fix(deps): update dependency xgboost to >=3.4,<3.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
xgboost	>=3.2,<3.3 → >=3.4,<3.5

---

Release Notes

dmlc/xgboost (xgboost)

v3.4.1: 3.4.1 Patch Release

Compare Source

What's Changed

• [jvm] Fix batch predict for SparseVector features (#​12347)
• Fix model slicing with category container. (#​12462)

Full Changelog: dmlc/xgboost@v3.4.0...v3.4.1

Additional artifacts

You can verify the downloaded packages by running the following command on your Unix shell:

echo "<hash> <artifact>" | shasum -a 256 --check

34a5cb99a67bb98b44f204767eeeae642b65a86b2ecfca60082e4d74fd4d169a  xgboost-src-3.4.1.tar.gz
2514d394f989d6e990e67898d7f5e530c7c1867222c497ea454ffc18a31cb096  xgboost_r_gpu_linux.tar.gz

Experimental binary packages for R with CUDA enabled

• xgboost_r_gpu_linux.tar.gz: Download

Source tarball

• xgboost-src-3.4.1.tar.gz: Download

v3.4.0: Release 3.4.0 stable

Compare Source

Release notes

https://xgboost.readthedocs.io/en/latest/changes/v3.4.0.html

Additional artifacts

You can verify the downloaded packages by running the following command on your Unix shell:

echo "<hash> <artifact>" | shasum -a 256 --check

af4588b34c7fa1bfde258006beebbe181454f1fb74266f81883b23059af3b9fb  xgboost-src-3.4.0.tar.gz
8feb5a559cd869e9c9b8ed1a60475c34b7ba689c6f7b9c41dc9ba16fae4d19fe  xgboost_r_gpu_linux.tar.gz

Experimental binary packages for R with CUDA enabled

• xgboost_r_gpu_linux.tar.gz: Download

Source tarball

• xgboost-src-3.4.0.tar.gz: Download

v3.3.0: Release 3.3.0 stable

Compare Source

Release notes

https://xgboost.readthedocs.io/en/latest/changes/v3.3.0.html

Additional artifacts:

You can verify the downloaded packages by running the following command on your Unix shell:

echo "<hash> <artifact>" | shasum -a 256 --check

22d4fba822fba5cd02299bf0c63ec68ff72606bc1b1bd910423d4b83c2f108ff  xgboost-src-3.3.0.tar.gz
df276bf14ebda98319da70fa88874746d9275ffbcde77e18e171d809cdbda86a  xgboost_r_gpu_linux.tar.gz

Experimental binary packages for R with CUDA enabled

• xgboost_r_gpu_linux.tar.gz: Download

Source tarball

• xgboost-src-3.3.0.tar.gz: Download

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock

Command failed: uv lock --upgrade-package xgboost --upgrade-package xgboost --upgrade-package xgboost
Using CPython 3.13.15 interpreter at: /opt/containerbase/tools/python/3.13.15/bin/python3
   Building tensorrt-cu13-libs==10.16.1.11
      Built tensorrt-cu13-libs==10.16.1.11
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version == '3.11.*' and platform_machine != 's390x'):
  ╰─▶ Because the requested Python version (>=3.10, <3.14) does not satisfy
      Python>=3.12 and xgboost>=3.4.0 depends on Python>=3.12, we can conclude
      that xgboost>=3.4.0 cannot be used.
      And because modelaudit[all] depends on xgboost>=3.4 and your project
      requires modelaudit[all], we can conclude that your project's
      requirements are unsatisfiable.

hint: While the active Python version is 3.13, the resolution failed for other Python versions supported by your project. Consider limiting your project's supported Python versions using `requires-python`.
hint: The `requires-python` value (>=3.10, <3.14) includes Python versions that are not supported by your dependencies (e.g., xgboost>=3.4.0 only supports >=3.12). Consider using a more restrictive `requires-python` value (like >=3.12).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 033198f986

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep all-ci installable on Python 3.10/3.11

This bumps the all-ci extra to xgboost>=3.4,<3.5, but the current matching PyPI release, xgboost 3.4.0, declares Requires-Python: >=3.12 (https://pypi.org/pypi/xgboost/3.4.0/json). On the Python 3.10/3.11 lanes that run uv sync --extra all-ci (for example .github/workflows/test.yml:355-380), resolution becomes unsatisfiable; use Python-version markers or retain a compatible xgboost bound for older supported Pythons.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Regenerate the root uv.lock

This changes the root xgboost constraints in pyproject.toml, but uv.lock still records xgboost as >=3.2,<3.3 for the all, all-ci, and xgboost extras (uv.lock:2651-2653). The dependency-change workflow runs uv lock --check for the root project (.github/workflows/test.yml:315-332), so this commit will fail the lock consistency job until the lockfile is regenerated with the same constraints.

Useful? React with 👍 / 👎.