build(deps): bump the pip-dependencies group across 1 directory with 3 updates

[dependabot]

Updates the requirements on matplotlib, requests and scrapy to permit the latest version.
Updates matplotlib to 3.11.2

Release notes

Sourced from matplotlib's releases.

REL: v3.11.2

This is the second bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Speed up RGBA-stage image resampling
• Fix hexbin clipping in PDF output
• Fix \text with internal braces
• Fix some crashes and make some checks more robust to unlikely cases
• Fix frame skew when saving GIF animations with PillowWriter
• Fix HiDPI handling in Qt toolbar and WebAgg embeddings
• Fix ResizeEvent handling for TextBox
• Fix bug with PGF hatch linewidth and color
• Fix a bug with drawing an empty Collection
• Fix incorrect glyphs in Cairo backends
• Improve build system to prevent conflicts between wheels and system libraries

Commits

• d3ca917 REL: v3.11.2
• b76fea9 DOC: Set current version to 3.11.2
• 39c7f06 DOC: Prepare GitHub stats for 3.11.2
• 5dd13e3 Merge branch 'v3.11.1-doc' into release-3.11.2
• aa484be Merge branch 'v3.11.0-doc' into v3.11.1-doc
• 0e10f83 Merge pull request #32330 from meeseeksmachine/auto-backport-of-pr-32324-on-v...
• ebe947b Backport PR #32324: Don't force any diagnostics to be errors in bundled Harfbuzz
• 8f4b7c5 Merge pull request #32322 from meeseeksmachine/auto-backport-of-pr-32321-on-v...
• 93278ad Backport PR #32321: DOC: correct note about PyOS_InputHook
• b0aee78 Merge pull request #32319 from meeseeksmachine/auto-backport-of-pr-32305-on-v...
• Additional commits viewable in compare view

Updates requests to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates scrapy to 2.19.0

Release notes

Sourced from scrapy's releases.

2.19.0

• New RemoteControl extension which allows inspecting and controlling a running crawl over HTTP, used by the Scrapy MCP server
• Experimental aiohttp-based download handler (now the default when running without a reactor)

Full Changelog

Changelog

Sourced from scrapy's changelog.

Scrapy 2.19.0 (2026-09-10)

Highlights:

• New RemoteControl extension which allows inspecting and controlling a running crawl over HTTP, used by the :ref:Scrapy MCP server <using-mcp-server>

• Experimental aiohttp-based download handler (now the default when running without a reactor)

Modified requirements

-   Added support for Python 3.15.
    (:gh:`7511`)


New dependencies:


aiohttp_ >= 3.13.3


charset-normalizer_ >= 3.4.0


platformdirs_ >= 2.0.0


(:gh:7866, :gh:8054)


Backward-incompatible changes

• When running :ref:without a Twisted reactor <asyncio-without-reactor>, i.e. with :setting:TWISTED_REACTOR_ENABLED set to False, the default download handler for http and https is now :class:~scrapy.core.downloader.handlers._aiohttp.AiohttpDownloadHandler instead of :class:~scrapy.core.downloader.handlers._httpx.HttpxDownloadHandler. You can configure :class:~scrapy.core.downloader.handlers._httpx.HttpxDownloadHandler in the :setting:DOWNLOAD_HANDLERS setting if you want. (:gh:8118)

• scrapy.http.cookies.WrappedRequest.is_unverifiable() now always returns False, and the undocumented is_unverifiable request meta key that it used to read is ignored. (:gh:7933)

Deprecations

</tr></table> 

... (truncated)

Commits

• 8026dee Bump version: 2.18.0 → 2.19.0
• b1f1cba Release notes for 2.19.0 (#8124)
• a410975 Fix LocalCache evicting a different key when updating an existing key (#8113)
• 41c3f3e Add AiohttpDownloadHandler and switch reactorless to it (#8118)
• 20dcf82 Implement some idioms from newer Python versions. (#8123)
• 3fd2a40 Agents docs page. (#8120)
• 6995549 Exclude news and contributing from llms-full.txt only (#8119)
• 6057f02 Expose HTTP cache storage timestamp via the cache_timestamp meta key (#8034)
• 1d5fa5a Include bind address in HTTP/1.1 and HTTP/2 pool keys (#8081)
• 544f4d2 Fix missing certificate and IP address on HTTP/1.1 responses without a body (...
• Additional commits viewable in compare view

[Copilot]

Copilot review overview

🟡 Changes recommended

The dependency updates have unresolved compatibility concerns.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: None

What changed in this PR

Updates minimum versions of Matplotlib, Requests, and Scrapy.

Changes:

• Raises dependency floors in requirements.txt.
• Raises the Matplotlib floor for chart tooling.

File	Description
requirements.txt	Updates Matplotlib, Requests, and Scrapy constraints.
charts/​requirements.txt	Updates the Matplotlib constraint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.