chore(deps): bump the python group across 1 directory with 6 updates

[dependabot]

Bumps the python group with 6 updates in the /infra/containers/sandbox directory:

Package	From	To
ipython	9.15.0	9.17.0
lxml	6.1.1	6.1.2
matplotlib	3.10.7	3.10.9
pypdf	6.15.0	6.16.2
pypdfium2	5.12.1	5.13.0
reportlab	5.0.0	5.0.1

Updates ipython from 9.15.0 to 9.17.0

Commits

• 3278f6f release 9.17.0
• 40cfb95 Update what's new for 9.17
• 2ed42ae Fix RST formatting in display_functions.py
• a487a06 change emojis
• 7f0ee55 Declare IPython's built-in magics lazily
• ee02392 Only run the psutil-free kitty detection test where /proc exists
• af386cf Annotate _find_dunder and put measured numbers in the whatsnew
• b7509b6 Add a whatsnew entry for the second startup pass
• a42fdc0 Defer mimetypes, locale, glob and runpy to their use sites
• cab037e Detect the kitty graphics protocol without importing psutil
• Additional commits viewable in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

Commits

• f2874e9 Update release date.
• 687a295 Build: Exclude Py3.8 from windows-arm builds.
• acadc56 Build: Remove outdated build target.
• 59f93eb Build: Split old-Linux and other-Py3.8 builds.
• 923df83 Build: Fix manylinux2014 build.
• 975cc83 Build: Fix Px3.8 build setup.
• 09e5d3e Build: Fix cibuildwheel version.
• 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
• 5567037 Build: Exclude Py3.15 from 32bit builds.
• 904db40 Build: Update cibuildwheel to include Py3.15.
• Additional commits viewable in compare view

Updates matplotlib from 3.10.7 to 3.10.9

Release notes

Sourced from matplotlib's releases.

v3.10.9

This is a micro release of the v3.10.x series. Highlights of this release include:

• Various minor bug and doc fixes
• Security hardening validation of cyclers - Removing eval usage
• Security hardening in Latex and PS calls - Removing shell escapes

REL: v3.10.8

This is a bugfix release in the 3.10.x series.

The primary highlights of this release are:

• Properly allow freethreaded mode in the MacOS backend
• Better error handling for MacOS backend

Commits

• dd8d78b REL: v3.10.9
• 2fb1891 REL: Release prep v3.10.9
• d0e923a Merge branch 'v3.10.8-doc' into v3.10.x
• 1637932 Merge pull request #31558 from meeseeksmachine/auto-backport-of-pr-31556-on-v...
• a83faac Backport PR #31556: FIX: Inverted PyErr_Occurred check in enum type caster (_...
• a4f57ab Merge pull request #31545 from ksunden/backport-of-pr-31282-on-v3.10.x
• 063288d Merge pull request #31544 from ksunden/backport-of-pr-31248-on-v3.10.x
• b2ed196 Backport PR #31248: SEC: Remove eval() from validate_cycler
• acc6024 Merge pull request #31282 from scottshambaugh/tex_no_shell
• e3fb541 Merge pull request #31078 from meeseeksmachine/auto-backport-of-pr-31075-on-v...
• Additional commits viewable in compare view

Updates pypdf from 6.15.0 to 6.16.2

Release notes

Sourced from pypdf's releases.

Version 6.16.2, 2026-08-23

What's new

Bug Fixes (BUG)

• Make remove_from_tree() work on outline items (#3939) by @​RISHIKKASULA
• Be more lenient about space width in layout mode text extraction (#3992) by @​PJBrs
• Do not scale the text leading by the font size (#3987) by @​matthewkogan
• Update annotation appearance stream matrix on page transform (#3968) by @​BashfulHippo
• Allow repeated page references (#3959) by @​yuming-long

Robustness (ROB)

• Improve RC4 fallback when cryptography can't provide it (#3853) by @​msylw

Full Changelog

Version 6.16.1, 2026-08-14

What's new

Security (SEC)

• Limit iterations for outline retrieval and XForm text extraction (#3966) by @​stefan6419846

Full Changelog

Version 6.16.0, 2026-08-13

What's new

Security (SEC)

• Detect cycles in TreeObject.insert_child (#3964) by @​stefan6419846

New Features (ENH)

• AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#3917) by @​PJBrs
• AppearanceStream: Consider more encodings for Type1 core fonts (#3905) by @​PJBrs

Performance Improvements (PI)

• Build /ToUnicode source-code bytes directly in parse_bfrange (#3952) by @​Anai-Guo

Bug Fixes (BUG)

• Preserve internal Link annotations when appending/merging (#3953) (#3954) by @​Anai-Guo
• Fix false inline image end markers (#3922) by @​ciphercom
• Reject typeless non-page /Kids entries in strict mode (#3955) by @​Anai-Guo
• Apply character spacing (Tc) per glyph in layout-mode extraction (#3951) by @​Anai-Guo
• Keep the Adobe CMYK inversion when an explicit /Decode is present (#3943) by @​RavSinghChandan

Robustness (ROB)

• AppearanceStream: Only escape parentheses for 8-bit fonts (#3961) by @​PJBrs
• Recover the trailer from a cross-reference stream when rebuilding the xref (#3950) by @​Anai-Guo

Maintenance (MAINT)

• Deduplicate CatalogAttributes and CatalogDictionary (#3940) by @​j-t-1

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.16.2, 2026-08-23

Bug Fixes (BUG)

• Make remove_from_tree() work on outline items (#3939)
• Be more lenient about space width in layout mode text extraction (#3992)
• Do not scale the text leading by the font size (#3987)
• Update annotation appearance stream matrix on page transform (#3968)
• Allow repeated page references (#3959)

Robustness (ROB)

• Improve RC4 fallback when cryptography can't provide it (#3853)

Full Changelog

Version 6.16.1, 2026-08-14

Security (SEC)

• Limit iterations for outline retrieval and XForm text extraction (#3966)

Full Changelog

Version 6.16.0, 2026-08-13

Security (SEC)

• Detect cycles in TreeObject.insert_child (#3964)

New Features (ENH)

• AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#3917)
• AppearanceStream: Consider more encodings for Type1 core fonts (#3905)

Performance Improvements (PI)

• Build /ToUnicode source-code bytes directly in parse_bfrange (#3952)

Bug Fixes (BUG)

• Preserve internal Link annotations when appending/merging (#3953) (#3954)
• Fix false inline image end markers (#3922)
• Reject typeless non-page /Kids entries in strict mode (#3955)
• Apply character spacing (Tc) per glyph in layout-mode extraction (#3951)
• Keep the Adobe CMYK inversion when an explicit /Decode is present (#3943)

Robustness (ROB)

• AppearanceStream: Only escape parentheses for 8-bit fonts (#3961)
• Recover the trailer from a cross-reference stream when rebuilding the xref (#3950)

Maintenance (MAINT)

• Deduplicate CatalogAttributes and CatalogDictionary (#3940)

Code Style (STY)

• Type pages as a Sequence rather than a list (#3957)

... (truncated)

Commits

• 1da0987 REL: 6.16.2
• f6853cc BUG: Make remove_from_tree() work on outline items (#3939)
• c6d38af BUG: Type character widths as float (#3996)
• 882b3b2 STY: Type the XMP stream as StreamObject rather than ContentStream (#3995)
• 4c8f707 STY: Accept any sequence of fit arguments in Fit (#3990)
• 2450321 STY: Accept any sequence as the annotation border (#3991)
• 2dcab8d MAINT: Skip test_appearance_stream_rtl when RTL support is unavailable (#3993)
• 412975a BUG: Be more lenient about space width in layout mode text extraction (#3992)
• ddbfea9 BUG: Interpolate the reader in the reset_translation error message (#3981)
• c646ef2 ROB: Improve RC4 fallback when cryptography can't provide it (#3853)
• Additional commits viewable in compare view

Updates pypdfium2 from 5.12.1 to 5.13.0

Release notes

Sourced from pypdfium2's releases.

5.13.0

Release 5.13.0

Summary

• Experimental pyemscripten_2026_0_wasm32 (Pyodide) build support added. However, the resulting builds are flaky at runtime and subject to various types of random crashes. Freezes on shutdown have also been observed. While these issues persist, PyEmscripten wheels will not be uploaded to PyPI, but they are included in the release process and can be downloaded from GitHub on an experimental basis. If you can help track down and fix these issues, please reach out. Note: Our PyEmscripten wheels are bigger than usual, as they are built with debug symbols (a non-debug build is not considered useful at this stage).
• Fixed compatibility with Python 3.6 and 3.7.
  • Runtime support was inadvertently broken due to a faulty cached property backport which held only one cache per class, not per instance as should have been. The accidental loss of caches broke key assumptions of our autoclose logic, which relies on cached_property since 5.8.0. (Earlier versions that did not make extensive use of cached properties might work but have not been explicitly tested.)
  • This release replaces both functools.cached_property and the faulty functools.lru_cache() based backport with our own, backward compatible cached_property implementation along with thorough documentation.
  • Also, fixed setup (i.e. source installation) with Python 3.6 and its max available setup dependency versions (that is, setuptools 59). This had probably been broken for a long time. (A few non-breaking issues remain, e.g. for some reason we end up with a purelib directory, but it should be platlib.)
  • Bear in mind that ctypesgen continues to require Python >=3.8 at this time (3.6 compat not being a priority in that case), but you can install with --no-build-isolation and let the reference bindings be used, or try adding ctypesgen's src/ to PYTHONPATH to bypass setup, and see how it goes.
  • Note: We do not plan to (and practically cannot) keep up compatibility with outdated Python versions indefinitely. In particular, setup compatibility may be dropped sooner or later in favor of contemporary Python packaging concepts, like migrating as much as possible to pyproject.toml. That said, we are happy to restore compatibility at this point, and fix any unintentional breakage.
• Fixed MANIFEST.in missing Windows spoof headers, which resulted in subtly incorrect bindings when installing from an sdist on Windows, as seen in test failures. (Release wheels have been unaffected and passed the test suite, so this issue went unnoticed for a while.)
• Bumped gn-dist from 2407.1 to 2407.3. Made its setup python 3.6 compatible likewise (wheels should have worked before now). Changed versioning and release process so that CI no longer needs to push to the repository (may eventually become a blueprint for pypdfium2 itself). More documentation added, including manylinux2014 POC.
• Internal improvements (non-exhaustive):
  • Properly clean up *.egg-info/ and build/ before packaging, to avoid mad file inclusion bugs (ran into this while working on setup include rules).
  • Migrated from requirements files to PEP 735 dependency groups (pyproject.toml). Recent enough pip should be available to Python >= 3.9. For compatibility with older versions, feel free to use ./utils/misc/install_dep_group.py.
  • Applied dependency cooldowns to internal callers of pip install. Always use virtual environments in CI. Use lockfiles in sensitive areas (e.g. publish jobs).
  • Rearranged & improved utilities. Cleaner distinction between setupsrc/ and utils/.
  • Work around persistent i686 container network issues by downgrading host runner to ubuntu-24.04.
  • Let setupsrc/ share code from src/ through a pypdfium2_cfg._shared submodule that can be added to sys.path.

Build info

This release was made with the following build strategies:

• PBIN: [macosx_arm64, macosx_x86_64, win_amd64, win_arm64, win32, manylinux_x86_64, manylinux_i686, manylinux_aarch64, manylinux_armv7l, manylinux_ppc64le, manylinux_mips64le, android_arm64_v8a, android_armeabi_v7a]
• SBLD: [manylinux_mipsle]
• CIBW: [manylinux_riscv64, manylinux_loongarch64, manylinux_s390x, musllinux_x86_64, musllinux_aarch64, musllinux_armv7l, musllinux_i686, musllinux_ppc64le, musllinux_s390x, musllinux_riscv64, musllinux_loongarch64, pyodide_wasm32]

[!CAUTION] The following builds are affected by known, major issues (e.g. endianness bugs, crashes, freezes) and are NOT considered ready for production use: [manylinux_s390x, musllinux_s390x, pyodide_wasm32]

Commit logs

Commits between 5.12.1 and 5.13.0 (latest commit first):

• a4659102 [autorelease main] update 5.13.0
• 9094de35 continue on changelog/docs
• b89e367a git_net_additions.py: minor tweaks
• 57157e78 readme: don't overdo admonitions
• 033d5ce0 changelog: less waffle
• 5afbd619 install_buildtools: use compat function for dependency group

... (truncated)

Commits

• a465910 [autorelease main] update 5.13.0
• 9094de3 continue on changelog/docs
• b89e367 git_net_additions.py: minor tweaks
• 57157e7 readme: don't overdo admonitions
• 033d5ce changelog: less waffle
• 5afbd61 install_buildtools: use compat function for dependency group
• 3282e36 Add zizmor to check step
• 07b84aa Progress changelog
• 6ec38d2 git_net_additions: further improve fallback
• b5cdd7c git_net_additions: fancier fallback for binary files
• Additional commits viewable in compare view

Updates reportlab from 5.0.0 to 5.0.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions