Bump the pip-minor-and-patch group with 2 updates

[dependabot]

Bumps the pip-minor-and-patch group with 2 updates: numpy and scipy.

Updates numpy from 2.4.6 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates scipy from 1.17.1 to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

• Name (commits)
• Wasim Akram (2) +
• Jake Bowhay (1)
• Michael Bratsch (1)
• Dietrich Brunn (1)
• Evgeni Burovski (1)
• Aadya Chinubhai (1)
• Lucas Colley (3)
• Tekin Ertekin (1) +
• Fuyugithub (2) +
• Ralf Gommers (11)
• Joren Hammudoglu (1)
• Ijtihed Kilani (1) +
• Andrew Nelson (2)
• Ilhan Polat (1)
• Tyler Reddy (39)
• romao05 (1) +
• Michael Simacek (1) +
• Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

SciPy 1.18.0 Release Notes

SciPy 1.18.0 is the culmination of 6 months of hard work. It contains many new features, numerous bug-fixes, improved test coverage and better documentation. There have been a number of deprecations and API changes in this release, which are documented below. All users are encouraged to upgrade to this release, as there are a large number of bug-fixes and optimizations. Before upgrading, we recommend that users check that their own code does not use deprecated SciPy functionality (to do so, run your code with python -Wd and check for DeprecationWarning s).

... (truncated)

Commits

• e4e854e REL: SciPy 1.18.1 rel commit
• 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
• 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
• 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
• a717e28 DOC: PR 25884 revisions
• bb489c0 DOC: PR 25884 revisions
• 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
• 095fe56 DOC, BLD: PR 25884 revisions
• e66ea64 DOC: update minimum GCC version in toolchain roadmap
• c021653 TST: tolerance bumps and skips on 32-bit platforms
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.