[dependabot]

Bumps the python-workflow-requirements group in /.github/workflows/requirements with 6 updates:

Package	From	To
cmake	4.4.0	4.4.2
lxml	6.1.1	6.1.2
numpy	2.5.1	2.5.2
protobuf	7.35.1	7.36.0
pyzmq	27.1.0	27.2.0
scipy	1.18.0	1.18.1

Updates cmake from 4.4.0 to 4.4.2

Commits

• 10f3cc5 [Bot] Update to CMake 4.4.2 (#719)
• 7aafa76 chore(deps): bump the actions group with 4 updates (#718)
• b824b7c [Bot] Update to CMake 4.4.1 (#717)
• 2796c51 chore(deps): bump wntrblm/nox in the actions group (#716)
• b961bdb chore(deps): bump astral-sh/setup-uv in the actions group (#715)
• 2d2582c chore: always run tests (#662)
• See full diff in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

Commits

• f2874e9 Update release date.
• 687a295 Build: Exclude Py3.8 from windows-arm builds.
• acadc56 Build: Remove outdated build target.
• 59f93eb Build: Split old-Linux and other-Py3.8 builds.
• 923df83 Build: Fix manylinux2014 build.
• 975cc83 Build: Fix Px3.8 build setup.
• 09e5d3e Build: Fix cibuildwheel version.
• 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
• 5567037 Build: Exclude Py3.15 from 32bit builds.
• 904db40 Build: Update cibuildwheel to include Py3.15.
• Additional commits viewable in compare view

Updates numpy from 2.5.1 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Abhijeetsingh Meena +
• Charalampos Stratakis
• Charles Harris
• Chris Ninham +
• David Woods
• Geonho +
• Gopu Yeshwanth Reddy +
• Iason Krommydas
• Ijtihed Kilani
• Jelle Zijlstra +
• Joren Hammudoglu
• Kumar Aditya
• Mike Boyle
• Nathan Goldbaum
• Raghuveer Devulapalli
• Sebastian Berg

... (truncated)

Commits

• 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
• ecf599c Merge pull request #32221 from charris/backport-32151
• 3c7ac97 Merge pull request #32220 from charris/backport-32205
• 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
• 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
• c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
• 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
• d8262bc MAINT: Update cibuildwheel to v4.2.0
• 988d94d Merge pull request #32158 from charris/backport-32133
• b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
• Additional commits viewable in compare view

Updates protobuf from 7.35.1 to 7.36.0

Commits

• See full diff in compare view

Updates pyzmq from 27.1.0 to 27.2.0

Release notes

Sourced from pyzmq's releases.

v27.2.0

See release notes, or pyzmq on PyPI.

Install with:

pip install 'pyzmq==27.2.0'

Commits

• c6bc8f2 Bump to 27.2.0
• 326d7d9 Merge pull request #2213 from minrk/2721
• cfcb1e0 changelog for 27.2
• 5e1bb1e Merge pull request #2212 from minrk/curve_keygen
• cd64002 add zmq.curve_keygen cli entrypoint
• 16891f2 Merge pull request #2211 from minrk/libsodium-1022
• 9e8cef1 put instructions in a comment
• 6652ccf bundle libsodium 1.0.22
• 95b77e1 Merge pull request #2183 from jorenham/typing/error/coverage
• 9c18dcb Merge pull request #2210 from zeromq/dependabot/pip/tools/cibuildwheel-eq-4.2...
• Additional commits viewable in compare view

Updates scipy from 1.18.0 to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

• Name (commits)
• Wasim Akram (2) +
• Jake Bowhay (1)
• Michael Bratsch (1)
• Dietrich Brunn (1)
• Evgeni Burovski (1)
• Aadya Chinubhai (1)
• Lucas Colley (3)
• Tekin Ertekin (1) +
• Fuyugithub (2) +
• Ralf Gommers (11)
• Joren Hammudoglu (1)
• Ijtihed Kilani (1) +
• Andrew Nelson (2)
• Ilhan Polat (1)
• Tyler Reddy (39)
• romao05 (1) +
• Michael Simacek (1) +
• Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits

• e4e854e REL: SciPy 1.18.1 rel commit
• 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
• 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
• 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
• a717e28 DOC: PR 25884 revisions
• bb489c0 DOC: PR 25884 revisions
• 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
• 095fe56 DOC, BLD: PR 25884 revisions
• e66ea64 DOC: update minimum GCC version in toolchain roadmap
• c021653 TST: tolerance bumps and skips on 32-bit platforms
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions