[Bot] Update dependencies (#2939)

* Update dependencies

* fix: older pip for graalpy on Windows

The dependency update regenerated the constraints and dropped the pip
hold-back for GraalPy on Windows, where newer pip breaks. Restore the
marker-based pin.

Assisted-by: ClaudeCode:claude-opus-4.8

* ci: keep graalpy pip workaround across dependency bumps

update_constraints now re-applies the GraalPy Windows pip hold-back after
uv pip compile, so the bot no longer wipes it each run. Target only the
Python versions that ship a GraalPy config (3.12), derived from
build-platforms.toml; drop the stale pin from the 3.11 constraints.

Assisted-by: ClaudeCode:claude-opus-4.8

* fix(macos): accept .tar.gz PyPy archives

PyPy switched its macOS downloads from .tar.bz2 to .tar.gz, which tripped
the hard-coded extension assert in install_pypy. Accept both.

Assisted-by: ClaudeCode:claude-opus-4.8

* ci: hold filelock back for graalpy

filelock >=3.30 imports errno.ENOTSUP, which GraalPy lacks, so virtualenv
fails on GraalPy. Hold it at 3.29.4 for GraalPy until the upstream fix
ships (~2026-08), reusing the update_constraints workaround mechanism.

Assisted-by: ClaudeCode:claude-opus-4.8

* ci: bump filelock for graalpy

* revert android cp315 update

see https://github.com/pypa/cibuildwheel/pull/2933#issuecomment-4821042715

---------

Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>

noxfile.py

@@ -16,9 +16,11 @@ See sessions with `nox -l`
 """
 
 import os
+import re
 import shutil
 import sys
 from pathlib import Path
+from typing import Any
 
 import nox
 
@@ -63,6 +65,52 @@ def tests(session: nox.Session) -> None:
         session.run("pytest", "test", "-x", "--durations", "0", "--timeout=2400", "test")
 
 
+# Packages held back for GraalPy until upstream fixes land. uv pip compile
+# can't express a per-implementation split, so the compiled pin is patched:
+# GraalPy (matching `graalpy_marker`) gets `held`, everything else
+# (`other_marker`) tracks the freshly compiled version.
+GRAALPY_HELD_BACK = (
+    # Newer pip breaks GraalPy on Windows.
+    {
+        "package": "pip",
+        "held": "26.0.1",
+        "graalpy_marker": 'implementation_name == "graalpy" and platform_system == "Windows"',
+        "other_marker": 'implementation_name != "graalpy" or platform_system != "Windows"',
+    },
+    # filelock >=3.30 imports errno.ENOTSUP, which GraalPy lacks (fix due ~2026-08).
+    {
+        "package": "filelock",
+        "held": "3.29.7",
+        "graalpy_marker": 'implementation_name == "graalpy"',
+        "other_marker": 'implementation_name != "graalpy"',
+    },
+)
+
+
+def _pin_graalpy_workarounds(output_file: Path) -> None:
+    text = output_file.read_text()
+    for pin in GRAALPY_HELD_BACK:
+        package = re.escape(pin["package"])
+        text = re.sub(
+            rf"^{package}==(?P<version>[^\s;]+)$",
+            f"{pin['package']}==\\g<version>; {pin['other_marker']}\n"
+            f"{pin['package']}=={pin['held']}; {pin['graalpy_marker']}",
+            text,
+            flags=re.MULTILINE,
+        )
+    output_file.write_text(text)
+
+
+def _graalpy_python_versions(build_platforms: dict[str, Any]) -> set[str]:
+    """Python minor versions (e.g. "3.12") that ship a GraalPy configuration."""
+    return {
+        ".".join(config["version"].split(".")[:2])
+        for platform in build_platforms.values()
+        for config in platform["python_configurations"]
+        if config["identifier"].startswith("gp")
+    }
+
+
 @nox.session(default=False, tags=["update"])
 def update_constraints(session: nox.Session) -> None:
     """
@@ -79,6 +127,9 @@ def update_constraints(session: nox.Session) -> None:
     env = os.environ.copy()
     env["UV_CUSTOM_COMPILE_COMMAND"] = f"nox -s {session.name}"
 
+    build_platforms = nox.project.load_toml(resources / "build-platforms.toml")
+    graalpy_versions = _graalpy_python_versions(build_platforms)
+
     for minor_version in range(9, 16):
         python_version = f"3.{minor_version}"
         output_file = resources / f"constraints-python{python_version.replace('.', '')}.txt"
@@ -92,13 +143,14 @@ def update_constraints(session: nox.Session) -> None:
             f"--output-file={output_file}",
             env=env,
         )
+        if python_version in graalpy_versions:
+            _pin_graalpy_workarounds(output_file)
 
     shutil.copyfile(
         resources / "constraints-python315.txt",
         resources / "constraints.txt",
     )
 
-    build_platforms = nox.project.load_toml(resources / "build-platforms.toml")
     pyodides = build_platforms["pyodide"]["python_configurations"]
     for pyodide in pyodides:
         python_version = ".".join(pyodide["version"].split(".")[:2])