Release 0.15.0: plotly.js 3.x work, remove kaleido/EPS, dependency security bumps

[jqnatividad]

Summary

Release prep for plotly.rs 0.15.0, the last release on plotly.js 3.x. Per the discussion in #437, the plotly.js 4.x upgrade will be the basis for 0.16.0.

0.15.0 ships everything currently under [Unreleased] (plotly.js 3.0.1 → 3.7.0, the new trace types and the 3.7 attribute backfill), plus:

• Removes the deprecated Kaleido backend and ImageFormat::EPS, as announced for 0.15.0 in the 0.13.0 deprecation notices.
• Security / dependencies: drops the unused zip build-dependency and bumps darling/syn, dirs and the examples' dependencies.
• Versions: plotly 0.15.0, plotly_derive 0.15.0, plotly_static 0.2.0 (breaking: EPS removed; also carries the plotly.js 3.7.0 bundle).

⚠️ Publish order

plotly 0.15.0 depends on plotly_static = "0.2", and release.yml does not publish plotly_static (it goes through publish_plotly_static.yml). Publish in this order:

1. plotly_static 0.2.0
2. plotly_derive 0.15.0
3. plotly 0.15.0

Changes

Kaleido / EPS removal (03a5dc4)

• Removed plotly_kaleido from the workspace; removed the kaleido and kaleido_download features and the kaleido-gated Plot::{write_image, to_base64, to_svg} implementations.
• Removed ImageFormat::EPS and the #![allow(deprecated)] in plotly_static that was waiting on 0.15.0.
• Removed the kaleido example, and the kaleido/EPS sections from the README and book. Install snippets now point at 0.15, and the README WASM snippet's CDN link now points at plotly.js 3.7.0.

Dependencies (f1d5d06)

• plotly_static: removed the zip build-dependency (build.rs never used it); dirs 6 → 7.
• plotly_derive: darling 0.23 → 0.24 together with syn 2 → 3 (darling 0.24 is built on syn 3). No macro code changes needed.
• examples: reqwest 0.13, env_logger 0.11, itertools 0.15, ndarray 0.17, rand/rand_chacha 0.10, with small API adaptations (RngExt::random, dropping the deprecated into_raw_vec).

Example fix (48b387b): the custom_controls sinusoidal slider built 52 traces (0..=num_steps) for 51 slider steps, so step 0 also showed a stray 5.1-frequency curve. It now builds 51.

Lints and an add_frames fix (a21da1f)

• Fixes Plot::add_frames, which added every frame twice when the plot had no frames yet. Adds a regression test.

• Theme statics in plotly::layout::themes (DEFAULT, PLOTLY_WHITE, …) are now std::sync::LazyLock<Template> instead of once_cell::sync::Lazy<Template>, and the once_cell dependency is dropped. This changes the type of public items. It only affects code that calls Lazy::force on them, and it lands in a release that is already breaking. It needs Rust 1.80+; no MSRV is declared.

• Addresses clippy's pedantic missing_errors_doc, missing_panics_doc and doc_markdown, plus cargo::redundant_homepage:

  • adds # Errors/# Panics sections to public fallible APIs, including the wasm-only bindings and callbacks;
  • backticks identifiers in docs, and fixes an unbalanced-backtick comment that was copied across 8 traces;
  • removes the homepage fields that duplicated repository.

  A new clippy.toml treats WebDriver, MapLibre, GeoJSON, MathJax and ModeBar as product names rather than identifiers. CI doesn't enforce pedantic lints; this is cleanup.

Release (5d68616): version bumps and the CHANGELOG [0.15.0] section. Also removes the Funnel/Waterfall changelog entries that duplicated the #432 entry.

CI changes (please review)

• build.yml: removed the kaleido entries from the matrices, lint steps and test excludes; the semver job now checks static_export_chromedriver instead of kaleido.
• build.yml (16b30fb): dropped the pinned release-type: minor from the semver job. An explicit release type is applied verbatim, without the 0.y.z → major promotion, so the intentional removals would fail as major changes. Inferring from the version treats 0.14.1 → 0.15.0 as major, and during normal development (version unchanged) it still defaults to a minor-level check.
• Deleted publish_plotly_kaleido.yml and the plotly_kaleido publish step in release.yml. The already-published plotly_kaleido crate on crates.io is unaffected.

Known issue: transitive zip 8.x

cargo audit still reports RUSTSEC-2026-0367/0368/0369 for zip 8.6.0. After this PR, zip comes only from webdriver-downloader 0.17 (zip ^8), a build-time dependency of plotly_static that fetches chromedriver/geckodriver.

• All three advisories concern ZipArchive::extract() (symlinks and permissions). webdriver-downloader doesn't call extract(); it reads the driver entry with by_name + io::copy.
• The fix is upstream in Change: bump zip to 9 ik1ne/webdriver-downloader#67 (zip 9; CI green, awaiting review). Once it's released, a 0.15.x patch can bump webdriver-downloader.
• [patch.crates-io] wasn't used because it doesn't reach downstream users of the published crate.

The other advisories cargo audit reports against older lockfiles (rustls, quinn-proto, h2, crossbeam-epoch) are semver-compatible and resolve with a fresh cargo update. Cargo.lock isn't tracked, so this PR doesn't change them.

For the maintainer

• The CHANGELOG release date is set to today; adjust as needed.
• #432 also appears under the already-released [0.14.1] - Fixed ("mdBook table of contents ordering"). That may be the wrong PR number; I left it unchanged.
• ea7c2bf is a formatting-only commit. Nightly rustfmt 2026-10-16 re-wraps comments under wrap_comments, which was failing the Rustfmt job on about 10 files (it would fail on main too). It contains no code changes.
• Not addressed here: RUSTDOCFLAGS="-D warnings" cargo doc --features all still fails on pre-existing issues that this PR leaves unchanged:
  • two unresolved intra-doc links (ExporterSyncExt/ExporterAsyncExt) in plot.rs, which date back to fd36405;
  • several unclosed HTML tag <n> errors.

Test plan

• cargo clippy --features all --all-targets -- -D warnings (no longer needs -A deprecated)
• cargo clippy -p plotly_static --features geckodriver,webdriver_download -- -D warnings
• cargo clippy --package plotly --target wasm32-unknown-unknown -- -D warnings
• cargo test -p plotly --features all --lib: 379 pass. The 8 browser-dependent export tests couldn't run locally (chromedriver 153 vs Chrome 155); CI installs a matched pair.
• cargo test -p plotly --features all --doc (38 pass), cargo test -p plotly_static --doc --features chromedriver (20 pass)
• cd examples && cargo clippy --workspace -- -D warnings
• cargo clippy --workspace --all-targets --features all -- -A clippy::all -W clippy::missing_panics_doc -W clippy::missing_errors_doc -W clippy::non_std_lazy_statics -W clippy::doc_markdown (also with static_export_geckodriver and --target wasm32-unknown-unknown): clean
• typos
• cargo audit: only the transitive zip 8.6.0 advisories described above remain
• cargo-semver-checks (my local version can't read this toolchain's rustdoc format; relying on the CI job)

🤖 Generated with Claude Code