theme	0.21.0	0.23.0
sphinx-autodoc-typehints	3.13.7	3.13.10
dagster	1.13.24	1.13.26
dagster-webserver	1.13.24	1.13.26
numpy	2.5.3	2.5.4
pydantic	2.13.5	2.14.0
onnxruntime	1.30.0	1.31.0
nvidia-cudnn-cu12	9.26.0.51	9.27.0.42
onnxruntime-gpu	1.30.0	1.31.0
holidays	0.105	0.106
mlflow-skinny	3.16.1	3.17.0
pvlib	0.15.2	0.16.1

Updates ipykernel from 7.3.0 to 7.4.0

Release notes

Sourced from ipykernel's releases.

v7.4.0

7.4.0

(Full Changelog)

New features added

• Enable setting and resetting a thread-local parent header #1546 (@​jasongrout, @​minrk)

Enhancements made

• Allow async cell to process Comm messages #1565 (@​davidbrochart, @​JohanMabille, @​kylebarron)
• Bump minimum Python to 3.11, update linting, drop dead branches #1553 (@​Carreau, @​minrk)
• Defer the psutil import until it is actually needed #1551 (@​Carreau, @​minrk)
• validate variable names in copyToGlobals debug handler #1537 (@​sahvx655-wq, @​JohanMabille)
• create debugger tmp directory with 0o700 permissions #1530 (@​sahvx655-wq, @​JohanMabille, @​minrk)
• Update the supported_encryption to use a list as per JEP latest state #1528 (@​krassowski, @​Carreau, @​JohanMabille)
• Make psutil optional at runtime #1527 (@​yves-surrel, @​ianthomas23)

Bugs fixed

• Create _control_lock before its users #1568 (@​tovrstra, @​minrk)
• Reply with busy -> error -> idle if subshell unknown #1558 (@​krassowski, @​Carreau, @​JohanMabille)
• Send the shell reply through the ZMQStream instead of raw on its socket #1529 (@​BoykoNeov, @​ZupoLlask, @​claude, @​ianthomas23, @​practicusai, @​thomasjm)
• Enable ProactorEventLoop on windows for ipykernel #1469 (@​NewUserHa, @​BoykoNeov, @​Gravifer, @​ZupoLlask, @​claude, @​ianthomas23)

Maintenance and upkeep improvements

• try to fix publish workflow #1571 (@​minrk)
• chore: update pre-commit hooks #1570 (@​davidbrochart)
• Use dependency groups instead of extras #1563 (@​davidbrochart)
• MAINT: Switch zizmor to the github action #1561 (@​Carreau, @​Yann-P)
• Fix downstream test: install ipykernel from source for jupyter_kernel_test #1560 (@​glaziermag, @​Carreau, @​claude)
• Add Zizmor #1556 (@​Carreau, @​Yann-P)
• [CI] remove type:ignore, likely due to new pyzmq #1552 (@​Carreau, @​minrk)
• Fix typing issue due to new releases #1544 (@​Carreau, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​BoykoNeov (activity) | @​Carreau (activity) | @​davidbrochart (activity) | @​glaziermag (activity) | @​Gravifer (activity) | @​ianthomas23 (activity) | @​jasongrout (activity) | @​JohanMabille (activity) | @​krassowski (activity) | @​kylebarron (activity) | @​minrk (activity) | @​NewUserHa (activity) | @​practicusai (activity) | @​sahvx655-wq (activity) | @​Scott5S (activity) | @​thomasjm (activity) | @​tovrstra (activity) | @​Yann-P (activity) | @​yves-surrel (activity) | @​ZupoLlask (activity)

Changelog

Sourced from ipykernel's changelog.

7.4.0

(Full Changelog)

New features added

• Enable setting and resetting a thread-local parent header #1546 (@​jasongrout, @​minrk)

Enhancements made

• Allow async cell to process Comm messages #1565 (@​davidbrochart, @​JohanMabille, @​kylebarron)
• Bump minimum Python to 3.11, update linting, drop dead branches #1553 (@​Carreau, @​minrk)
• Defer the psutil import until it is actually needed #1551 (@​Carreau, @​minrk)
• validate variable names in copyToGlobals debug handler #1537 (@​sahvx655-wq, @​JohanMabille)
• create debugger tmp directory with 0o700 permissions #1530 (@​sahvx655-wq, @​JohanMabille, @​minrk)
• Update the supported_encryption to use a list as per JEP latest state #1528 (@​krassowski, @​Carreau, @​JohanMabille)
• Make psutil optional at runtime #1527 (@​yves-surrel, @​ianthomas23)

Bugs fixed

• Create _control_lock before its users #1568 (@​tovrstra, @​minrk)
• Reply with busy -> error -> idle if subshell unknown #1558 (@​krassowski, @​Carreau, @​JohanMabille)
• Send the shell reply through the ZMQStream instead of raw on its socket #1529 (@​BoykoNeov, @​ZupoLlask, @​claude, @​ianthomas23, @​practicusai, @​thomasjm)
• Enable ProactorEventLoop on windows for ipykernel #1469 (@​NewUserHa, @​BoykoNeov, @​Gravifer, @​ZupoLlask, @​claude, @​ianthomas23)

Maintenance and upkeep improvements

• try to fix publish workflow #1571 (@​minrk)
• chore: update pre-commit hooks #1570 (@​davidbrochart)
• Use dependency groups instead of extras #1563 (@​davidbrochart)
• MAINT: Switch zizmor to the github action #1561 (@​Carreau, @​Yann-P)
• Fix downstream test: install ipykernel from source for jupyter_kernel_test #1560 (@​glaziermag, @​Carreau, @​claude)
• Add Zizmor #1556 (@​Carreau, @​Yann-P)
• [CI] remove type:ignore, likely due to new pyzmq #1552 (@​Carreau, @​minrk)
• Fix typing issue due to new releases #1544 (@​Carreau, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​BoykoNeov (activity) | @​Carreau (activity) | @​davidbrochart (activity) | @​glaziermag (activity) | @​Gravifer (activity) | @​ianthomas23 (activity) | @​jasongrout (activity) | @​JohanMabille (activity) | @​krassowski (activity) | @​kylebarron (activity) | @​minrk (activity) | @​NewUserHa (activity) | @​practicusai (activity) | @​sahvx655-wq (activity) | @​Scott5S (activity) | @​thomasjm (activity) | @​tovrstra (activity) | @​Yann-P (activity) | @​yves-surrel (activity) | @​ZupoLlask (activity)

Commits

• cfa461d Publish 7.4.0
• e0658fd try to fix publish workflow (#1571)
• 5bf2c68 needs permission-contents for zizmor
• a375e4a try to fix publish workflow
• 3938cb6 chore: update pre-commit hooks (#1570)
• 5ef129a chore: update pre-commit hooks (#1566)
• fbc96be Create _control_lock before its users (#1568)
• 0273cec Allow async cell to process Comm messages (#1565)
• f8f7eb7 Create _control_lock before its users
• 3d11719 chore: update pre-commit hooks
• Additional commits viewable in compare view

Updates jupytext from 1.19.5 to 1.19.6

Release notes

Sourced from jupytext's releases.

Version 1.19.6

Security

• The Quarto conversions now run in a private temporary directory, so that the output file that quarto convert names after its input can no longer be pre-created as a symlink by another user of the machine. Thanks to Naveed for the PR (#1615).
• Paired paths from notebook formats metadata are now prevented from escaping the working tree, including when an absolute notebook path is used. Thanks to Naveed for addressing the issue (#1588).
• The CLI now ignores trusted cell metadata when the notebook signature is invalid, so a trusted=true option in a paired text file cannot make untrusted notebook outputs trusted during --sync. Thanks to Naveed for the fix (#1617).
• Custom cell_markers and endofcell values in the light format are now matched literally, preventing regular-expression injection, parsing errors, and excessive processing time on crafted notebooks. This also fixes writing OCaml notebooks with custom cell markers. Thanks to Naveed again for the PR (#1618).
• We have merged Dependabot security updates for the JupyterLab extension and the documentation website (#1614, #1620, #1622, #1624, #1634, #1639, #1642, #1643, #1647, #1653, #1654).

Fixed

• Menu entries such as "Rename Notebook…" name the file type again, instead of saying "default". Thanks to Michał Krassowski for this PR (#1632).
• Mermaid %% comments inside a markdown cell are no longer mistaken for py:percent cell markers (#1533). Thanks to Sanjay Santhanam for his PR (#1609)
• A whitespace-only final line in a percent-format cell is now preserved when reading and round-tripping the notebook (#1599). Thanks to lowbyteguy for the PR (#1610).
• The JupyterLab extension's development install script now uses the correct jupyter-builder import (#1632). Thanks again to Michał Krassowski for this fix.
• Fixed JupyterLab extension build issues related to Yarn package checksums. Thanks to Mahendra Paipuri for his contributions to #1614, #1620, and #1621.
• Fixed pairing on Windows when a prefix root contains subdirectories, such as notebooks/tutorials///ipynb.

Changed

• Updated the JupyterLab extension's production dependencies (#1621, #1641, #1652).
• Updated the documentation website's Astro, Starlight, and Sharp dependencies (#1612, #1621, #1625, #1641, #1646, #1650, #1652).
• Updated the GitHub Actions used for CI and publishing (#1613, #1619, #1633, #1640, #1649, #1651).
• Updated Jupyter Server in the Pixi environments. Thanks again to Mahendra Paipuri for this update (#1646).

Added

• We have added a development container that can be opened with VS Code’s Dev Containers extension (#1655).
• Added support for the Jenner language. Thanks to Lawrence Sinclair for this contribution (#1493).

Changelog

Sourced from jupytext's changelog.

1.19.6 (2026-10-04)

Security

• The Quarto conversions now run in a private temporary directory, so that the output file that quarto convert names after its input can no longer be pre-created as a symlink by another user of the machine. Thanks to Naveed for the PR (#1615).
• Paired paths from notebook formats metadata are now prevented from escaping the working tree, including when an absolute notebook path is used. Thanks to Naveed for addressing the issue (#1588).
• The CLI now ignores trusted cell metadata when the notebook signature is invalid, so a trusted=true option in a paired text file cannot make untrusted notebook outputs trusted during --sync. Thanks to Naveed for the fix (#1617).
• Custom cell_markers and endofcell values in the light format are now matched literally, preventing regular-expression injection, parsing errors, and excessive processing time on crafted notebooks. This also fixes writing OCaml notebooks with custom cell markers. Thanks to Naveed again for the PR (#1618).
• We have merged Dependabot security updates for the JupyterLab extension and the documentation website (#1614, #1620, #1622, #1624, #1634, #1639, #1642, #1643, #1647, #1653, #1654).

Fixed

• Menu entries such as "Rename Notebook…" name the file type again, instead of saying "default". Thanks to Michał Krassowski for this PR (#1632).
• Mermaid %% comments inside a markdown cell are no longer mistaken for py:percent cell markers (#1533). Thanks to Sanjay Santhanam for his PR (#1609)
• A whitespace-only final line in a percent-format cell is now preserved when reading and round-tripping the notebook (#1599). Thanks to lowbyteguy for the PR (#1610).
• The JupyterLab extension's development install script now uses the correct jupyter-builder import (#1632). Thanks again to Michał Krassowski for this fix.
• Fixed JupyterLab extension build issues related to Yarn package checksums. Thanks to Mahendra Paipuri for his contributions to #1614, #1620, and #1621.
• Fixed pairing on Windows when a prefix root contains subdirectories, such as notebooks/tutorials///ipynb.

Changed

• Updated the JupyterLab extension's production dependencies (#1621, #1641, #1652).
• Updated the documentation website's Astro, Starlight, and Sharp dependencies (#1612, #1621, #1625, #1641, #1646, #1650, #1652).
• Updated the GitHub Actions used for CI and publishing (#1613, #1619, #1633, #1640, #1649, #1651).

... (truncated)

Commits

• 9fccc3d Version 1.19.6 (#1656)
• 85c65a9 Add Jenner language support (#1493)
• ca39ad2 Add development container (#1655)
• 0176ff2 reject paired paths that escape the notebook directory tree (#1588)
• 1eb4653 Ignore '%%' lines inside fenced blocks of py:percent markdown cells (#1609)
• b1d7b65 build(deps): bump the jupytext-extension-security-updates group across 2 dire...
• 85df69a build(deps): bump the actions-dependencies group with 3 updates (#1651)
• c3bb81d run quarto convert in a private temp directory (#1615)
• 9bbd990 build(deps): bump the jupytext-extension-security-updates group across 1 dire...
• f96ae7d build(deps): bump the jupytext-extension-dependencies group across 2 director...
• Additional commits viewable in compare view

Updates nbconvert from 7.17.1 to 7.17.2

Release notes

Sourced from nbconvert's releases.

v7.17.2

7.17.2

(Full Changelog)

Maintenance and upkeep improvements

• Fix CI: fetch the classic CSS from PyPI, update dead links #2327 (@​Yann-P, @​Carreau, @​claude)

Other merged PRs

• Use org-level security policy (jupyter/.github/SECURITY.md) #2318 (@​Yann-P, @​minrk)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​claude (activity) | @​GruffElixir (activity) | @​minrk (activity) | @​Yann-P (activity)

Changelog

Sourced from nbconvert's changelog.

7.17.2

(Full Changelog)

Maintenance and upkeep improvements

• Fix CI: fetch the classic CSS from PyPI, update dead links #2327 (@​Yann-P, @​Carreau, @​claude)

Other merged PRs

• Use org-level security policy (jupyter/.github/SECURITY.md) #2318 (@​Yann-P, @​minrk)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​claude (activity) | @​GruffElixir (activity) | @​minrk (activity) | @​Yann-P (activity)

Commits

• e681152 Publish 7.17.2
• 8685e15 Fix CI: fetch the classic CSS from PyPI, update dead links
• ce4bd99 Merge commit from fork
• 1ff189e Use org-level security policy (jupyter/.github/SECURITY.md) (#2318)
• See full diff in compare view

Updates kaleido from 1.4.0 to 1.5.0

Release notes

Sourced from kaleido's releases.

v1.5.0

Changed

• Update Choreographer to v1.4.0 and use its large figure chunking, remove the Kaleido chunking code [#478]

Removed

• Drop support for Python 3.8 [#478]
• Remove the orjson dependency [#478]

Fixed

• Add the browser path to message in ChromeNotFoundError when it was set with path= or BROWSER_PATH and points to nothing [#476], with thanks to @​Blizzeq for the contribution!
• Restore serialization of figure specs through the plotly JSON encoder [#478]

Changelog

Sourced from kaleido's changelog.

v1.5.0 -- 2026-10-06

Changed

• Update Choreographer to v1.4.0 and use its large figure chunking, remove the Kaleido chunking code [#478]

Removed

• Drop support for Python 3.8 [#478]
• Remove the orjson dependency [#478]

Fixed

• Add the browser path to message in ChromeNotFoundError when it was set with path= or BROWSER_PATH and points to nothing [#476], with thanks to @​Blizzeq for the contribution!
• Restore serialization of figure specs through the plotly JSON encoder [#478]

Commits

• a517ccc chore: Update CHANGELOG (#480)
• 22ab87b fix: Update choreographer and rely on its message chunking (#478)
• 17c3f9f Merge pull request #476 from Blizzeq/fix/report-missing-browser-path
• ffaf3e3 Update CHANGELOG
• 090bda6 Apply review suggestions: import ChromeNotFoundError from kaleido.errors, rew...
• d6f5bf4 Merge pull request #472 from plotly/dependabot/uv/src/py/uv-d665ee01e3
• d2fcf7e Name the browser path in ChromeNotFoundError
• 31a8ca9 Merge pull request #474 from plotly/add-release-instructions
• 75dc279 update formatting
• 2eca63b updates in response to PR comments
• Additional commits viewable in compare view

Updates pydata-sphinx-theme from 0.21.0 to 0.23.0

Release notes

Sourced from pydata-sphinx-theme's releases.

v0.23.0

What's Changed

Improvements

• Loosen what keys can be cached in the sidebar by @​Yann-P in pydata/pydata-sphinx-theme#2500
• Declare color-scheme support and recommend light-dark() in the docs by @​anandghegde in pydata/pydata-sphinx-theme#2492
• Post-merge review for light-dark by @​Yann-P in pydata/pydata-sphinx-theme#2506

Fixes

• Prevent unwanted renders of PST sidebar, even if disabled in configuration by @​Yann-P in pydata/pydata-sphinx-theme#2507
• Fix shortening GitHub organization projects root links by @​Junaid-PK in pydata/pydata-sphinx-theme#2498
• Fix spacing between unnamed API return types by @​haoran3160-afk in pydata/pydata-sphinx-theme#2499

Maintenance

• Run npm audit; bump node version; add dep cooldown by @​Yann-P in pydata/pydata-sphinx-theme#2508

Dependencies

• Bump py-cov-action/python-coverage-comment-action from 4.3 to 4.5 by @​dependabot[bot] in pydata/pydata-sphinx-theme#2513
• [pre-commit.ci] pre-commit autoupdate hooks by @​pre-commit-ci[bot] in pydata/pydata-sphinx-theme#2518
• Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 by @​dependabot[bot] in pydata/pydata-sphinx-theme#2489

New Contributors

• @​anandghegde made their first contribution in pydata/pydata-sphinx-theme#2492
• @​haoran3160-afk made their first contribution in pydata/pydata-sphinx-theme#2499

Full Changelog: pydata/pydata-sphinx-theme@v0.22.0...v0.23.0

v0.23.0rc0

What's Changed

Improvements

• Loosen what keys can be cached in the sidebar by @​Yann-P in pydata/pydata-sphinx-theme#2500
• Declare color-scheme support and recommend light-dark() in the docs by @​anandghegde in pydata/pydata-sphinx-theme#2492

Fixes

• Fix shortening GitHub organization projects root links by @​Junaid-PK in pydata/pydata-sphinx-theme#2498
• Prevent unwanted renders of PST sidebar, even if disabled in configuration by @​Yann-P in pydata/pydata-sphinx-theme#2507
• Fix spacing between unnamed API return types by @​haoran3160-afk in pydata/pydata-sphinx-theme#2499

Maintenance

• Run npm audit; bump node version; add dep cooldown by @​Yann-P in pydata/pydata-sphinx-theme#2508
• Post-merge review for light-dark by @​Yann-P in pydata/pydata-sphinx-theme#2506

New Contributors

• @​anandghegde made their first contribution in pydata/pydata-sphinx-theme#2492
• @​haoran3160-afk made their first contribution in pydata/pydata-sphinx-theme#2499

... (truncated)

Commits

• 560ca12 Bump 0.23.0rc0 -> 0.23.0
• 1a2a2c3 Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 (#2489)
• 8a67845 [pre-commit.ci] pre-commit autoupdate hooks (#2518)
• ea0a529 Bump py-cov-action/python-coverage-comment-action from 4.3 to 4.5 (#2513)
• daccf13 Bump 0.22.0 -> 0.23.0rc0
• 642ca72 Loosen what keys can be cached in the sidebar (#2500)
• c223b82 Fix spacing between unnamed API return types (#2499)
• 9cfdc3e Run npm audit; bump node version; add dep cooldown (#2508)
• e0a5d5c Prevent unwanted renders of PST sidebar, even if disabled in configuration (#...
• 46a8149 Post-merge review for light-dark (#2506)
• Additional commits viewable in compare view

Updates sphinx-autodoc-typehints from 3.13.7 to 3.13.10

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.13.10

typing.Self, Never, LiteralString, Final, TypeAlias, TypeGuard, TypeIs, Required, NotRequired, ReadOnly, Unpack, Concatenate and TypeForm now link to the Python docs instead of rendering as unresolved text, as do ParamSpecArgs and ParamSpecKwargs on Python 3.12. See #786, which fixes #785.

A bare Literal no longer renders with empty brackets (#788), and annotating with the TypeVar or ParamSpec class itself no longer prints its member descriptors (#787).

Signatures of NamedTuple classes and classes that only define __new__ now drop their type hints like other classes, by @​PDGGK in #784.

Full changelog.

3.13.9

Fix the forward-reference warning when documenting NumPy's clip by resolving generic parameters declared in stub signatures. See #780, which fixes #779.

Full changelog.

3.13.8

What's Changed

• 🐛 fix(resolver): resolve guarded class imports by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#775

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.7...3.13.8

Changelog

Sourced from sphinx-autodoc-typehints's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.13.10 (2026-10-13)

---

• Link typing.Self, Never, LiteralString, Final, TypeAlias, TypeGuard, TypeIs, Required, NotRequired, ReadOnly, Description has been truncated

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud