Bump autograd from 1.8.0 to 1.9.0

[dependabot]

Bumps autograd from 1.8.0 to 1.9.0.

Release notes

Sourced from autograd's releases.

v1.9.0

Autograd v1.9.0

23 June 2026, released on PyPI on 26 June 2026

We are happy to announce the Autograd v1.9.0 release. It brings broader NumPy 2.x and Python compatibility, several gradient correctness fixes, and better integration with array-like containers such as xarray's DataArray.

This release supports both NumPy 1.x and 2.x. Python versions 3.10 through 3.14 are supported. We have dropped support for Python 3.9, which is now end of life (#748).

Features and general enhancements

• Improved integration with NumPy ufuncs and array-like containers, making it possible to differentiate through xarray.DataArrays that hold ArrayBoxes (#717, #716).
• Added a 'same' mode for scipy.signal.convolve, including its forward pass and VJP (#721).

Bug fixes

• np.where now preserves native Python types instead of promoting them to float64 (#779, fixes #671).
• Fixed np.mean, np.std, np.var, and linalg.norm failing when passed a list or tuple containing ArrayBox objects (#757).
• Added the missing VJP for np.astype, which was introduced in NumPy 2.0 (#714).
• Added the missing JVP for np.conjugate (#713).
• Fixed np.absolute gradients so they handle the division-by-zero case the same way np.abs already did (#712).
• Registered np.empty_like and np.full_like as non-differentiable functions so they pass through tracing cleanly (#710).
• Fixed linalg.norm VJP and JVP for complex numbers (#705, fixes #666).

Maintenance

• Adopted PEP 639 for license metadata and dropped the now-redundant license trove classifier (#783, #787).
• Followed PEP 765 (#740).

Miscellaneous

• Security hardening: added a Dependabot config for GitHub Actions, added Zizmor as a CI job, and pinned and updated pre-commit hooks (#785).
• Added exclude-newer = "3 days ago" to guard against supply-chain attacks during dependency resolution (#775).
• Replaced the retired macos-13 CI image with macos-15-intel (#747).
• Removed the outdated in-tree conda package recipe (#784).

Documentation

• Added a tutorial on working with xarray.DataArrays (#782).
• Added an examples section with a matplotlib dependency, and tidied up the existing examples (#756, #720).
• Updated the README and fixed the instructions for running a specific test (#704, #702, #711).

---

New contributors

• @​jeremy-feng made their first contribution in HIPS/autograd#704
• @​danra made their first contribution in HIPS/autograd#705
• @​jvansanten made their first contribution in HIPS/autograd#720
• @​Schefflera-Arboricola made their first contribution in HIPS/autograd#740

... (truncated)

Commits

• 7c6a626 Release v1.9.0 (#786)
• 8537a19 Drop license trove classifier (#787)
• 9c76a7a Add a tutorial about working with xarray.DataArrays (#782)
• b76143b Security hardening (#785)
• 3220927 Comply with PEP 639 (#783)
• 9c36bd2 Drop outdated conda package recipe (#784)
• b2fc265 Improve autograd integration with ufuncs and array-like containers (#717)
• 4ec9753 Map multiple names of the same object to the same wrapped object (#716)
• c7e1e99 chore: update pre-commit hooks (#781)
• db0b226 Overwrite where to preserve native Python types (#779)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)