chore: bump dash from 3.3.0 to 4.4.0

[dependabot]

Bumps dash from 3.3.0 to 4.4.0.

Release notes

Sourced from dash's releases.

Dash Version 4.4.0

Added

• #3826 WebSocket callback dispatch no longer lets long-lived callbacks limit the number of concurrent users. Async callbacks (including session-persistent ones) run directly on the connection event loop instead of occupying a worker thread, and synchronous callbacks run on a shared ThreadPoolExecutor whose size is configurable via the new websocket_max_workers argument to Dash (default 4). A synchronous persistent (no-output) callback now warns at registration since it would tie up a worker thread.

Fixed

• #3861 Fix synchronous WebSocket callbacks not inheriting ContextVar values bound by ASGI middleware. copy_context() is now captured on the event-loop thread before the callback is submitted to the thread pool, instead of inside the worker thread where only default values were visible.
• #3779 Fix dash.testing Browser.get_logs() returning None on non-Chrome webdrivers, which broke assertions like assert dash_duo.get_logs() == []. It now returns [], matching the Chrome code path.
• #3822 Fix UnboundLocalError for user_callback_output in async background callbacks (Celery and Diskcache managers) when the callback raises PreventUpdate or another exception before the variable is assigned.
• #3819 Fix RuntimeError: No active request in context when a non-Dash path falls through to the FastAPI catch-all route. Fixes #3812.
• #3838 Replace mcp dependency with inline types.
• #3824 Fix dash.testing ThreadedRunner.stop() hanging at teardown for Quart apps. Fixes #3823.
• #3425 dcc.DatePicker: Fix updatemode="bothdates" not always respected

Changed

• Drop support for Python 3.8 (end-of-life since October 2024). The minimum supported version is now Python 3.9.

v4.3.0

Added

• #3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.
• #3710 MCP: Framework utilities, types for interacting with layout
• #3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format
• #3712 MCP: Resources for exposing app layout, components, and pages
• #3731 MCP: Expose callbacks as Tools
• #3747 MCP: Support pattern-matching callbacks in Tools
• #3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)
• #3749 MCP: get_dash_component Tool and callback execution
• #3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport
• #3766 MCP: Support background callbacks in Tools

Changed

• #3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

• #3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.
• #3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.
• #3813 Fix websockets using incorrect path when deployed behind a proxy
• #3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

v4.3.0rc0

Added

• #3710 MCP: Framework utilities, types for interacting with layout
• #3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format
• #3712 MCP: Resources for exposing app layout, components, and pages
• #3731 MCP: Expose callbacks as Tools
• #3747 MCP: Support pattern-matching callbacks in Tools
• #3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)
• #3749 MCP: get_dash_component Tool and callback execution
• #3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport
• #3766 MCP: Support background callbacks in Tools

... (truncated)

Changelog

Sourced from dash's changelog.

[4.4.0] - 2026-07-03

Added

• #3826 WebSocket callback dispatch no longer lets long-lived callbacks limit the number of concurrent users. Async callbacks (including session-persistent ones) run directly on the connection event loop instead of occupying a worker thread, and synchronous callbacks run on a shared ThreadPoolExecutor whose size is configurable via the new websocket_max_workers argument to Dash (default 4). A synchronous persistent (no-output) callback now warns at registration since it would tie up a worker thread.

Fixed

• #3861 Fix synchronous WebSocket callbacks not inheriting ContextVar values bound by ASGI middleware. copy_context() is now captured on the event-loop thread before the callback is submitted to the thread pool, instead of inside the worker thread where only default values were visible.
• #3779 Fix dash.testing Browser.get_logs() returning None on non-Chrome webdrivers, which broke assertions like assert dash_duo.get_logs() == []. It now returns [], matching the Chrome code path.
• #3822 Fix UnboundLocalError for user_callback_output in async background callbacks (Celery and Diskcache managers) when the callback raises PreventUpdate or another exception before the variable is assigned.
• #3819 Fix RuntimeError: No active request in context when a non-Dash path falls through to the FastAPI catch-all route. Fixes #3812.
• #3838 Replace mcp dependency with inline types.
• #3824 Fix dash.testing ThreadedRunner.stop() hanging at teardown for Quart apps. Fixes #3823.
• #3425 dcc.DatePicker: Fix updatemode="bothdates" not always respected

Changed

• Drop support for Python 3.8 (end-of-life since October 2024). The minimum supported version is now Python 3.9.

[4.3.0] - 2026-06-18

Added

• #3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.
• #3852 Added support for Plotly hoveranywhere and clickanywhere events in dcc.Graph by adding xvals and yvals to hoverData and clickData.

Changed

• #3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

• #3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.
• #3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.
• #3813 Fix websockets using incorrect path when deployed behind a proxy
• #3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

[4.3.0rc0] - 2026-05-21

Added

• #3710 MCP: Framework utilities, types for interacting with layout
• #3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format
• #3712 MCP: Resources for exposing app layout, components, and pages
• #3731 MCP: Expose callbacks as Tools
• #3747 MCP: Support pattern-matching callbacks in Tools
• #3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)
• #3749 MCP: get_dash_component Tool and callback execution
• #3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport
• #3766 MCP: Support background callbacks in Tools

[4.2.0] - 2026-06-01 - The Freedom Update

This release marks a major milestone for Dash, bringing unprecedented flexibility to how you build and deploy your applications.

🚀 Multiple Backend Support

... (truncated)

Commits

• 1fc4a2d Merge pull request #3870 from plotly/master-4.4.0
• 2a59605 version 4.4.0 build artifacts
• b7d537b Merge branch 'dev' into master-4.4.0
• 4e0fb90 Merge pull request #3867 from plotly/version-4.4.0
• 826c080 version 4.4.0
• 9ba8421 Merge pull request #3862 from plotly/fix/ws-contextvars
• c79ebf4 Merge branch 'dev' into fix/ws-contextvars
• 7cf426e Merge pull request #3860 from plotly/fix/dependabot-spam
• a33d61d Merge branch 'dev' into fix/dependabot-spam
• d5ffe05 Merge branch 'dev' into fix/ws-contextvars
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)