[dependabot]

Bumps the python-dependencies group with 3 updates in the / directory: dash, pytz and tzdata.

Updates dash from 4.4.1 to 4.5.0

Release notes

Sourced from dash's releases.

Dash Version 4.5.0

Added

• #4099 Streaming callbacks over HTTP now require shared storage and fail at server setup without it, instead of falling back to one connection per stream; WebSocket streaming callbacks do not need it.
• #4095 Make shared storage and the multiplexed streaming downlink opt-in (shared_storage= or DASH_SHARED_STORAGE), and move msgspec to a new dash[shared_storage] extra for the persistent LocalSharedStorage modes (dash[diskcache] and dash[redis] include it).
• #4026 Add DASH_SECRET_KEY so a hosting platform can give every worker and pod the same signing secret for page, background and stream tokens without editing the app (server.secret_key still wins and is not changed).
• #4026 Add DASH_SHARED_STORAGE to pick the shared-storage backend when the app does not pass shared_storage=: local, none, diskcache:///abs/path, or a redis:// / rediss:// URL.
• #4024 Add support for social media meta tags in regular Dash apps using app.title, app.description, and app.image.
• #3976 Add a new scrollToTop prop to dcc.Link to control whether the page scrolls to the top after client-side navigation. It defaults to True to preserve the existing behavior. Fixes #3974.
• #3947 Make plotly-cloud a default install dependency of Dash instead of an optional extra, so the plotly CLI and Dash's cloud integration work out of the box. The dash[cloud] extra is kept for backward compatibility.
• #3930 Add shared storage: a backend-agnostic cross-process state manager (key/value with optional TTL, plus ordered replayable pub/sub) via dash.ctx.shared_storage, started lazily. Ships LocalSharedStorage (in-memory with optional disk persistence), DiskcacheSharedStorage, and RedisSharedStorage for horizontally-scaled deployments; see .ai/ARCHITECTURE.md.
• #3931 Add streaming callbacks: an async def generator callback streams its yields to the browser as they are produced (dash.Patch yields apply incrementally). A browser's streams share one SharedWorker-hosted connection so they do not count against the per-host connection limit; closing a tab cancels its streams.
• #3977 Add partial WebSocket prop reads with get_prop(..., path=...). Closes #3975.
• #3765 Add opt-in partial pattern matching for callback Input, Output, and State via partial_pattern=True, so dictionary ID patterns can match component IDs with extra keys and combine with ALL/MATCH wildcards. Fixes #3764.
• #3880 Add experimental support for React 19 (default stays React 18.3.1); opt in with REACT_VERSION=19.2.4 or dash._dash_renderer._set_react_version("19.2.4"). Dash serves the umd-react package with a compatibility shim so component libraries built against React <=18 keep working; see .ai/ARCHITECTURE.md.
• #3925 Add optional callback request payload compression via compress_payload and compress_threshold callback parameters (default threshold 5,000 bytes), sending gzip payloads that Dash decompresses on Flask, FastAPI, and Quart. Fixes #3924.
• #3961 Added cursor position data (xPixel, yPixel) to dcc.Graph hoverData and clickData when hoveranywhere or clickanywhere is enabled in the figure.
• #3960 Rewrite dcc.Markdown and dcc.Link as Typescript components
• #3881 Added dash.remount, a wrapper for a callback-returned component that forces the renderer to remount it (resetting its internal state) instead of reconciling in place: the explicit way to reset a stateful component from a callback without changing its id.

Removed

• #3880 Remove React 16 support (16.14.0 is no longer an accepted value for REACT_VERSION / _set_react_version).
• #4039 Remove unnecessary Python version checks (pre 3.9).

Changed

• #4073 Move plotly-cloud back to the optional dash[cloud] extra (it was a default dependency in 4.5.0rc0/rc1), since it is not available on conda-forge.
• #4026 Log a warning, once per process, when a streaming request is refused because its stream token failed verification, which on multi-worker deployments usually means the workers do not share a signing secret.
• #3987 Forward FastAPI reload scope options (reload_dirs, reload_excludes, and reload_includes) to Uvicorn when reloading.
• #3986 Adjust _run_before_hooks in the fastapi backend to honor a response returned by a before_request function, matching the flask backend's behavior.

Fixed

• #4075 fastapi backend: run before_request hooks on every route of the Dash app (assets, hook routes, api_endpoint, pages, when mounted) and send a non-None hook result as the response, as on Flask. fastapi and quart also run them on the WebSocket handshake.
• #4075 Background callbacks without cache_by no longer share a result between requests with equal inputs (unread Diskcache results now expire after a day, or after expire when set, even with cache_by), and callbacks with the same source no longer share a cache key. build_cache_key takes a new callback_key argument.
• #4075 dcc.Location(refresh=True).href, html.Area.href and html.Base.href now block javascript: URLs like html.A.
• #4075 Pages path_template matching no longer errors or backtracks badly on paths with a newline.
• #4075 Add configure_mcp_server(cache_by=..., cache_maxsize=...) so apps whose layout or callbacks depend on the user can keep the MCP server's cached tool descriptions and initial values per user (128 users by default, None for no limit).
• #4052 Fix callbacks of removed components still firing after a callback returns None for children: the renderer now clears their paths. Fixes #4033.
• #4027 Support async def hook routes (dash.hooks.route) on all backends, stop hook routes from leaking the app context to the caller, and let hook routes and MCP read the request on the fastapi backend.
• #4053 Fix callbacks being registered twice under a reloader (e.g. uvicorn --reload) when Dash() is given an explicit name or is built by an app factory called from the main module. Fixes #3912.
• #3980 Fix the three before_request hooks (Dash._setup_server and the pages router_sync / router_async) publishing their "already done" guard flag before the setup work behind it had run. Under a multi-threaded WSGI worker such as gunicorn -k gthread (or under an ASGI worker for the async router), a second request arriving mid-setup could observe the flag already set, skip setup, then read registered_paths / callback_map / the pages router callback while they were still being registered - causing the first burst of component bundle requests after a restart to 500 with Error loading dependency. "<lib>" is not a registered library, or the pages router to hit DuplicateCallback when two workers raced past the guard. Each hook body now runs under a lock (threading.Lock for the two sync hooks, an asyncio.Lock bound to the running loop for the async router) and only publishes the flag after all work completes. Fixes #3971.
• #3944 Fix dash.testing runner backend detection for wrapped FastAPI/Quart servers so threaded Flask-only options are not passed to ASGI runners.
• #3955 Unpin selenium in the testing requirements (was capped at <=4.2.0 from 2022) and require >=4.11.0, so it can drive current stable Chrome via Selenium Manager and stop the widespread CI flakiness.
• #3881 Speed up the renderer layout crawl (crawlLayout and its callers) by replacing curried-ramda path/pathOr lookups with direct property access on the hot path: ~16% faster Patch().append() into a large container, with no behavior change.
• #3881 Fix pattern-matching (MATCH/ALL/ALLSMALLER) callbacks getting quadratically slower as matching components grow; a new O(1) id->path index cuts an ALL update over 400 components from ~580ms to ~140ms (~4x), with no app changes.
• #3941 Fix the FastAPI and Quart backends opening a WebSocket connection on every page load even for apps with no WebSocket callbacks; the socket now opens only when actually needed. Fixes #3939.
• #3916 Fixed a regression where dragging multiple files into dcc.Upload would upload only the first file when multiple=True
• #3922 Fix dcc.Input(type="number") stepper behavior when only min is set.
• #3936 Use the proxied url as the Jupyter server url so DASH_PROXY is honored by the external url and inline iframe in notebooks. Fixes #3401.
• #3938 Fix dcc.Patch() re-running the initial callbacks of components already on the page (including every MATCH/ALL element) and wiping their user-edited persisted values. Fixes #3681 and #3937
• #3960 Fix dcc.Markdown not rendering <dccLink /> by using newer dependencies

... (truncated)

Changelog

Sourced from dash's changelog.

[4.5.0] - 2026-10-29

Added

• #4099 Streaming callbacks over HTTP now require shared storage and fail at server setup without it, instead of falling back to one connection per stream; WebSocket streaming callbacks do not need it.
• #4095 Make shared storage and the multiplexed streaming downlink opt-in (shared_storage= or DASH_SHARED_STORAGE), and move msgspec to a new dash[shared_storage] extra for the persistent LocalSharedStorage modes (dash[diskcache] and dash[redis] include it).
• #4026 Add DASH_SECRET_KEY so a hosting platform can give every worker and pod the same signing secret for page, background and stream tokens without editing the app (server.secret_key still wins and is not changed).
• #4026 Add DASH_SHARED_STORAGE to pick the shared-storage backend when the app does not pass shared_storage=: local, none, diskcache:///abs/path, or a redis:// / rediss:// URL.
• #4024 Add support for social media meta tags in regular Dash apps using app.title, app.description, and app.image.
• #3976 Add a new scrollToTop prop to dcc.Link to control whether the page scrolls to the top after client-side navigation. It defaults to True to preserve the existing behavior. Fixes #3974.
• #3947 Make plotly-cloud a default install dependency of Dash instead of an optional extra, so the plotly CLI and Dash's cloud integration work out of the box. The dash[cloud] extra is kept for backward compatibility.
• #3930 Add shared storage: a backend-agnostic cross-process state manager (key/value with optional TTL, plus ordered replayable pub/sub) via dash.ctx.shared_storage, started lazily. Ships LocalSharedStorage (in-memory with optional disk persistence), DiskcacheSharedStorage, and RedisSharedStorage for horizontally-scaled deployments; see .ai/ARCHITECTURE.md.
• #3931 Add streaming callbacks: an async def generator callback streams its yields to the browser as they are produced (dash.Patch yields apply incrementally). A browser's streams share one SharedWorker-hosted connection so they do not count against the per-host connection limit; closing a tab cancels its streams.
• #3977 Add partial WebSocket prop reads with get_prop(..., path=...). Closes #3975.
• #3765 Add opt-in partial pattern matching for callback Input, Output, and State via partial_pattern=True, so dictionary ID patterns can match component IDs with extra keys and combine with ALL/MATCH wildcards. Fixes #3764.
• #3880 Add experimental support for React 19 (default stays React 18.3.1); opt in with REACT_VERSION=19.2.4 or dash._dash_renderer._set_react_version("19.2.4"). Dash serves the umd-react package with a compatibility shim so component libraries built against React <=18 keep working; see .ai/ARCHITECTURE.md.
• #3925 Add optional callback request payload compression via compress_payload and compress_threshold callback parameters (default threshold 5,000 bytes), sending gzip payloads that Dash decompresses on Flask, FastAPI, and Quart. Fixes #3924.
• #3961 Added cursor position data (xPixel, yPixel) to dcc.Graph hoverData and clickData when hoveranywhere or clickanywhere is enabled in the figure.
• #3960 Rewrite dcc.Markdown and dcc.Link as Typescript components
• #3881 Added dash.remount, a wrapper for a callback-returned component that forces the renderer to remount it (resetting its internal state) instead of reconciling in place: the explicit way to reset a stateful component from a callback without changing its id.

Removed

• #3880 Remove React 16 support (16.14.0 is no longer an accepted value for REACT_VERSION / _set_react_version).
• #4039 Remove unnecessary Python version checks (pre 3.9).

Changed

• #4073 Move plotly-cloud back to the optional dash[cloud] extra (it was a default dependency in 4.5.0rc0/rc1), since it is not available on conda-forge.
• #4026 Log a warning, once per process, when a streaming request is refused because its stream token failed verification, which on multi-worker deployments usually means the workers do not share a signing secret.
• #3987 Forward FastAPI reload scope options (reload_dirs, reload_excludes, and reload_includes) to Uvicorn when reloading.
• #3986 Adjust _run_before_hooks in the fastapi backend to honor a response returned by a before_request function, matching the flask backend's behavior.

Fixed

• #4075 fastapi backend: run before_request hooks on every route of the Dash app (assets, hook routes, api_endpoint, pages, when mounted) and send a non-None hook result as the response, as on Flask. fastapi and quart also run them on the WebSocket handshake.
• #4075 Background callbacks without cache_by no longer share a result between requests with equal inputs (unread Diskcache results now expire after a day, or after expire when set, even with cache_by), and callbacks with the same source no longer share a cache key. build_cache_key takes a new callback_key argument.
• #4075 dcc.Location(refresh=True).href, html.Area.href and html.Base.href now block javascript: URLs like html.A.
• #4075 Pages path_template matching no longer errors or backtracks badly on paths with a newline.
• #4075 Add configure_mcp_server(cache_by=..., cache_maxsize=...) so apps whose layout or callbacks depend on the user can keep the MCP server's cached tool descriptions and initial values per user (128 users by default, None for no limit).
• #4052 Fix callbacks of removed components still firing after a callback returns None for children: the renderer now clears their paths. Fixes #4033.
• #4027 Support async def hook routes (dash.hooks.route) on all backends, stop hook routes from leaking the app context to the caller, and let hook routes and MCP read the request on the fastapi backend.
• #4053 Fix callbacks being registered twice under a reloader (e.g. uvicorn --reload) when Dash() is given an explicit name or is built by an app factory called from the main module. Fixes #3912.
• #3980 Fix the three before_request hooks (Dash._setup_server and the pages router_sync / router_async) publishing their "already done" guard flag before the setup work behind it had run. Under a multi-threaded WSGI worker such as gunicorn -k gthread (or under an ASGI worker for the async router), a second request arriving mid-setup could observe the flag already set, skip setup, then read registered_paths / callback_map / the pages router callback while they were still being registered - causing the first burst of component bundle requests after a restart to 500 with Error loading dependency. "<lib>" is not a registered library, or the pages router to hit DuplicateCallback when two workers raced past the guard. Each hook body now runs under a lock (threading.Lock for the two sync hooks, an asyncio.Lock bound to the running loop for the async router) and only publishes the flag after all work completes. Fixes #3971.
• #3944 Fix dash.testing runner backend detection for wrapped FastAPI/Quart servers so threaded Flask-only options are not passed to ASGI runners.
• #3955 Unpin selenium in the testing requirements (was capped at <=4.2.0 from 2022) and require >=4.11.0, so it can drive current stable Chrome via Selenium Manager and stop the widespread CI flakiness.
• #3881 Speed up the renderer layout crawl (crawlLayout and its callers) by replacing curried-ramda path/pathOr lookups with direct property access on the hot path: ~16% faster Patch().append() into a large container, with no behavior change.
• #3881 Fix pattern-matching (MATCH/ALL/ALLSMALLER) callbacks getting quadratically slower as matching components grow; a new O(1) id->path index cuts an ALL update over 400 components from ~580ms to ~140ms (~4x), with no app changes.
• #3941 Fix the FastAPI and Quart backends opening a WebSocket connection on every page load even for apps with no WebSocket callbacks; the socket now opens only when actually needed. Fixes #3939.
• #3916 Fixed a regression where dragging multiple files into dcc.Upload would upload only the first file when multiple=True
• #3922 Fix dcc.Input(type="number") stepper behavior when only min is set.
• #3936 Use the proxied url as the Jupyter server url so DASH_PROXY is honored by the external url and inline iframe in notebooks. Fixes #3401.
• #3938 Fix dcc.Patch() re-running the initial callbacks of components already on the page (including every MATCH/ALL element) and wiping their user-edited persisted values. Fixes #3681 and #3937
• #3960 Fix dcc.Markdown not rendering <dccLink /> by using newer dependencies

... (truncated)

Commits

• 9b04a1d Merge pull request #4101 from plotly/master-4.5.0
• f7ad523 Version 4.5.0 build artifacts
• fa4f243 Merge remote-tracking branch 'origin/dev' into master-4.5.0
• 00b8ed6 Merge pull request #4100 from plotly/release-4.5.0
• 3ba04eb Backfill 4.5.0 CHANGELOG entries and PR links
• 28b5375 version 4.5.0
• 3bc84a4 Merge pull request #4099 from plotly/stream-requires-shared-storage
• acd5383 Add PR number to CHANGELOG
• 076e5af Require shared storage for HTTP streaming callbacks
• 5abb55c Merge pull request #4095 from plotly/shared-storage-opt-in
• Additional commits viewable in compare view

Updates pytz from 2026.5 to 2026.6

Commits

• e3c6fe2 Bump version numbers to 2026.6/2026f
• 23e2e67 IANA 2026f
• e6f3078 Squashed 'tz/' changes from 039ef27cc5..d8acf4bc22
• See full diff in compare view

Updates tzdata from 2026.5 to 2026.6

Release notes

Sourced from tzdata's releases.

2026.6: Release of upstream tzdata 2026f

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

Changelog

Sourced from tzdata's changelog.

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

---

Commits

• 0d4342c Update tzdata to version 2026f (#157)
• See full diff in compare view

[CervezaStallone]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.