pip dependency update: bump the visualization-dependencies group with 2 updates

[dependabot]

Bumps the visualization-dependencies group with 2 updates: plotly and matplotlib.

Updates plotly from 6.3.1 to 6.5.0

Release notes

Sourced from plotly's releases.

v6.5.0

Updated

• Update plotly.js from version 3.2.0 to version 3.3.0. See the plotly.js release notes for more information. [#5421]. Notable changes include:
  • Add hovertemplate for candlestick and ohlc traces [#7619]

Fixed

• Fix bug where numpy datetime contained in Python list was converted to integer [#5415]

Full Changelog: plotly/plotly.py@v6.4.0...v6.5.0

v6.4.0

Updated

• Update plotly.js from version 3.1.1 to version 3.2.0. See the plotly.js release notes for more information. [#5357]. Notable changes include:
  • Add hovertemplatefallback and texttemplatefallback attributes [#7577]
  • Add "SI extended" formatting rule for tick exponents on axis labels, allowing values to be displayed with extended SI prefixes (e.g., femto, pico, atto) [#7249]

Deprecated

• Deprecate create_hexbin_mapbox in favor of create_hexbin_map, update related function calls [5358], with thanks to @​ajlien for the contribution!

Changelog

Sourced from plotly's changelog.

[6.5.0] - 2025-11-17

Updated

• Update plotly.js from version 3.2.0 to version 3.3.0. See the plotly.js release notes for more information. [#5421]. Notable changes include:
  • Add hovertemplate for candlestick and ohlc traces [#7619]

Fixed

• Fix bug where numpy datetime contained in Python list was converted to integer [#5415]

[6.4.0] - 2025-11-02

Updated

• Update plotly.js from version 3.1.1 to version 3.2.0. See the plotly.js release notes for more information. [#5357]. Notable changes include:
  • Add hovertemplatefallback and texttemplatefallback attributes [#7577]
  • Add "SI extended" formatting rule for tick exponents on axis labels, allowing values to be displayed with extended SI prefixes (e.g., femto, pico, atto) [#7249]

Deprecated

• Deprecate create_hexbin_mapbox in favor of create_hexbin_map, update related function calls [5358], with thanks to @​ajlien for the contribution!

Commits

• b19f8e5 changelog formatting
• 1ec9a16 Update CHANGELOG.md
• 83a2b0b version changes for v6.5.0
• a49f495 Merge pull request #5421 from plotly/update-plotlyjs-3.3.0
• f687526 update plotly/labextension with files from ci
• 83ab425 update package-lock with new plotly.js
• a3480f0 package-lock indentation
• e519d5a update plotly.js to v3.3.0
• 22b0ac0 Merge pull request #5415 from plotly/fix-np-date-handling-issue
• aa30be5 Update _plotly_utils/basevalidators.py
• Additional commits viewable in compare view

Updates matplotlib from 3.8.0 to 3.10.8

Release notes

Sourced from matplotlib's releases.

REL: v3.10.8

This is a bugfix release in the 3.10.x series.

The primary highlights of this release are:

• Properly allow freethreaded mode in the MacOS backend
• Better error handling for MacOS backend

REL: v3.10.7

This is the latest bugfix release in the 3.10.x series.

The most important update in this release is that the minimum version of pyparsing has been updated to version 3.0.

REL: v3.10.6

This is a bugfix release in the 3.10.x series.

Highlights from this release include:

- Fix regression of hi-dpi support for Qt
- Fix race condition in TexManager.make_dvi & make_png
- Various documentation and other bugfixes

REL: v3.10.5

This is the fourth bugfix release of the 3.10.x series.

Included in this release is distributed wheels for Python 3.14 (including freethreaded) and Windows ARM.

There are also several smaller bugfixes.

REL: v3.10.3

This is the third bugfix release of the 3.10.x series

REL: v3.10.1

This is the first bugfix release of the 3.10.x series.

This release contains several bug-fixes and adjustments:

• Respect array alpha with interpolation_stage='rgba' in _Imagebase::_make_image
• Remove md5 usage to prevent issues on FIPS enabled systems
• Fix pyplot.matshow figure handling
• Fix modifying Axes' position also alters the original Bbox object used for initialization
• Fix title position for polar plots
• Add version gate to GTK4 calls when necessary
• Raise warning if both c and facecolors are used in scatter plot

As well as several documentation improvements and corrections.

... (truncated)

Commits

• 1392cbe REL: v3.10.8
• 0b9ebb3 Doc release prep v3.10.8
• bc7b5c4 Merge branch 'v3.10.7-doc' into v3.10.x
• 86b38d3 Github stats v3.10.8
• 9512188 Merge pull request #30717 from meeseeksmachine/auto-backport-of-pr-30714-on-v...
• d300769 Backport PR #30714: FIX: Gracefully handle numpy arrays as input to check_in_...
• 799bc95 Merge pull request #30711 from ngoldbaum/v3.10.x
• 134000b Merge pull request #30697 from ngoldbaum/fix-plotting-on-worker-threads
• 5b8e219 TST: Run macosx backends in a subprocess
• 878e71a Backport PR #29810: Declare free-threaded support in MacOS backend extension ...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.