Update dash requirement from >=4.2.0 to >=4.4.1 in the dash-network group

[dependabot]

Updates the requirements on dash to permit the latest version.
Updates dash to 4.4.1

Release notes

Sourced from dash's releases.

Dash Version 4.4.1

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786

Changelog

Sourced from dash's changelog.

[4.4.1] - 2026-07-21

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786

[4.4.0] - 2026-07-03

Added

• #3826 WebSocket callback dispatch no longer lets long-lived callbacks limit the number of concurrent users. Async callbacks (including session-persistent ones) run directly on the connection event loop instead of occupying a worker thread, and synchronous callbacks run on a shared ThreadPoolExecutor whose size is configurable via the new websocket_max_workers argument to Dash (default 4). A synchronous persistent (no-output) callback now warns at registration since it would tie up a worker thread.
• #3852 Added support for Plotly hoveranywhere and clickanywhere events in dcc.Graph by adding xvals and yvals to hoverData and clickData.

Fixed

• #3861 Fix synchronous WebSocket callbacks not inheriting ContextVar values bound by ASGI middleware. copy_context() is now captured on the event-loop thread before the callback is submitted to the thread pool, instead of inside the worker thread where only default values were visible.
• #3779 Fix dash.testing Browser.get_logs() returning None on non-Chrome webdrivers, which broke assertions like assert dash_duo.get_logs() == []. It now returns [], matching the Chrome code path.
• #3822 Fix UnboundLocalError for user_callback_output in async background callbacks (Celery and Diskcache managers) when the callback raises PreventUpdate or another exception before the variable is assigned.
• #3819 Fix RuntimeError: No active request in context when a non-Dash path falls through to the FastAPI catch-all route. Fixes #3812.
• #3838 Replace mcp dependency with inline types.
• #3824 Fix dash.testing ThreadedRunner.stop() hanging at teardown for Quart apps. Fixes #3823.
• #3425 dcc.DatePicker: Fix updatemode="bothdates" not always respected

Changed

• Drop support for Python 3.8 (end-of-life since October 2024). The minimum supported version is now Python 3.9.

[4.3.0] - 2026-06-18

Added

• #3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.

Changed

• #3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

• #3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.
• #3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.
• #3813 Fix websockets using incorrect path when deployed behind a proxy
• #3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

[4.3.0rc0] - 2026-05-21

Added

• #3710 MCP: Framework utilities, types for interacting with layout
• #3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format
• #3712 MCP: Resources for exposing app layout, components, and pages
• #3731 MCP: Expose callbacks as Tools
• #3747 MCP: Support pattern-matching callbacks in Tools

... (truncated)

Commits

• 39b5c13 Merge pull request #3909 from plotly/master-4.4.1
• 5079b04 Version 4.4.1 build artifacts
• 3130ed6 Merge branch 'dev' into master-4.4.1
• e06a351 Merge pull request #3908 from plotly/patch-4.4.1
• 8f0ec6f Version 4.4.1
• 051be28 npm audit fix
• 505958a update radix in dcc
• d282d93 Merge pull request #3902 from plotly/fix/callback-args-hardening
• f651bd5 Merge branch 'dev' into fix/callback-args-hardening
• 27bddaa Merge pull request #3903 from leontoddjohnson/patch-1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions