chore(deps): weekly safe pypi updates · 3 packages

[mendral-app]

Packages bumped

Package	Old	New	Published
aiohttp	3.14.1	3.14.3	2026-07-23
imageio	2.37.0	2.37.4	2026-07-20
bokeh	3.9.1	3.9.2	2026-07-25

Per-package detail

aiohttp 3.14.1 → 3.14.3

• Fixes client dropping first Authorization/Cookie/Proxy-Authorization header on cross-origin redirect (#13180)
• Fixes error message construction in C HTTP parser (#13222)
• Fixes StreamResponse.last_modified rounding with fractional seconds (#5303)
• Fixes resolving localhost on Windows without active network (#5357)
• Rejects multipart body parts whose Content-Length exceeds limit
• Used in Jupyter hub for async HTTP — no impact (bug fixes only, no API changes)

imageio 2.37.0 → 2.37.4

• Sets filename parameter of FileNotFoundError (#922)
• Gracefully handles invalid EXIF orientation in Pillow plugin (#1159)
• Prevents OverflowError for FPS in pyav plugin (#1121)
• Fixes ffmpeg plugin not loading files with carets (#1135)
• Used for image I/O in data science hub — no impact (bug fixes only)

bokeh 3.9.2

• Fixes authentication not working with prefix in server (#11991)
• Fixes theme not applied to json_item plots (#12160)
• Fixes scientific precision not updating when zooming (#15063)
• Hardens WebSocket token signature verification (#15125)
• Multiple UI/rendering bugfixes for plots and widgets
• Used for interactive visualization in Jupyter hub — no impact (fixes only, no breaking changes)

Files modified

• hub/jupyter-server/requirements.txt

Skipped this ecosystem

Package	Current	Latest eligible	Reason
numpy	1.26.4	2.5.1	Pinned: blocked by gensim (requires numpy <2)
scipy	1.13.1	1.18.0	Pinned: blocked by gensim
pandas	2.2.3	3.0.3	Pinned: requires numpy ≥2
matplotlib	3.10.3	3.11.1	Risky: removes get_cmap(), plot_date(), boxplot param changes
numba	0.61.2	0.66.0	Risky: 5-version jump, tight LLVM coupling
textblob	0.19.0	0.20.1	Risky: minor bump in 0.x series
fastapi	0.111.0	0.140.7	Risky: 29 minor versions jump
uvicorn	0.30.1	0.51.0	Risky: 20 minor versions jump
websockets	12.0	16.1.1	Risky: 4 major versions jump
orjson	3.10.18	3.11.9	Covered by open PR #251
beautifulsoup4	4.13.4	4.15.0	Covered by open PR #251
requests	2.32.4	2.34.2	Covered by open PR #251
spacy	3.8.2	3.8.14	Covered by open PR #251
opencv-python	4.11.0.86	5.0.0.93	Major version bump
ipykernel	6.29.5	7.3.0	Major version bump
pytest	8.3.5	9.1.1	Major version bump
seaborn	0.13.2	0.13.2	Already at latest
tornado	6.5.7	6.5.7	Already at latest
scikit-learn	1.9.0	1.9.0	Already at latest
scikit-image	0.26.0	0.26.0	Already at latest
pydantic	2.13.4	2.13.4	Already at latest stable
httpx	0.28.1	0.28.1	Already at latest stable

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session