[dependabot]

Bumps dash from 3.3.0 to 4.4.1.

Release notes

Sourced from dash's releases.

v4.4.1

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786

v4.4.0

Added

• #3826 WebSocket callback dispatch no longer lets long-lived callbacks limit the number of concurrent users. Async callbacks (including session-persistent ones) run directly on the connection event loop instead of occupying a worker thread, and synchronous callbacks run on a shared ThreadPoolExecutor whose size is configurable via the new websocket_max_workers argument to Dash (default 4). A synchronous persistent (no-output) callback now warns at registration since it would tie up a worker thread.

Fixed

• #3861 Fix synchronous WebSocket callbacks not inheriting ContextVar values bound by ASGI middleware. copy_context() is now captured on the event-loop thread before the callback is submitted to the thread pool, instead of inside the worker thread where only default values were visible.
• #3779 Fix dash.testing Browser.get_logs() returning None on non-Chrome webdrivers, which broke assertions like assert dash_duo.get_logs() == []. It now returns [], matching the Chrome code path.
• #3822 Fix UnboundLocalError for user_callback_output in async background callbacks (Celery and Diskcache managers) when the callback raises PreventUpdate or another exception before the variable is assigned.
• #3819 Fix RuntimeError: No active request in context when a non-Dash path falls through to the FastAPI catch-all route. Fixes #3812.
• #3838 Replace mcp dependency with inline types.
• #3824 Fix dash.testing ThreadedRunner.stop() hanging at teardown for Quart apps. Fixes #3823.
• #3425 dcc.DatePicker: Fix updatemode="bothdates" not always respected

Changed

• Drop support for Python 3.8 (end-of-life since October 2024). The minimum supported version is now Python 3.9.

v4.3.0

Added

• #3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.
• #3710 MCP: Framework utilities, types for interacting with layout
• #3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format
• #3712 MCP: Resources for exposing app layout, components, and pages
• #3731 MCP: Expose callbacks as Tools
• #3747 MCP: Support pattern-matching callbacks in Tools
• #3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)
• #3749 MCP: get_dash_component Tool and callback execution
• #3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport
• #3766 MCP: Support background callbacks in Tools

Changed

• #3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

• #3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.
• #3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.
• #3813 Fix websockets using incorrect path when deployed behind a proxy
• #3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

v4.3.0rc0

Added

... (truncated)

Changelog

Sourced from dash's changelog.

[4.4.1] - 2026-07-21

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786

[4.4.0] - 2026-07-03

Added

• #3826 WebSocket callback dispatch no longer lets long-lived callbacks limit the number of concurrent users. Async callbacks (including session-persistent ones) run directly on the connection event loop instead of occupying a worker thread, and synchronous callbacks run on a shared ThreadPoolExecutor whose size is configurable via the new websocket_max_workers argument to Dash (default 4). A synchronous persistent (no-output) callback now warns at registration since it would tie up a worker thread.
• #3852 Added support for Plotly hoveranywhere and clickanywhere events in dcc.Graph by adding xvals and yvals to hoverData and clickData.

Fixed

• #3861 Fix synchronous WebSocket callbacks not inheriting ContextVar values bound by ASGI middleware. copy_context() is now captured on the event-loop thread before the callback is submitted to the thread pool, instead of inside the worker thread where only default values were visible.
• #3779 Fix dash.testing Browser.get_logs() returning None on non-Chrome webdrivers, which broke assertions like assert dash_duo.get_logs() == []. It now returns [], matching the Chrome code path.
• #3822 Fix UnboundLocalError for user_callback_output in async background callbacks (Celery and Diskcache managers) when the callback raises PreventUpdate or another exception before the variable is assigned.
• #3819 Fix RuntimeError: No active request in context when a non-Dash path falls through to the FastAPI catch-all route. Fixes #3812.
• #3838 Replace mcp dependency with inline types.
• #3824 Fix dash.testing ThreadedRunner.stop() hanging at teardown for Quart apps. Fixes #3823.
• #3425 dcc.DatePicker: Fix updatemode="bothdates" not always respected

Changed

• Drop support for Python 3.8 (end-of-life since October 2024). The minimum supported version is now Python 3.9.

[4.3.0] - 2026-06-18

Added

• #3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.

Changed

• #3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

• #3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.
• #3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.
• #3813 Fix websockets using incorrect path when deployed behind a proxy
• #3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

[4.3.0rc0] - 2026-05-21

Added

• #3710 MCP: Framework utilities, types for interacting with layout
• #3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format
• #3712 MCP: Resources for exposing app layout, components, and pages
• #3731 MCP: Expose callbacks as Tools
• #3747 MCP: Support pattern-matching callbacks in Tools

... (truncated)

Commits

• 39b5c13 Merge pull request #3909 from plotly/master-4.4.1
• 5079b04 Version 4.4.1 build artifacts
• 3130ed6 Merge branch 'dev' into master-4.4.1
• e06a351 Merge pull request #3908 from plotly/patch-4.4.1
• 8f0ec6f Version 4.4.1
• 051be28 npm audit fix
• 505958a update radix in dcc
• d282d93 Merge pull request #3902 from plotly/fix/callback-args-hardening
• f651bd5 Merge branch 'dev' into fix/callback-args-hardening
• 27bddaa Merge pull request #3903 from leontoddjohnson/patch-1
• Additional commits viewable in compare view

[CervezaStallone]

@dependabot rebase