Skip to content

build(deps): bump the sandbox-python group across 1 directory with 5 updates - #357

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/sandbox/sandbox-python-64c293803b
Open

build(deps): bump the sandbox-python group across 1 directory with 5 updates#357
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/sandbox/sandbox-python-64c293803b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the sandbox-python group with 5 updates in the /sandbox directory:

Package From To
boto3 1.43.72 1.43.83
clickhouse-connect 1.7.1 1.7.2
eth-abi 5.2.0 6.0.0
eth-account 0.13.7 0.14.0
plotly 6.9.0 7.0.0

Updates boto3 from 1.43.72 to 1.43.83

Commits

Updates clickhouse-connect from 1.7.1 to 1.7.2

Release notes

Sourced from clickhouse-connect's releases.

v1.7.2

clickhouse-connect v1.7.2

This patch release fixes SQLAlchemy reflection and SQL generation, query formatting, server-side parameter names, and HTTP proxy path handling.

What's Changed

Bug Fixes

  • SQLAlchemy inspectors bound to an Engine now support get_columns() and reflect_table() on SQLAlchemy 2.x. Reflection also honors include_columns and exclude_columns. Closes #967.
  • Queries ending with a semicolon, whitespace, or trailing comment now place client-appended FORMAT clauses correctly. Insert detection also follows SQL token rules. Closes #903.
  • The async client now preserves explicit proxy_path values without adding extra slashes. Closes #963.
  • The synchronous client now sends a normalized / request path through forwarding HTTP proxies when no proxy_path is configured. Closes #951.
  • Server-side query placeholders now recognize $ in valid parameter names while preserving raw binary binding and ambiguity checks. Closes #936.
  • SQLAlchemy ClickHouse types now implement the public literal processor contract for TypeDecorator and with_variant(). Closes #965.
  • SQLAlchemy literals containing percent signs now compile safely alongside bound parameters and in server-side parameter mode. Closes #966.
  • SQLAlchemy now applies ClickHouse backslash escaping to generic literal strings, defaults, aliases, TTL clauses, comments, and Alembic comment operations. Custom pre-escaping workarounds should be removed. Closes #975.
  • SQLAlchemy union(), intersect(), and except_() now emit explicit DISTINCT operations. Use the corresponding _all() methods when duplicate-preserving behavior is required. Closes #973.
  • SQLAlchemy Select.with_hint() now emits SAWarning when an applicable table hint would otherwise be ignored. Generated SQL remains unchanged. Closes #974.

Full Changelog: v1.7.1...v1.7.2

Installation

pip install clickhouse-connect
Changelog

Sourced from clickhouse-connect's changelog.

1.7.2, 2026-08-19

Bug Fixes

  • SQLAlchemy inspectors bound to an Engine can now call get_columns() and reflect_table() directly on SQLAlchemy 2.x. These methods now acquire and reuse one connection for each reflection operation, while inspectors already bound to a Connection continue to reuse it. Table reflection also honors positional include_columns and exclude_columns filters passed by SQLAlchemy instead of silently reflecting every column. Closes #967.
  • Queries ending in a semicolon now keep the client-appended FORMAT clause inside the statement, including when the semicolon is followed by whitespace or a trailing comment. This fixes query, query_arrow, and raw_query with fmt for both sync and async clients. A lone directly trailing semicolon keeps the existing fast binding path, and inserts carrying inline data are never passed through the SQL lexer. Insert detection now follows SQL token rules, so quoted text such as ' INSERT INTO ' in a SELECT no longer misroutes the query, and identifiers named insert are not mistaken for the keyword. Closes #903.
  • The async client now preserves an explicit proxy_path when constructing request URLs. It previously appended / unconditionally, changing /clickhouse to /clickhouse/ and /clickhouse/ to /clickhouse//, which could break exact-path proxy routing. Bare authority URLs still use /. Closes #963.
  • The synchronous client now normalizes an empty request path to / when no proxy_path is configured, so requests routed through a forwarding HTTP proxy (http_proxy/HTTP_PROXY) use the normal absolute-form request-target (http://host:8123/?query=...) instead of the RFC-valid but non-normalized http://host:8123?query=..., which some proxies reject with HTTP 400 and others forward with the query string silently dropped. Direct connections are unaffected because urllib3 already normalizes the empty path, and an explicit proxy_path is left exactly as-is. This matches the async client, which already sent the path. Closes #951.
  • Query placeholders now recognize $ in server-valid parameter names such as {id$x:Int32} or {$x$:String}. Previously these names were missed, which omitted their server-side values and could also drop DateTime64 precision and timezone hints. Placeholder detection is otherwise unchanged from 1.x. A $name$ dictionary key with a buffer value such as bytes, bytearray, or memoryview stays a raw binary bind. A non-buffer value for such a key can bind through a single {name:Type} placeholder, and ambiguous or repeated uses of the name raise ProgrammingError. SQLAlchemy server_side_params accepts the same names and rejects the reserved $name$ form. Closes #936.
  • SQLAlchemy ClickHouse types now implement the public literal processor contract, so TypeDecorator wrappers and with_variant() render ClickHouse literals with proper quoting and escaping. Closes #965.
  • SQLAlchemy ClickHouse type literals containing percent signs now compile safely alongside remaining bound parameters, and server-side parameter mode preserves consecutive percent signs in literals. Closes #966.
  • SQLAlchemy now applies ClickHouse backslash escaping to generic literal_binds strings, string DEFAULT, MATERIALIZED, ALIAS, and TTL clauses, CREATE comments, and Alembic table and column comment operations. Backslash values now round-trip verbatim instead of being reinterpreted or terminating a quoted literal. ClickHouse-native literal processors and percent handling are unchanged. If custom TypeDecorator.process_literal_param or UserDefinedType code pre-escaped backslashes as a workaround, remove that workaround because the dialect now applies ClickHouse escaping. Closes #975.
  • SQLAlchemy union(), intersect(), and except_() now compile to explicit UNION DISTINCT, INTERSECT DISTINCT, and EXCEPT DISTINCT, preserving SQLAlchemy's duplicate-removing semantics instead of relying on ClickHouse defaults. Their union_all(), intersect_all(), and except_all() counterparts remain explicit ALL operations. Users relying on previous duplicate-preserving behavior from union_default_mode='ALL' or ClickHouse's default intersect_default_mode='ALL' and except_default_mode='ALL' should switch to the corresponding _all() method. Closes #973.
  • SQLAlchemy Select.with_hint() now emits an SAWarning when an applicable table hint would otherwise be silently ignored. The generated SQL remains unchanged for 1.x compatibility. Applications that promote SAWarning to an error will now stop at compilation instead of executing without the requested hint. Use the typed final(), sample(), prewhere(), and limit_by() methods for those ClickHouse clauses. Raw with_statement_hint() tail directives remain supported. Closes #974.
Commits
  • 9283654 release prep for 1.7.2 (#980)
  • 836e12e fix SQLAlchemy engine-bound table reflection (#979)
  • 1b7b0af fix SQLAlchemy DISTINCT set operations (#978)
  • c76037d warn on ignored SQLAlchemy table hints (#977)
  • 6ca829b Joe/fix arrow trailing semicolon (#970)
  • f110acc update review instructions and arch metadata (#976)
  • 289f42a Fix SQLAlchemy DDL string literal escaping for comments and string defaults (...
  • 9c24d33 Joe/fix chsqlatype literal bugs (#969)
  • 2f34aa5 use centralized docs drift checker (#961)
  • 8e15d09 async explicit proxy_path preservation (#964)
  • Additional commits viewable in compare view

Updates eth-abi from 5.2.0 to 6.0.0

Release notes

Sourced from eth-abi's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: ApeWorX/eth-abi@v5.2.0...v6.0.0

Changelog

Sourced from eth-abi's changelog.

Release Notes

.. towncrier release notes start

eth-abi v6.0.0-beta.1 (2025-12-17)

Breaking Changes


- Drop support for Python 3.8 & 3.9 (`[#250](https://github.com/ApeWorX/eth-abi/issues/250) <https://github.com/ApeWorX/eth-abi/issues/250>`__)

Improved Documentation

  • Fix typo in index ([#243](https://github.com/ApeWorX/eth-abi/issues/243) <https://github.com/ApeWorX/eth-abi/issues/243>__)

Features


- Add support for Python 3.14 (`[#250](https://github.com/ApeWorX/eth-abi/issues/250) <https://github.com/ApeWorX/eth-abi/issues/250>`__)
Commits
  • c0d2d0f refactor: drop <3.10; add <=3.14; migrate to prek and ruff; use Github Action...
  • afa145a newsfragment for #246
  • a92aff7 feat: optimize encode and decode
  • cdc7e65 Bump version: 5.2.0 → 6.0.0-beta.1
  • 484a3cf Compile release notes for v6.0.0-beta.1
  • a7e0aad Merge pull request #250 from kclowes/template-upgrades
  • 303b4d7 Fix docs/contributing
  • 404786a Add newsfragments for #250
  • 0eac8dd Remove hypothesis warnings
  • d4c9a81 Fix typing
  • Additional commits viewable in compare view

Updates eth-account from 0.13.7 to 0.14.0

Release notes

Sourced from eth-account's releases.

v0.14.0

What's Changed

Full Changelog: ApeWorX/eth-account@v0.13.7...v0.14.0

Changelog

Sourced from eth-account's changelog.

Release Notes

.. towncrier release notes start

eth-account v0.14.0-beta.1 (2025-12-18)

Breaking Changes


- Drop support for Python 3.8 and 3.9 (`[#328](https://github.com/ApeWorX/eth-account/issues/328) <https://github.com/ethereum/eth-account/issues/328>`__)
- Bump eth-utils requirement to >=5.3.0 to allow for CamelModel usage (`[#329](https://github.com/ApeWorX/eth-account/issues/329) <https://github.com/ethereum/eth-account/issues/329>`__)

Features



- Add support for Python 3.14 (`[#328](https://github.com/ApeWorX/eth-account/issues/328) &lt;https://github.com/ethereum/eth-account/issues/328&gt;`__)

Internal Changes - for eth-account Contributors

</code></pre>

<ul>

<li>Fix mypy errors with BaseModel.model_json_schema introduced with Pydantic 2.12 (<code>#326 &lt;https://github.com/ethereum/eth-account/issues/326&amp;gt;&lt;/code&gt;__)&lt;/li>

</ul>

</blockquote>

</details>

<details>

<summary>Commits</summary>


<ul>

<li><a href="https://github.com/ApeWorX/eth-account/commit/7972dcd2b565315882fd1be5082cb1aa2a856689&quot;&gt;&lt;code&gt;7972dcd&lt;/code&gt;&lt;/a> refactor: drop &lt;3.10; add &lt;=3.14; migrate to prek and ruff; use Github Action...</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/20757b1138419e01da56ab4d79f09bb5b95fc079&quot;&gt;&lt;code&gt;20757b1&lt;/code&gt;&lt;/a> Breaking/add remaining breaking changes for major (<a href="https://redirect.github.com/ApeWorX/eth-account/issues/333&quot;&gt;#333&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/63a9fc5dcf0fe25cb79dbbdaeb09dea49e4ebf35&quot;&gt;&lt;code&gt;63a9fc5&lt;/code&gt;&lt;/a> parametrized sets -&gt; ordered list so we can run with xdist</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/7fe8e016da979e90030b7ef0ba9bad22ccac0195&quot;&gt;&lt;code&gt;7fe8e01&lt;/code&gt;&lt;/a> remove deprecated method, no longer needed after eth-utils bump</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/f5653f32371422248f0d21b37ce95643db1da3e5&quot;&gt;&lt;code&gt;f5653f3&lt;/code&gt;&lt;/a> Inherit from eth-utils CamelModel for pydantic types:</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/b8fc03a99d9b4f7b5601e4c5b496c518f9a32b67&quot;&gt;&lt;code&gt;b8fc03a&lt;/code&gt;&lt;/a> re-generate test vectors after go dep updates</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/e94fd3b5fb51b6e8f948e3a5e2810a90d3c011d1&quot;&gt;&lt;code&gt;e94fd3b&lt;/code&gt;&lt;/a> Bump github.com/consensys/gnark-crypto in /tests/_scripts/go-kzg-verify</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/c52a8ed5510a8b16e9ea9f7459a21e8691854d24&quot;&gt;&lt;code&gt;c52a8ed&lt;/code&gt;&lt;/a> re-generate test vectors after go dep updates</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/04bb3633e986524365a77b9905d17ab01072ee1f&quot;&gt;&lt;code&gt;04bb363&lt;/code&gt;&lt;/a> Bump golang.org/x/crypto in /tests/_scripts/go-kzg-verify</li>

<li><a href="https://github.com/ApeWorX/eth-account/commit/5eb3acb6f25de657310ff81f55b5d1e90a03f032&quot;&gt;&lt;code&gt;5eb3acb&lt;/code&gt;&lt;/a> move test scripts into</li>

<li>Additional commits viewable in <a href="https://github.com/ApeWorX/eth-account/compare/v0.13.7...v0.14.0&quot;&gt;compare view</a></li>

</ul>

</details>


<br />


Updates plotly from 6.9.0 to 7.0.0



Release notes

Sourced from plotly's releases.




v7.0.0


Fixed


    

  • Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @​genrichez for the contribution!
    • 

  • Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]
    • 

  • Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @​mishrakushal for the contribution!
    • 

  • Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @​lucasjamar for the contribution!
    • 

  • Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @​robertoffmoura for the contribution!
    • 



Removed


    

  • Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
    • 

  • Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
    • 

  • Remove support for Orca for static image generation [#5677]
    • 

  • Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]
    • 



Updated


    

  • Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:

      

    • Add quiver trace type to visualize vector fields using arrows [#7710, #7945]
      • 

    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
      • 

    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.

        

      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
        • 

      

      • 

    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
      • 

    • Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:

        

      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
        • 

      • hsv() color strings are no longer supported
        • 

      • Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported
        • 

      • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0, 0%, 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
        • 

      

      • 

    • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
      • 

    • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
      • 

    • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
      • 

    • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]
      • 

    

    • 



v7.0.0rc0


Removed


    

  • Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
    • 

  • Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
    • 

  • Remove support for Orca for static image generation [#5677]
    • 

  • Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]
    • 



Fixed


    

  • Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!
    • 



Updated


    

  • Update plotly.js from version 3.6.0 to version 4.0.0-rc.0 [#5673]. This is a major-version release candidate with many changes. See the plotly.js release notes for the full list. The most significant changes include:

      

    • Add quiver trace type to visualize vector fields using arrows [#7710], with thanks to @​degzhaus for the contribution!
      • 

    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
      • 

    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.

        

      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
        • 

      

      • 

    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
      • 

    • Switch color processing library from TinyColor to color [#7536]. There are some changes to supported color string formats as a result:

        

      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
        • 

      

      • 

    

    • 






... (truncated)





Changelog

Sourced from plotly's changelog.




[7.0.0] - 2026-08-25


Fixed


    

  • Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @​genrichez for the contribution!
    • 

  • Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]
    • 

  • Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @​mishrakushal for the contribution!
    • 

  • Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @​lucasjamar for the contribution!
    • 

  • Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @​robertoffmoura for the contribution!
    • 



Updated


    

  • Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:

      

    • Add quiver trace type to visualize vector fields using arrows [#7710, #7945]
      • 

    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
      • 

    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.

        

      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
        • 

      

      • 

    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
      • 

    • Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:

        

      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
        • 

      • hsv() color strings are no longer supported
        • 

      • Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported
        • 

      • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0 0% 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
        • 

      

      • 

    • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
      • 

    • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
      • 

    • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
      • 

    • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]
      • 

    

    • 



[7.0.0rc0] - 2026-07-29


Removed


    

  • Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
    • 

  • Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
    • 

  • Remove support for Orca for static image generation [#5677]
    • 

  • Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]
    • 



Updated


    

  • Update plotly.js from version 3.6.0 to version 4.0.0-rc.0 [#5673]. This is a major-version release candidate with many changes. See the plotly.js release notes for the full list. The most significant changes include:

      

    • Add quiver trace type to visualize vector fields using arrows [#7710]
      • 

    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
      • 

    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.

        

      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
        • 

      

      • 

    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
      • 

    • Switch color processing library from TinyColor to color [#7536]. There are some changes to supported color string formats as a result:

        

      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
        • 

      • hsv() color strings are no longer supported
        • 

      • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0, 0%, 0%)'
        • 

      

      • 

    • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
      • 

    • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
      • 

    • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
      • 

    • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]
      • 

    

    • 








Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    •

@dependabot
build(deps): bump the sandbox-python group across 1 directory with 5 …
01ae015 
…updates

Bumps the sandbox-python group with 5 updates in the /sandbox directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.72` | `1.43.83` |
| [clickhouse-connect](https://github.com/ClickHouse/clickhouse-connect) | `1.7.1` | `1.7.2` |
| [eth-abi](https://github.com/ApeWorX/eth-abi) | `5.2.0` | `6.0.0` |
| [eth-account](https://github.com/ApeWorX/eth-account) | `0.13.7` | `0.14.0` |
| [plotly](https://github.com/plotly/plotly.py) | `6.9.0` | `7.0.0` |



Updates `boto3` from 1.43.72 to 1.43.83
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.72...1.43.83)

Updates `clickhouse-connect` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/ClickHouse/clickhouse-connect/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-connect/blob/main/CHANGELOG.md)
- [Commits](ClickHouse/clickhouse-connect@v1.7.1...v1.7.2)

Updates `eth-abi` from 5.2.0 to 6.0.0
- [Release notes](https://github.com/ApeWorX/eth-abi/releases)
- [Changelog](https://github.com/ApeWorX/eth-abi/blob/main/docs/release_notes.rst)
- [Commits](ApeWorX/eth-abi@v5.2.0...v6.0.0)

Updates `eth-account` from 0.13.7 to 0.14.0
- [Release notes](https://github.com/ApeWorX/eth-account/releases)
- [Changelog](https://github.com/ApeWorX/eth-account/blob/main/docs/release_notes.rst)
- [Commits](ApeWorX/eth-account@v0.13.7...v0.14.0)

Updates `plotly` from 6.9.0 to 7.0.0
- [Release notes](https://github.com/plotly/plotly.py/releases)
- [Changelog](https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md)
- [Commits](plotly/plotly.py@v6.9.0...v7.0.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: sandbox-python
- dependency-name: clickhouse-connect
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: sandbox-python
- dependency-name: eth-abi
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: sandbox-python
- dependency-name: eth-account
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sandbox-python
- dependency-name: plotly
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: sandbox-python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 14, 2026
redpandabot[bot]
redpandabot Bot reviewed Sep 14, 2026
View reviewed changes

@redpandabot redpandabot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

Dependabot bump of the sandbox-python group (boto3, clickhouse-connect, eth-abi, eth-account, plotly plus their transitive eth-* deps). OSV reports no vulnerabilities for any new or transitive version, and the major bumps don't break repo code: evm.py's eth_account calls (from_key/address/sign_transaction/raw_transaction) all exist in 0.14.0 and eth_abi/plotly are never imported by module code. The only notable item is that the new eth-account dependency tree pulls a pre-release py-ecc into the sandbox image when a stable version is available.

Issues

  • 🟡 sandbox/requirements.txt:1489 — pre-release py-ecc 9.0.0b1 pinned despite stable 8.0.0 satisfying all constraints — see the thread on that line

Reviewed @ 01ae0153
"Weeks of coding can save you hours of planning."

Comment thread sandbox/requirements.txt
--hash=sha256:08b21f1244a97e7a1a699833c4bb2678475aa108b3f1989886ed0b038ebfd849 \
--hash=sha256:78cbf7bd06d1b05bb3b8ec1b709864695229b55151b6f7530fbf55517ead6fdd
# via -r requirements.in
py-ecc==9.0.0b1 \

@redpandabot redpandabot Bot Sep 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 pre-release py-ecc 9.0.0b1 pinned despite stable 8.0.0 satisfying all constraints

The eth-account 0.14.0 tree adds py-ecc==9.0.0b1, a beta, though PyPI's latest stable is 8.0.0 (published after the beta) and the only constraint in the chain, eth-keyfile 0.10.0's py_ecc>=5.2.0, is satisfied by 8.0.0. Nothing in eth-keys/eth-account/eth-keyfile metadata requires the beta, so this looks like resolver churn (the entry also lists each hash twice). Worth re-verifying the compile or pinning py-ecc 8.0.0 before shipping a curve-crypto beta in the sandbox image.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@redpandabot redpandabot[bot] redpandabot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants