build(deps): bump the sandbox-python group across 1 directory with 4 updates

[dependabot]

Bumps the sandbox-python group with 4 updates in the /sandbox directory: boto3, clickhouse-connect, matplotlib and plotly.

Updates boto3 from 1.43.20 to 1.43.37

Commits

• af4ce8d Merge branch 'release-1.43.37'
• d52c295 Bumping version to 1.43.37
• b926d8d Add changelog entries from botocore
• 08029bd Bump https://github.com/astral-sh/ruff-pre-commit (#4804)
• 1b11d8e Bump actions/checkout from 6.0.0 to 7.0.0 in the github-actions group (#4803)
• 76f3a99 Add CODEOWNERS file for team review enforcement (#4805)
• 1d26f21 Merge branch 'release-1.43.36'
• e8ccf57 Merge branch 'release-1.43.36' into develop
• 111333b Bumping version to 1.43.36
• 9d1fa23 Add changelog entries from botocore
• Additional commits viewable in compare view

Updates clickhouse-connect from 1.1.1 to 1.4.0

Release notes

Sourced from clickhouse-connect's releases.

v1.3.0

This release adds structured error codes on raised exceptions, Windows ARM64 wheels, and a set of bug fixes for the DB API cursor and server-side bind parameters.

Highlights

Features

• Structured error fields on exceptions. Server errors now expose a numeric code attribute with the ClickHouse error code and a name attribute with the symbolic name such as UNKNOWN_TABLE on DatabaseError and OperationalError. Callers can branch on exc.code instead of parsing the message string. code is set even when show_clickhouse_errors is disabled. Both default to None when unavailable, such as on transport errors. Closes #786.
• Windows ARM64 wheels. Wheels are now built and published for win_arm64 on CPython 3.10 through 3.14, including the free-threaded 3.14 build. Closes #785.

Bug Fixes

• Large query parameter payloads are now automatically sent as form data in the request body instead of the URL query string, so a large IN list or a high-dimensional vector embedding no longer produces a URL that intermediaries like nginx, AWS ALB, or CloudFront reject with HTTP 414. Queries using binary parameter binds are never promoted automatically and only use form encoding when form_encode_query_params=True is set. Applies to both sync and async clients. Closes #740.
• DB API Cursor.executemany no longer raises AttributeError when rows are passed as sequences instead of mappings. PEP 249 allows sequence rows, and consumers like Airflow's DbApiHook.insert_rows(executemany=True) pass tuples.
• uuid.UUID, IPv4Address, and IPv6Address values nested inside Array, Tuple, or Map server-side bind parameters are now quoted, fixing IN lists of UUIDs bound to {name:Array(String)} being rejected by the server. Closes #791.
• A datetime parameter whose name genuinely ends in _64 is no longer renamed when the query binds that exact name, fixing placeholders like {param_64:DateTime64(6)} being left unbound. SQLAlchemy hit this with server_side_params=True once a statement reached 64 anonymous parameters. The documented _64 convention still works as before. Closes #790.

Installation

pip install --upgrade clickhouse-connect

Full Changelog: ClickHouse/clickhouse-connect@v1.2.0...v1.3.0

v1.2.0

clickhouse-connect 1.2.0

This release adds opt-in server-side bind parameters for the SQLAlchemy dialect, a token_provider client option for refreshable access tokens, and custom HTTP headers on client creation. It also ships a batch of SQLAlchemy reflection and type fixes along with several correctness fixes in query parameter handling and DSN parsing.

⚠️ Upgrade note: literal % in a DSN

The dsn passed to create_client / create_async_client now percent-decodes the username, password, and database. This lets you supply credentials that contain reserved characters in URL-encoded form, so pass%20word decodes to pass word.

If your DSN contains a literal %, you must now escape it as %25. A DSN credential like pa%ss will otherwise be misread. This is the one behavior change in this release that can affect existing setups, so check your connection strings before upgrading. A DSN with a username and no password now also sends an empty password rather than the literal string None. Closes #713.

Highlights

New features

• Server-side bind parameters for SQLAlchemy. Opt in with create_engine(url, server_side_params=True). The dialect then emits ClickHouse native {name:Type} / {name:Array(Type)} placeholders instead of client-side string interpolation. Off by default. Closes #735.
• token_provider client option. Sync and async. It accepts a callable that returns an access token string. The callable is invoked once for the initial token and again to fetch a fresh token whenever the server rejects the current one on an authentication failure, retrying the request once. Mutually exclusive with access_token and username/password.
• Custom HTTP headers. A new headers option on create_client / create_async_client attaches custom headers to every request, including the initialization queries sent during client creation. Useful for HTTP gateways that require auth headers such as Cloudflare Access service tokens.

Bug fixes

• A datetime bound to a server-side {name:DateTime64(...)} placeholder now keeps its sub-second precision instead of being truncated to seconds. The declared parameter type drives this, so no _64 name suffix or manual DT64Param wrapper is needed, and it applies through Array and Tuple hints. Plain DateTime binds are unchanged. Closes #739.
• bytes / bytearray query parameters now render as ClickHouse string literals, each byte as \xHH, instead of the Python repr. This fixes inserts into FixedString / String columns through the SQLAlchemy dialect. Closes #777.
• Strip -- line comments that have no following space when classifying queries, so a DDL with a leading --sql-style comment is routed as a command instead of raising StreamFailureError. Closes #499.

SQLAlchemy improvements

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.4.0, 2026-06-29

Bug Fixes

• QueryResult.first_item and QueryResult.first_row now return None for an empty result set instead of raising IndexError. Both properties indexed element [0] without checking the row count, so they crashed when a query returned no rows. They now short-circuit on an empty result in both row-oriented and column-oriented mode. Closes #824.
• Cursor.executemany now correctly resets rowcount and reports the number of inserted rows after a bulk insert. Previously, rowcount retained the value from the previous operation. The insert summary is also appended to cursor.summary, consistent with the non-bulk path. In addition, passing a generator as seq_of_parameters no longer raises TypeError; the bulk-insert optimisation is now skipped for non-indexable iterables and the operation falls through to the row-by-row path as PEP 249 requires.
• Fixed a connection failure partway through reading a query result being silently treated as a complete result. The reader detected the broken stream but discarded the error once any rows had already been read, so a truncated result was returned as if it were whole. A mid-stream read failure now raises StreamFailureError, carrying the server-side error message when ClickHouse reported one. Closes #802.
• Client.insert_arrow and AsyncClient.insert_arrow no longer drop the transport_settings argument. It was passed positionally into the compression parameter, so transport settings were ignored and a non-empty value corrupted the request. It is now forwarded correctly.
• command now raises ProgrammingError when binary parameter binds are combined with command data or external data, instead of placing binary content into the URL query string. This applies to both the sync and async clients.
• Importing clickhouse-connect no longer emits a DeprecationWarning for the array 'u' type code. The compiled buffer module built an unused array.array('u', []) template at import time. The 'u' (wchar_t) code was deprecated and is scheduled for removal in 3.16, where this would have become an ImportError. The template is removed, which also lets projects that run with -W error import the package. Closes #815.
• The SQLAlchemy Nullable and LowCardinality DDL helpers are now functions that return a concrete ChSqlaType. They were classes whose __new__ returned a different type, which type checkers cannot model, so Array(LowCardinality(String)) raised a spurious mypy error despite working at runtime. Runtime behavior is unchanged. Closes #819.

Improvements

• The Cython extension modules now declare free-threading compatibility, so importing clickhouse-connect on a free-threaded Python build such as 3.14t no longer silently re-enables the GIL. As part of this change, ResponseBuffer.read_uint64 no longer uses a module level scratch buffer for its big-endian byte swap, which was the one piece of shared mutable state in the C modules. Building from source now requires Cython 3.1 or later. The CI test matrix now runs the full suite on free-threaded Python 3.14t as a non-blocking job. Free-threading support remains experimental.
• QueryResult.query_id now returns an empty string instead of None when the server reported no query id. This matches QuerySummary and makes the property consistently typed as str.
• clickhouse-connect now ships PEP 561 type information. The py.typed marker is included so downstream type checkers can use the package annotations. Closes #692.
• create_client, create_async_client, connect(), and the DB-API Connection constructor now accept None for port and database to request the driver's defaults, in addition to omitting them. Previously the public type hints exposed the internal sentinel values 0 for port and "__default__" for database, so callers had no clean way to say "not specified". None is now the documented, typed way to do that at every level. The old sentinel values are still accepted, so the change is backward compatible. Closes #801.

Compatibility

• Client.insert, AsyncClient.insert, and raw_insert now require column_names to be a Sequence rather than a bare Iterable. A one-shot iterator such as a generator already failed at runtime because the column names are measured and iterated more than once, so the type hint now matches the real requirement.

1.3.0, 2026-06-11

Improvements

• Build and publish Windows ARM64 win_arm64 wheels for CPython 3.10 through 3.14, including the free-threaded 3.14 build. Closes #785.
• Server errors now expose structured fields on the raised exception. DatabaseError and OperationalError carry a numeric code attribute with the ClickHouse error code and a name attribute with the symbolic name such as UNKNOWN_TABLE, so callers can branch on exc.code instead of parsing the message string. code is set even when show_clickhouse_errors is disabled. name is only set when error detail is enabled. Both default to None when unavailable, such as on transport errors. Closes #786.

Bug Fixes

• DB API Cursor.executemany no longer raises AttributeError: 'tuple' object has no attribute 'keys' when rows are passed as sequences instead of mappings. The bulk insert optimization assumed every row was a dict, but PEP 249 allows seq_of_parameters to contain sequences, and cursor.execute already accepted positional parameters. Sequence rows now use the same bulk insert path, taking column names from the INSERT statement when present. This fixes consumers like Airflow's DbApiHook.insert_rows(executemany=True), which passes tuples.
• Large query parameter payloads are now automatically sent as form data in the request body instead of the URL query string. Server-side bind parameters were urlencoded into the request URL, so a large IN list or a high-dimensional vector embedding could produce a URL that HTTP intermediaries such as nginx, AWS ALB, and CloudFront reject with HTTP 414. The client now routes parameters to the POST body once their encoded length passes a threshold, which keeps the URL small. Setting form_encode_query_params=True still forces form encoding for all queries. Queries using binary parameter binds are never promoted automatically and only use form encoding when the flag is set. This does not change the server's per-value size limit, which is governed by http_max_field_value_size. Applies to both sync and async clients. Closes #740.
• uuid.UUID, IPv4Address, and IPv6Address values nested inside Array, Tuple, or Map server-side bind parameters are now quoted, matching client-side parameter formatting. Previously they rendered unquoted, so an IN list of UUIDs bound to {name:Array(String)} (as produced by SQLAlchemy Column.in_ with server_side_params=True) was rejected by the server with Code: 26 ... cannot be parsed as Array(String). Closes #791.
• A datetime parameter whose name genuinely ends in _64 is no longer renamed when the query binds that exact name. bind_query treated any trailing _64 as a DateTime64 precision hint and stripped it before looking at the query, so a placeholder like {param_64:DateTime64(6)} was left unbound and the server rejected the query. SQLAlchemy hits this with server_side_params=True once a statement reaches 64 anonymous parameters. The suffix is now only treated as a hint when the full name does not appear as a placeholder in the query, which leaves the documented _64 convention working as before. Closes #790.

1.2.0, 2026-06-08

Improvements

• SQLAlchemy: opt-in server-side bind parameters via create_engine(url, server_side_params=True). The dialect then emits ClickHouse native {name:Type} / {name:Array(Type)} placeholders instead of client-side string interpolation. Off by default. Closes #735.
• Added a token_provider client option (sync and async). It accepts a callable returning an access token string; the callable is invoked once for the initial token and again to fetch a fresh token whenever the server rejects the current one (authentication failure), retrying the request once. Mutually exclusive with access_token and username/password.
• Added a headers option to create_client/create_async_client for attaching custom HTTP headers to every request, including the initialization queries sent during client creation. Useful for HTTP gateways that require auth headers such as Cloudflare Access service tokens.

Bug Fixes

• A datetime bound to a server-side {name:DateTime64(...)} placeholder now keeps its sub-second precision instead of being truncated to seconds. The declared parameter type drives this, so no _64 name suffix or manual DT64Param wrapper is needed, and it applies through Array and Tuple hints. Plain DateTime binds are unchanged. Closes #739.
• Strip -- line comments that have no following space when classifying queries, so a DDL with a leading --sql-style comment is routed as a command instead of raising StreamFailureError. Closes #499.
• SQLAlchemy: implement reflection on the dialect itself so MetaData.reflect() and Inspector.get_multi_columns() work.
• SQLAlchemy: UDT-based types (UUID, IPv4/IPv6, JSON, Nested, geometry types, AggregateFunction, etc.) now return concrete python_type classes instead of None, matching SQLAlchemy's TypeEngine.python_type contract.
• SQLAlchemy: Array now subclasses sqlalchemy.types.ARRAY and exposes item_type.
• bytes/bytearray query parameters now render as ClickHouse string literals (each byte as \xHH) instead of the Python repr, fixing inserts into FixedString/String columns through the SQLAlchemy dialect. Closes #777.
• The dsn passed to create_client/create_async_client now percent-decodes the username, password, and database, so credentials containing reserved characters can be supplied URL-encoded (pass%20word becomes pass word). A literal % in a DSN must now be written as %25. A DSN with a username and no password now sends an empty password rather than the literal string None. Closes #713.

Commits

• 584ae6a v1.4.0 release prep (#829)
• affc55f Return None from first_item/first_row on empty result (#826)
• 3abcd6a make Nullable and LowCardinality functions returning ChSqlaType (#823)
• 53c4031 remove u template (#822)
• fae64ca refactor(driver): accept None for port and database as 'not specified' (#813)
• f322544 chore: add local mypy pre-commit hook mirroring CI (#814)
• e3fbd59 add note about mypy typing (#810)
• 3d0596c refactor(cc_sqlalchemy): add type annotations to pass mypy (part of #692) (#807)
• 157a190 refactor(driver-clients): add annotations to client, httpclient, asyncclient ...
• 79dc7cf refactor(driver-utils): add type annotations to pass mypy (part of #692) (#805)
• Additional commits viewable in compare view

Updates matplotlib from 3.10.9 to 3.11.0

Release notes

Sourced from matplotlib's releases.

REL: v3.11.0

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. See the release notes for more information.

REL: v3.11.0rc2

This is the second release candidate for the meso release 3.11.0.

This release candidate fixes some problems with downstream packages, removes some missed deprecations, and corrects some additional minor bugs.

REL: v3.11.0rc1

After an extended development stretch, we are pleased to announce the first release candidate of Matplotlib 3.11.0.

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner. Due to the update to the font rendering stack, we cannot guarantee that text will be bit-for-bit perfect with previous releases, so if you are using Matplotlib for testing, it may be necessary to introduce/raise a tolerance within your tests.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. Final release notes are still being curated, but you may browse the list of new features, API changes, and all issues/pull requests on the milestone.

As a note for downstream packagers, the font libraries have only been tested against the versions bundled with the wheels. It may be possible to expand the range of requirements, or that a requirement is too broad. Please report any issues you have building against external dependencies.

Commits

• 69c7534 REL: v3.11.0
• b7d912b DOC: Set 3.11 as preferred stable release
• 7c3d502 Update Security Policy for 3.11
• 964e73d DOC: Prepare GitHub stats for 3.11 final
• bfa2633 Bump font manager version to final release
• d0603b2 Merge pull request #31873 from meeseeksmachine/auto-backport-of-pr-31706-on-v...
• edf5ebc Backport PR #31706: Fix clabel manual index
• c0e80b7 Merge pull request #31872 from meeseeksmachine/auto-backport-of-pr-31868-on-v...
• 2a14854 Backport PR #31868: DOC: Move errorbar examples to the statistics sections
• ea43d96 Merge pull request #31871 from meeseeksmachine/auto-backport-of-pr-31870-on-v...
• Additional commits viewable in compare view

Updates plotly from 6.7.0 to 6.8.0

Release notes

Sourced from plotly's releases.

v6.8.0

Added

• Add optional font parameter for make_subplots [#5393], with thanks to @​Zomtir for the contribution!

Fixed

• Fix issue where user-specified color_continuous_scale was ignored when template had autocolorscale=True [#5439], with thanks to @​antonymilne for the contribution!
• Use presence of COLAB_NOTEBOOK_ID env var to enable Colab renderer instead of testing import of google.colab [#5473], with thanks to @​kevineger for the contribution!
• Fix incorrect annotation placement for add_vline, add_hline, add_vrect, and add_hrect on datetime axes [#5508], with thanks to @​mosh3eb for the contribution!
• Update tests to be compatible with numpy 2.4 [#5522], with thanks to @​thunze for the contribution!
• Fix issue where js/ directory was unintentionally installed as a top-level Python package when installing plotly [#5587]
• Add default headers to be passed in to Kaleido v1.3.0 to avoid blocked Open Street Map tiles [#5588]
• Propagate the requested default_height/default_width to the outer wrapper div produced by to_html so that responsive (percentage) dimensions inherit from a sized parent container instead of collapsing to the plotly.js 450px fallback [#5591], with thanks to @​SharadhNaidu for the contribution!

Updated

• The __eq__ method for graph_objects classes now returns NotImplemented to give the other operand an opportunity to handle the comparison [#5547], with thanks to @​RazerM for the contribution!
• Update plotly.js from version 3.5.0 to version 3.6.0. See the plotly.js release notes for more information [#5608]. Notable changes include:
  • Add support for arrays for the pie property legendrank, so that it can be configured per slice [#7723]
  • Add hoversort layout attribute to sort unified hover label items by value [#7734]

Changelog

Sourced from plotly's changelog.

[6.8.0] - 2026-06-03

Added

• Add optional font parameter for make_subplots [#5393], with thanks to @​Zomtir for the contribution!

Fixed

• Fix issue where user-specified color_continuous_scale was ignored when template had autocolorscale=True [#5439], with thanks to @​antonymilne for the contribution!
• Use presence of COLAB_NOTEBOOK_ID env var to enable Colab renderer instead of testing import of google.colab [#5473], with thanks to @​kevineger for the contribution!
• Fix incorrect annotation placement for add_vline, add_hline, add_vrect, and add_hrect on datetime axes [#5508], with thanks to @​mosh3eb for the contribution!
• Update tests to be compatible with numpy 2.4 [#5522], with thanks to @​thunze for the contribution!
• Fix issue where js/ directory was unintentionally installed as a top-level Python package when installing plotly [#5587]
• Add default headers to be passed in to Kaleido v1.3.0 to avoid blocked Open Street Map tiles [#5588]
• Propagate the requested default_height/default_width to the outer wrapper div produced by to_html so that responsive (percentage) dimensions inherit from a sized parent container instead of collapsing to the plotly.js 450px fallback [#5591], with thanks to @​SharadhNaidu for the contribution!

Updated

• The __eq__ method for graph_objects classes now returns NotImplemented to give the other operand an opportunity to handle the comparison [#5547], with thanks to @​RazerM for the contribution!
• Update plotly.js from version 3.5.0 to version 3.6.0. See the plotly.js release notes for more information [#5608]. Notable changes include:
  • Add support for arrays for the pie property legendrank, so that it can be configured per slice [#7723]
  • Add hoversort layout attribute to sort unified hover label items by value [#7734]

Commits

• ea4eca8 Address PR feedback
• e57adbd Fix broken example
• b8c2bf4 Update Jupyter Lab extension files
• 2de1059 Update docs for release
• f94e304 Version changes for v6.8.0
• 7f2eb35 Merge pull request #5608 from plotly/cam/update-plotly.js-3.6.0
• f57cf96 Update command to run npm install for updateplotlyjs
• 1f26820 Update lock file
• 8f699a3 chore: Update plotly.js to v3.6.0
• f0755e5 Merge pull request #5605 from plotly/cam/pin-python-frontmatter
• Additional commits viewable in compare view