build(deps): bump narwhals from 2.25.0 to 2.27.1

[dependabot]

Bumps narwhals from 2.25.0 to 2.27.1.

Release notes

Sourced from narwhals's releases.

Narwhals v2.27.1

What's Changed

• fix: return a numeric dtype from str.len_chars on all-null object columns by @​FBruzzesi in narwhals-dev/narwhals#4031
• fix: count characters, not bytes, in str.zfill on Polars < 2.0 by @​FBruzzesi in narwhals-dev/narwhals#4040

Full Changelog: narwhals-dev/narwhals@v2.27.0...v2.27.1

Narwhals v2.27.0

Changes

• test: cover concat_str single expression and null inputs (#3978)
• test: cover corr and cov constant, stability and group_by cases (#3917)
• fix(tests): PySpark tests fixup (#3940)
• test: test cover quantile boundaries, invalid raises, median over (#3919)

✨ Enhancements

• feat: Add {DataFrame, LazyFrame}.cast (#3815)
• feat: support list.contains for PyArrow, pandas and Dask (#4001)
• feat: accept file-like objects in {read,scan}_* (#3956)
• feat: hint at narwhals-datafusion plugin for datafusion.DataFrame (#3937)

🐞 Bug fixes

• fix: avoid LazyFrame.cast from resolving the full schema to check column names (#4016)
• fix: return null for floor division by zero on pandas-like backends (#4011)
• fix: upcast {Int8,Int16,UInt8,UInt16} to Int64 in pyarrow cum_sum (#3995)
• fix: align scalar operands before fill_null and horizontal reductions in Dask (#3972)
• fix: use relations' own connection for concat(how="diagonal") on DuckDB (#3998)
• fix: align list.contains null handling with Polars on lazy backends (#3996)
• fix: cum_count(reverse=True) counts non-null values on pandas-like backends (#3991)
• fix: align pandas-like and Dask concat_str boolean rendering (#3979)
• fix: match Polars in str.slice for negative offset, raise on negative length (#3969)
• fix: correct str.zfill for +-prefixed strings on polars<=1.30 and support polars 0.20.4 (#3958)
• fix: align concat_str behavior for polars<0.20.6 (#3981)
• fix: broadcast scalar-only concat_str for sql-like backends (#3980)
• fix: avoid DIVIDE_BY_ZERO in PySpark corr on constant columns (#3960)
• fix: preserve all-null rows in concat_str for pyarrow backend (#3966)
• fix: align series before fillna and isna in dask mean_horizontal (#3968)
• fix: drop trailing separator in concat_str(..., ignore_nulls=True) for pandas-like and Dask backends (#3967)
• fix: broadcast literals in pandas-like and PyArrow horizontal functions (#3941)
• fix: preserve nulls when casting to String on pandas pre v3.0.0 (#3939)
• fix: reject a negative width in str.zfill consistently across backends (#3770)
• fix: align __mod__ and __rmod__ behavior with negative operands across backends (#3929)
• fix: raise DuplicateError on duplicate struct field names; cover nested struct schema round trip in tests (#3918)
• fix: reject invalid str.{pad_start,pad_end} arguments consistently; cover pad length-zero and unicode edge cases in tests (#3910)
• fix: str.replace(n=0) on pandas-like backends; cover replace regex and n edge cases in tests (#3911)
• fix(pyarrow): use native {starts,ends}_with kernels, fixing empty-suffix ends_with; cover empty-pattern and null expr-pattern search in tests (#3912)

... (truncated)

Commits

• 185de76 release: Bump version to 2.27.1
• 67a2cff chore(deps): lock file maintenance (#4049)
• a295df1 chore(deps): lock file maintenance (#4035)
• 19ad1eb chore: prek autoupdate (#4039)
• 2b2521b fix: count characters, not bytes, in str.zfill on Polars < 2.0 (#4040)
• b89e14a skip changelog(deps): Update github/codeql-action action to v4.38.2 (#4034)
• faf5bde fix: return a numeric dtype from str.len_chars on all-null object columns...
• 1acc082 release: Bump version to 2.27.0 (#4028)
• b8dd014 fix: avoid LazyFrame.cast from resolving the full schema to check column na...
• cc2b466 fix: return null for floor division by zero on pandas-like backends (#4011)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fair-code	Ready	Preview	Oct 16, 2026 9:44am UTC

[github-actions]

@yakew7 - new PR touching a path you own, please review.