[dependabot]

Bumps the python-minor-and-patch group with 17 updates:

Package	From	To
numpy	2.5.3	2.5.4
ruff	0.16.10	0.17.0
pydoclint	0.11.0	0.11.1
executing	2.2.1	2.3.0
filelock	4.0.12	4.1.1
iniconfig	2.3.0	2.3.1
json5	0.15.0	0.17.3
jsonpointer	3.1.1	3.2.1
jupyterlite-core	0.8.5	0.8.6
narwhals	2.26.0	2.27.1
nbconvert	7.17.1	7.17.2
nest-asyncio2	1.7.3	1.7.4
platformdirs	4.12.3	4.13.0
pycparser	3.0	3.11
python-discovery	1.6.1	1.6.2
sqlalchemy	2.1.3	2.1.4
virtualenv	21.14.5	21.14.7

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Updates pydoclint from 0.11.0 to 0.11.1

Release notes

Sourced from pydoclint's releases.

0.11.1

What's Changed

• Fix empty exclude pattern excluding all files instead of none by @​jsh9 in jsh9/pydoclint#319

Full Changelog: jsh9/pydoclint@0.11.0...0.11.1

Changelog

Sourced from pydoclint's changelog.

[0.11.1] - 2026-10-11

• Fixed
  • An empty --exclude pattern (such as --exclude='' or exclude = '' in the config file) excluded every file, so nothing was checked and the run passed. Now an empty pattern means "don't exclude any files", so every file gets checked (#311)
• Changed
  • An --exclude value that isn't a valid regular expression is now rejected with a clear error message instead of a traceback
• Full diff
  • jsh9/pydoclint@0.11.0...0.11.1

Commits

• 8717514 Fix empty exclude pattern excluding all files instead of none (#319)
• See full diff in compare view

Updates executing from 2.2.1 to 2.3.0

Commits

• 57917e8 remove tox from release script
• 7719501 formatting (#108)
• 3a52bb2 3.15 support (#109)
• 0dc8a1c refactor: convert type comments to type annotations (#105)
• ae10d56 build(deps): bump ipython from 4.2.1 to 8.10.0 (#106)
• 3646ef3 build(deps): bump pygments from 2.19.2 to 2.20.0 (#104)
• 82a0574 chore: use pyproject.toml (#103)
• See full diff in compare view

Updates filelock from 4.0.12 to 4.1.1

Release notes

Sourced from filelock's releases.

4.1.1

• Bound the shared-lock contention test by worker progress so slow CI machines can finish the workload. #819
• Avoid the macOS /dev/fd lookup implicated in a kernel panic by opening SQLite through a validated hard link. The database directory must be writable and support hard links; alias creation failure raises OSError. #820
• Ignore non-ASCII PID or start-time fields and out-of-range PIDs in ReadWriteLock hard-link directory names so forged owners cannot abort acquisition. #821
• Use Python 3.15 for development and automation. #816

PyPI release

Full Changelog: tox-dev/filelock@4.1.0...4.1.1

4.1.0

• Import OwnerMode, CompromiseReason and has_fcntl from filelock. #790
• AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. #803
• A Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. #815
• is_lock_held_by_us and is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. #774
• SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. #775
• acquire and acquire no longer wait past timeout when poll_interval is longer than the time left. #777
• SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. #778
• ReadWriteLock, SoftReadWriteLock and their async wrappers treat a inf timeout like -1 and raise ValueError for a blocking nan one. #779
• ReadWriteLock and SoftReadWriteLock accept a timeout above TIMEOUT_MAX instead of raising OverflowError. #780
• acquire raises ValueError for a blocking nan timeout or a poll_interval above TIMEOUT_MAX, and treats a inf timeout like -1. #781
• SoftFileLock and MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. #782
• UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises FileNotFoundError instead of retrying. #785
• SoftFileLock and SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. #786
• StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that landed as published, and no longer reports is_locked after a failed claim cleanup. #787
• On Python 3.10 without the exceptiongroup backport, a release failure under the default context_error_policy no longer turns into ModuleNotFoundError; cleanup failures chain instead of grouping, and on_acquired is allowed. #788
• AsyncReadWriteLock and AsyncSoftReadWriteLock drop a task's hold when a caller cancels it during a release that still completes, instead of blocking every later writer. #789
• SoftFileLease releases a lease dropped while held, at garbage collection or interpreter exit, and raises ValueError for a heartbeat_interval above TIMEOUT_MAX. #791
• StrictSoftFileLock judges an abandoned private record's age by the filesystem's clock, so a client clock ahead of an NFS server no longer aborts live publications. #792
• BaseAsyncFileLock raises RuntimeError instead of CancelledError when its

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.2.4 (2026-10-19)

---

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

---

4.2.3 (2026-10-19)

---

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

---

4.2.2 (2026-10-18)

---

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

---

4.2.1 (2026-10-17)

---

• On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
• :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
• Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

• 5830a7e Release 4.1.1
• a5fb607 fix(read-write): reject a hostile pid in _owner_is_gone (#821)
• 4c6f32f test: make lock error checks deterministic (#817)
• f11f523 fix(tests): bound concurrent lock progress (#819)
• 5fd0c8f fix(rw): avoid macOS descriptor lookups (#820)
• 0c3aaab feat(python): default to Python 3.15 (#816)
• 6c0ecc2 Release 4.1.0
• df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
• 0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
• 73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
• Additional commits viewable in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig#79
• @​Pitchfork-and-Torch made their first contribution in pytest-dev/iniconfig#76

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

• fix quadratic parse time for values with many continuation lines (#78, regarding #77)
• strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
• internal: iniconfig._parse.ParsedLine.value is now a list of lines

Commits

• 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
• d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
• 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
• 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
• b153213 test: expect sorted all after ruff RUF022 autofix
• 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
• 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 2e68639 [pre-commit.ci] pre-commit autoupdate
• 23c9e08 docs: use parse API in the README example
• e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
• Additional commits viewable in compare view

Updates json5 from 0.15.0 to 0.17.3

Commits

• 835dc35 Bump to v0.17.3 to pick up a security fix.
• efd1946 Sigh. Re-release again as v0.17.2.
• b9eb909 Re-release as v0.17.1.
• dcb49c0 Merge in changes for v0.17.0 (#120)
• a7ab730 bump version to v0.17.0.dev0
• fad917f update README.md
• 7b14898 rework GitHub CI to do different things on different versions of Python
• 1f4f812 Rework run script and project dependencies.
• 8f70c4c Bump version to v0.16.0.
• b475c55 Update dependencies and fix any newly raised issues.
• Additional commits viewable in compare view

Updates jsonpointer from 3.1.1 to 3.2.1

Release notes

Sourced from jsonpointer's releases.

3.2.1

What's Changed

• Report test coverage to Coveralls from GitHub Actions by @​stefankoegl in stefankoegl/python-json-pointer#87
• Replace Travis CI link with GitHub Actions badge in README by @​stefankoegl in stefankoegl/python-json-pointer#88
• Preserve trailing member-name spaces in pointer files by @​fhgffy in stefankoegl/python-json-pointer#89

Full Changelog: stefankoegl/python-json-pointer@v3.2.0...v3.2.1

3.2.0

What's Changed

• Run unittest discovery in the coverage target by @​x0Lazarus in stefankoegl/python-json-pointer#79
• [BUGFIX] JsonPointer should not index into strings by @​angela-tarantula in stefankoegl/python-json-pointer#76
• Preserve JsonPointer subclasses when joining by @​x0Lazarus in stefankoegl/python-json-pointer#78
• fix: validate assignment target in JsonPointer.set() by @​abhi-0203 in stefankoegl/python-json-pointer#80
• Normalize oversized array index conversion errors by @​fhgffy in stefankoegl/python-json-pointer#83
• Add VERBOSE_EXCEPTIONS flag to suppress doc content in JsonPointerException messages by @​stefankoegl with @​Copilot in stefankoegl/python-json-pointer#72
• Improve jsonpointer CLI: support positional pointer argument by @​stefankoegl in stefankoegl/python-json-pointer#81
• Add GitHub Actions workflow for PyPI publishing by @​stefankoegl in stefankoegl/python-json-pointer#85

New Contributors

• @​x0Lazarus made their first contribution in stefankoegl/python-json-pointer#79
• @​abhi-0203 made their first contribution in stefankoegl/python-json-pointer#80
• @​fhgffy made their first contribution in stefankoegl/python-json-pointer#83

Full Changelog: stefankoegl/python-json-pointer@v3.1.1...v3.2.0

Commits

• f2641f0 bump version to 3.2.1
• 5eb90c3 Merge pull request #89 from fhgffy/fix-cli-pointer-file-whitespace
• 709d2ee Fix CLI pointer file whitespace preservation
• 439f0ed Merge pull request #88 from stefankoegl/claude/coveralls-upload
• 9ce983e Merge pull request #87 from stefankoegl/claude/coveralls-upload
• 330f27b Replace Travis CI link with GitHub Actions badge and link
• 4727a8b Update Coveralls badge and link to current URLs
• 47e3676 Report test coverage to Coveralls from GitHub Actions
• f1f238b bump version to 3.2.0
• a2af5bc Merge pull request #85 from stefankoegl/claude/determined-feynman-lzwpbs
• Additional commits viewable in compare view

Updates jupyterlite-core from 0.8.5 to 0.8.6

Release notes

Sourced from jupyterlite-core's releases.

v0.8.6

0.8.6

(Full Changelog)

Bugs fixed

• Fix service worker stdin replies being delivered to all pending requests #2077 (@​jtpio)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​jtpio (activity)

Changelog

Sourced from jupyterlite-core's changelog.

0.8.6

(Full Changelog)

Bugs fixed

• Fix service worker stdin replies being delivered to all pending requests #2077 (@​jtpio)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​jtpio (activity)

Commits

• 337b8a7 Publish 0.8.6
• bd2c023 Backport PR #2077: Fix service worker stdin replies being delivered to all pe...
• See full diff in compare view

Updates narwhals from 2.26.0 to 2.27.1

Release notes

Sourced from narwhals's releases.

Narwhals v2.27.1

What's Changed

• fix: return a numeric dtype from str.len_chars on all-null object columns by @​FBruzzesi in narwhals-dev/narwhals#4031
• fix: count characters, not bytes, in str.zfill on Polars < 2.0 by @​FBruzzesi in narwhals-dev/narwhals#4040

Full Changelog: narwhals-dev/narwhals@v2.27.0...v2.27.1

Narwhals v2.27.0

Changes

• test: cover concat_str single expression and null inputs (#3978)
• test: cover corr and cov constant, stability and group_by cases (#3917)
• fix(tests): PySpark tests fixup (#3940)
• test: test cover quantile boundaries, invalid raises, median over (#3919)

✨ Enhancements

• feat: Add {DataFrame, LazyFrame}.cast (#3815)
• feat: support list.contains for PyArrow, pandas and Dask (#4001)
• feat: accept file-like objects in {read,scan}_* (#3956)
• feat: hint at narwhals-datafusion plugin for datafusion.DataFrame (#3937)

🐞 Bug fixes

• fix: avoid LazyFrame.cast from resolving the full schema to check column names (#4016)
• fix: return null for floor division by zero on pandas-like backends (#4011)
• fix: upcast {Int8,Int16,UInt8,UInt16} to Int64 in pyarrow cum_sum (#3995)
• fix: align scalar operands before fill_null and horizontal reductions in Dask (#3972)
• fix: use relations' own connection for concat(how="diagonal") on DuckDB (#3998)
• fix: align list.contains null handling with Polars on lazy backends (#3996)
• fix: cum_count(reverse=True) counts non-null values on pandas-like backends (#3991)
• fix: align pandas-like and Dask concat_str boolean rendering (#3979)
• fix: match Polars in str.slice for negative offset, raise on negative length (#3969)
• fix: correct str.zfill for +-prefixed strings on polars<=1.30 and support polars 0.20.4 (#3958)
• fix: align concat_str behavior for polars<0.20.6 (#3981)
• fix: broadcast scalar-only concat_str for sql-like backends (#3980)
• fix: avoid DIVIDE_BY_ZERO in PySpark corr on constant columns (#3960)
• fix: preserve all-null rows in concat_str for pyarrow backend (#3966)
• fix: align series before fillna and isna in dask mean_horizontal (#3968)
• fix: drop trailing separator in concat_str(..., ignore_nulls=True) for pandas-like and Dask backends (#3967)
• fix: broadcast literals in pandas-like and PyArrow horizontal functions (#3941)
• fix: preserve nulls when casting to String on pandas pre v3.0.0 (#3939)
• fix: reject a negative width in str.zfill consistently across backends (#3770)
• fix: align __mod__ and __rmod__ behavior with negative operands across backends (#3929)
• fix: raise DuplicateError on duplicate struct field names; cover nested struct schema round trip in tests (#3918)
• fix: reject invalid str.{pad_start,pad_end} arguments consistently; cover pad length-zero and unicode edge cases in tests (#3910)
• fix: str.replace(n=0) on pandas-like backends; cover replace regex and n edge cases in tests (#3911)
• fix(pyarrow): use native {starts,ends}_with kernels, fixing empty-suffix ends_with; cover empty-pattern and null expr-pattern search in tests (#3912)

... (truncated)

Commits

• 185de76 release: Bump version to 2.27.1
• 67a2cff chore(deps): lock file maintenance (#4049)
• a295df1 chore(deps): lock file maintenance (#4035)
• 19ad1eb chore: prek autoupdate (#4039)
• 2b2521b fix: count characters, not bytes, in str.zfill on Polars < 2.0 (#4040)
• b89e14a skip changelog(deps): Update github/codeql-action action to v4.38.2 (#4034)
• faf5bde fix: return a numeric dtype from str.len_chars on all-null object columns...
• 1acc082 release: Bump version to 2.27.0 (#4028)
• b8dd014 fix: avoid LazyFrame.cast from resolving the full schema to check column na...
• cc2b466 fix: return null for floor division by zero on pandas-like backends (#4011)
• Additional commits viewable in compare view

Updates nbconvert from 7.17.1 to 7.17.2

Release notes

Sourced from nbconvert's releases.

v7.17.2

7.17.2

(