Master 4.4.0

.github/dependabot.yml

@@ -1,10 +1,17 @@
 version: 2
 updates:
-  # Root package dependencies
+  # Root package dependencies.
+  # NOTE: listing more than one entry under `directories` makes Dependabot treat
+  # "/" as a recursive glob, so it scans every nested package.json. The negated
+  # globs below keep it out of directories that have their own update entry — the
+  # components and the renderer carry narrow allow/ignore lists (e.g. react-docgen
+  # is pinned) that the root entry would otherwise bypass. @plotly/* is internal.
   - package-ecosystem: "npm"
     directories:
       - "/"
       - "!/@plotly/*"
+      - "!/components/*"
+      - "!/dash/dash-renderer"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -43,8 +50,6 @@ updates:
       - dependency-name: "babel-loader"
       - dependency-name: "ts-loader"
       - dependency-name: "cookie"
-      - dependency-name: "eslint*"
-      - dependency-name: "prettier"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
 
@@ -75,10 +80,12 @@ updates:
       - dependency-name: "@types/*"
       - dependency-name: "@babel/*"
       - dependency-name: "babel-loader"
-      - dependency-name: "eslint*"
-      - dependency-name: "prettier"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
 
   # Components - dash-html-components
   - package-ecosystem: "npm"
@@ -101,9 +108,12 @@ updates:
       - dependency-name: "@types/*"
       - dependency-name: "@babel/*"
       - dependency-name: "babel-loader"
-      - dependency-name: "eslint*"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
 
   # Components - dash-table
   - package-ecosystem: "npm"
@@ -130,10 +140,12 @@ updates:
       - dependency-name: "css-loader"
       - dependency-name: "less"
       - dependency-name: "less-loader"
-      - dependency-name: "eslint*"
-      - dependency-name: "prettier"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
 
   # Python dependencies
   - package-ecosystem: "pip"
@@ -143,6 +155,10 @@ updates:
       day: "monday"
     cooldown:
       default-days: 14
+    # Keep lower bounds (e.g. Flask>=1.0.4 in install.txt) low: only raise a
+    # floor when the latest release is incompatible with the current range.
+    # Exact (==) pins in ci/dev/testing still update as normal.
+    versioning-strategy: increase-if-necessary
     groups:
       pip-dependencies:
         applies-to: version-updates
@@ -152,3 +168,8 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+    # jupyterlab is pinned <4.0.0: jupyterlab 4.x ships jlpm as Yarn Berry, which
+    # cannot consume @plotly/dash-jupyterlab's Yarn 1 lockfile and breaks the build.
+    ignore:
+      - dependency-name: "jupyterlab"
+        versions: [">=4.0.0"]

.github/workflows/post-test-status.yml

@@ -65,6 +65,44 @@ jobs:
               }
             }
 
+      - name: Post Percy status for fork/Dependabot PRs
+        # Percy needs PERCY_TOKEN to run, which is unavailable to fork PRs (and to
+        # Dependabot unless added to Dependabot secrets). Without a build, the
+        # Percy GitHub App never posts the required `percy/dash` status and the PR
+        # is blocked. Post a success status here so the check resolves — but only
+        # if Percy hasn't already posted one, so a real Percy result is never
+        # clobbered (e.g. when Dependabot does have the token).
+        if: >
+          github.event.workflow_run.head_repository.full_name != github.repository ||
+          github.event.workflow_run.actor.login == 'dependabot[bot]'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const sha = context.payload.workflow_run.head_sha;
+            const statusContext = 'percy/dash';
+
+            const { data: { statuses } } = await github.rest.repos.getCombinedStatus({
+              owner,
+              repo,
+              ref: sha,
+            });
+
+            if (statuses.some(s => s.context === statusContext)) {
+              console.log(`'${statusContext}' already posted — leaving it untouched.`);
+              return;
+            }
+
+            await github.rest.repos.createCommitStatus({
+              owner,
+              repo,
+              sha,
+              state: 'success',
+              context: statusContext,
+              description: 'Skipped — Percy unavailable for fork/Dependabot PRs',
+            });
+            console.log(`Posted skipped status for ${statusContext}`);
+
   test-report:
     name: Consolidated Test Report (Fork PR)
     runs-on: ubuntu-latest
@@ -79,6 +117,11 @@ jobs:
       checks: write
       actions: read
     steps:
+      # dorny/test-reporter runs `git ls-files` to resolve test paths, so the
+      # repo must be checked out. This workflow_run job otherwise has no checkout.
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
       - name: Download test results artifact
         uses: actions/download-artifact@v4
         with:

.github/workflows/testing.yml

@@ -70,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
 
     steps:
       - name: Checkout repository
@@ -123,7 +123,7 @@ jobs:
 
       - name: Run lint
         env:
-          PYLINT_EXTRA_ARGS: ${{ matrix.python-version == '3.8' && '--ignored-modules=mcp' || '' }}
+          PYLINT_EXTRA_ARGS: ${{ matrix.python-version == '3.9' && '--ignored-modules=mcp' || '' }}
         run: npm run lint
 
       - name: Run unit tests
@@ -615,7 +615,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
         test-group: ["1", "2", "3"]
 
     env:
@@ -719,7 +719,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
 
     env:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
@@ -866,7 +866,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
 
     steps:
       - name: Checkout repository
@@ -914,7 +914,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
         test-group: ["1", "2", "3"]
 
     env:

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

CHANGELOG.md

@@ -2,10 +2,28 @@
 All notable changes to `dash` will be documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.4.0] - 2026-07-03
+
+### Added
+- [#3826](https://github.com/plotly/dash/pull/3826) WebSocket callback dispatch no longer lets long-lived callbacks limit the number of concurrent users. Async callbacks (including session-persistent ones) run directly on the connection event loop instead of occupying a worker thread, and synchronous callbacks run on a shared `ThreadPoolExecutor` whose size is configurable via the new `websocket_max_workers` argument to `Dash` (default `4`). A synchronous persistent (no-output) callback now warns at registration since it would tie up a worker thread.
+
+## Fixed
+- [#3861](https://github.com/plotly/dash/issues/3861) Fix synchronous WebSocket callbacks not inheriting `ContextVar` values bound by ASGI middleware. `copy_context()` is now captured on the event-loop thread before the callback is submitted to the thread pool, instead of inside the worker thread where only default values were visible.
+- [#3779](https://github.com/plotly/dash/pull/3779) Fix `dash.testing` `Browser.get_logs()` returning `None` on non-Chrome webdrivers, which broke assertions like `assert dash_duo.get_logs() == []`. It now returns `[]`, matching the Chrome code path.
+- [#3822](https://github.com/plotly/dash/pull/3822) Fix `UnboundLocalError` for `user_callback_output` in async background callbacks (Celery and Diskcache managers) when the callback raises `PreventUpdate` or another exception before the variable is assigned.
+- [#3819](https://github.com/plotly/dash/pull/3819) Fix `RuntimeError: No active request in context` when a non-Dash path falls through to the FastAPI catch-all route. Fixes [#3812](https://github.com/plotly/dash/issues/3812).
+- [#3838](https://github.com/plotly/dash/pull/3838) Replace `mcp` dependency with inline types.
+- [#3824](https://github.com/plotly/dash/pull/3824) Fix `dash.testing` `ThreadedRunner.stop()` hanging at teardown for Quart apps. Fixes [#3823](https://github.com/plotly/dash/issues/3823).
+- [#3425](https://github.com/plotly/dash/issues/3425) dcc.DatePicker: Fix `updatemode="bothdates"` not always respected
+
+## Changed
+- Drop support for Python 3.8 (end-of-life since October 2024). The minimum supported version is now Python 3.9.
+
 ## [4.3.0] - 2026-06-18
 
 ## Added
 - [#3796](https://github.com/plotly/dash/pull/3796) MCP: Add `configure_mcp_server()` to toggle which content the MCP server exposes (`include_layout`, `include_callbacks`, `include_clientside_callbacks`, `include_pages`, `expose_callback_docstrings`). Only the parameters explicitly passed are updated; omitted parameters retain their current value.
+- [#3852](https://github.com/plotly/dash/pull/3852)  Added support for Plotly hoveranywhere and clickanywhere events in `dcc.Graph` by adding `xvals` and `yvals` to `hoverData` and `clickData`.
 
 ## Changed
 - [#3796](https://github.com/plotly/dash/pull/3796) MCP: Remove the `mcp_expose_docstrings` `Dash()` constructor argument; callback docstring exposure is now controlled via `configure_mcp_server(expose_callback_docstrings=...)`.

components/dash-core-components/.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true