Update bokeh requirement from <4,>=3.4.0 to >=3.9.1,<4

[dependabot]

Updates the requirements on bokeh to permit the latest version.

Changelog

Sourced from bokeh's changelog.

2026-06-04 3.9.1:

• bugfixes:

  • #14944 Document().to_json() is not JSON serializable
  • #13477 [component: docs] Dev docs no longer report precise version information
  • #15041 range_padding of y_range is not updated when changed via CustomJS
  • #7297 [component: bokehjs] Invert Colorbar Axis
  • #15004 [component: bokehjs] Cannot update min_border of figure with CustomJS callback
  • #14869 [component: bokehjs] BoxAnnotation shows resize cursor by default
  • #8787 [component: bokehjs] vline hover misses some multi-lines
  • #13838 [BUG] Using array/list in line_dash for hspan doesn't work
  • #13509 [component: bokehjs] [BUG] Incorrectly formatted ticks with %N format when time is older than the Epoch
  • #14665 [component: bokehjs] [bokeh-3.8.0.min.js:405] Uncaught (in promise) RangeError: Maximum call stack size exceeded
  • #14491 [component: bokehjs] Legends are not synced with glyph visibility state
  • #14741 [component: bokehjs] Possible regression in muting of legend entries since v3.7.0
  • #14856 [component: bokehjs] Patches hover tooltip triggers inside holes (hit-testing doesn't account for NaN-separated holes)
  • #14855 [component: bokehjs] Canvas Patch fill doesn't respect holes (nonzero fill rule instead of evenodd)
  • #15080 [component: bokehjs] Bokeh plot frame height does not update when changed via slider
  • #15015 [component: bokehjs] Update of num_minor_ticks does not trigger a visual update of the plot
  • #14907 NaT is encoded as float(nan) by the serializer
  • #15116 [component: docs] Documentation of enums is broken in 3.10 branch
  • #15131 [component: build] Release build failed for non pre-release version

• features:

  • #14411 Adding a performance mode

• tasks:

  • #14922 [component: docs] Update dev section of switcher.json after 3.9 release
  • #15054 [component: docs] Building documentation with BOKEH_DOCS_CDN=local raises SphinxError
  • #15022 [component: docs] Fix wrong formatted code block directives
  • #14878 [component: docs] Toopltips are broken if special characters are in the source.data keys
  • #14962 [component: docs] Document().models.freeze() not documented
  • #15098 [component: docs] Add missing link and fix example for tex() in figure class
  • #14961 [component: tests] Make it possible to run the Python unit test run in parallel
  • #15089 Backports for 3.9.1

2026-03-11 3.9:

• bugfixes:
  • #14584 Div from bokeh.models.dom raisese ValueError in show call
  • #14724 Bokeh protocol doesn't use binary encoding in pull-doc-reply message
  • #14569 [component: bokehjs] Adjust overlay in case of 1D box zoom
  • #14799 [component: build] Compilation failing with whitespace in path
  • #13578 [component: tests] Unit tests are failing due to changes in pytest-asyncio
  • #14568 [component: bokehjs] [BUG] Wheel Zoom Tool and Categorical Axis Range
  • #14817 MyPy can crash on Bokeh 3.9.0.dev9 code
  • #14776 [component: bokehjs] Don't add BBox if an axis has fixed position
  • #14815 [component: bokehjs] Bounds using FactorRanges aren't respected in the first visualization
  • #14881 Default compression level seems too high
  • #14894 NoChannelsConfiguredError breaks CI after PR #14309

... (truncated)

Commits

• 0d983b5 Deployment updates for release 3.9.1
• 808d988 Verify switcher.json after updating it in release automation (#15132)
• c7cb2d9 Merge pull request #15089 from bokeh/mattpap/3.9.1_backports
• b9c7c97 Add release notes
• 3907ae8 Resolve npm audit's complaints
• bfd0e34 Update visual baselines
• 2d1718c Restore Python 3.10 compatibility
• 6c7f228 reorder documentation strings in enums.py (#15118)
• 4387218 Fix definition of {Event,Property}CallbackManager.document
• 6c690e9 Pin mypy to version 0.19*
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[je-cook]

this is bumping the minimum which is unneeded

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.