build(deps): bump the dash-network group across 1 directory with 4 updates by dependabot[bot] · Pull Request #13 · pip-install-python/llms-2plot-dev

dependabot · 2026-11-02T13:36:28Z

Updates the requirements on plotly, dash, dash-mantine-components and dash-improve-my-llms to permit the latest version.
Updates plotly to 7.1.0

Release notes

Sourced from plotly's releases.

v7.1.0

Added

Support marginal_x/marginal_y="heatmap" in density_heatmap, drawing a single-row/column heatmap strip in the margin colored by the same z/histfunc aggregate as the main plot and sharing its color scale [#5706], with thanks to @lucasjamar for the contribution!

Add support for custom tick values in mpl_to_plotly when the matplotlib tick positions don't follow an arithmetic progression, including custom tick labels and tick values on date axes [#5262], with thanks to @robertoffmoura for the contribution!

Fixed

Fix Plotly Express treating unsigned integer columns (uint8, uint16, uint32, uint64) in pandas DataFrames as categorical, which caused px.bar and other functions to pick the wrong orientation and render unexpected plots [#4291, #4344], with thanks to @Belagum for the contribution!

Fix mpl_to_plotly not setting paper_bgcolor and plot_bgcolor from the matplotlib figure and axes backgrounds, so converted figures match the source figure's background colors [#5285], with thanks to @robertoffmoura for the contribution!

Fix rendering issue causing a too-large div when calling Figure.show() in Google Colab [#5718]

Fix the sphinx-gallery scraper so that it generates thumbnails for figures shown with fig.show() or displayed as the last expression of a code block [#5701], with thanks to @larsoner for the contribution!

The scaper now warns once (instead of failing the build) when static image export is unavailable

The sphinx-gallery scraper no longer scrapes files belonging to other examples during parallel builds [#5701], with thanks to @larsoner for the contribution!

Updated

Update plotly.js from version 4.0.0 to version 4.1.1 [#5722, #5730]. See the plotly.js release notes for v4.1.0 and v4.1.1 for details. Notable changes include:

Add an opt-in modebar button for downloading Plotly figures as JSON [#7990, #8022]

Add legend.groupdoubleclick to set the group behavior for a legend double-click [#7997]

Increase default double-click delay threshold to 500ms (from 300) [#8014]

Fix issue with per-point marker color for hover labels in scattergl, quiver traces [#8027]

Update maplibre-gl to v6 to address CVE-2026-85061 [#8035]

Note: Safari 15, Chrome 56, Firefox 51 and later are now required for map traces

Update hex_to_rgb function to raise error for invalid-length hex codes, and emit warning for hex codes containing alpha [#5729], with thanks to @dylanpulver for the contribution!

Changelog

Sourced from plotly's changelog.

[7.1.0] - 2026-09-15

Added

Support marginal_x/marginal_y="heatmap" in density_heatmap, drawing a single-row/column heatmap strip in the margin colored by the same z/histfunc aggregate as the main plot and sharing its color scale [#5706], with thanks to @lucasjamar for the contribution!

Add support for custom tick values in mpl_to_plotly when the matplotlib tick positions don't follow an arithmetic progression, including custom tick labels and tick values on date axes [#5262], with thanks to @robertoffmoura for the contribution!

Fixed

Fix Plotly Express treating unsigned integer columns (uint8, uint16, uint32, uint64) in pandas DataFrames as categorical, which caused px.bar and other functions to pick the wrong orientation and render unexpected plots [#4291, #4344], with thanks to @Belagum for the contribution!

Fix mpl_to_plotly not setting paper_bgcolor and plot_bgcolor from the matplotlib figure and axes backgrounds, so converted figures match the source figure's background colors [#5285], with thanks to @robertoffmoura for the contribution!

Fix rendering issue causing a too-large div when calling Figure.show() in Google Colab [#5718]

Fix the sphinx-gallery scraper so that it generates thumbnails for figures shown with fig.show() or displayed as the last expression of a code block [#5701], with thanks to @larsoner for the contribution!

The scaper now warns once (instead of failing the build) when static image export is unavailable

The sphinx-gallery scraper no longer scrapes files belonging to other examples during parallel builds [#5701], with thanks to @larsoner for the contribution!

Updated

Update plotly.js from version 4.0.0 to version 4.1.1 [#5722, #5730]. See the plotly.js release notes for v4.1.0 and v4.1.1 for details. Notable changes include:

Add an opt-in modebar button for downloading Plotly figures as JSON [#7990, #8022]

Add legend.groupdoubleclick to set the group behavior for a legend double-click [#7997]

Increase default double-click delay threshold to 500ms (from 300) [#8014]

Fix issue with per-point marker color for hover labels in scattergl, quiver traces [#8027]

Update maplibre-gl to v6 to address CVE-2026-85061 [#8035]

Note: Safari 15, Chrome 56, Firefox 51 and later are now required for map traces

Update hex_to_rgb function to raise error for invalid-length hex codes, and emit warning for hex codes containing alpha [#5729], with thanks to @dylanpulver for the contribution!

[7.0.0] - 2026-08-25

Fixed

Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @genrichez for the contribution!

Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]

Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @mishrakushal for the contribution!

Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @lucasjamar for the contribution!

Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @robertoffmoura for the contribution!

Updated

Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:

Add quiver trace type to visualize vector fields using arrows [#7710, #7945]

Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]

Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.

The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead

Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.

Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:

rgb()/rgba() strings with decimal 0–1 fractions are no longer supported

hsv() color strings are no longer supported

Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported

New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0 0% 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)

Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.

Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.

Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]

Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]

... (truncated)

Commits

243bfd0 version changes for v7.1.0
9b3c4da Merge pull request #5729 from dylanpulver/hex-to-rgb-rejects-invalid-length
3aa898c Merge branch 'main' into hex-to-rgb-rejects-invalid-length
a93dcc0 update changelog
7c85d48 add test for hex_to_rgb 4- and 8-character hex codes
80a94ec accept 4- and 8- character hex codes with a warning
ac78b8b Merge pull request #5726 from Belagum/px-unsigned-int-continuous
1cf7756 Merge branch 'main' into px-unsigned-int-continuous
ec79917 add attribution
ac7bc28 edit changelog entry
Additional commits viewable in compare view

Updates dash to 4.5.0

Release notes

Sourced from dash's releases.

Dash Version 4.5.0

Added

#4099 Streaming callbacks over HTTP now require shared storage and fail at server setup without it, instead of falling back to one connection per stream; WebSocket streaming callbacks do not need it.

#4095 Make shared storage and the multiplexed streaming downlink opt-in (shared_storage= or DASH_SHARED_STORAGE), and move msgspec to a new dash[shared_storage] extra for the persistent LocalSharedStorage modes (dash[diskcache] and dash[redis] include it).

#4026 Add DASH_SECRET_KEY so a hosting platform can give every worker and pod the same signing secret for page, background and stream tokens without editing the app (server.secret_key still wins and is not changed).

#4026 Add DASH_SHARED_STORAGE to pick the shared-storage backend when the app does not pass shared_storage=: local, none, diskcache:///abs/path, or a redis:// / rediss:// URL.

#4024 Add support for social media meta tags in regular Dash apps using app.title, app.description, and app.image.

#3976 Add a new scrollToTop prop to dcc.Link to control whether the page scrolls to the top after client-side navigation. It defaults to True to preserve the existing behavior. Fixes #3974.

#3947 Make plotly-cloud a default install dependency of Dash instead of an optional extra, so the plotly CLI and Dash's cloud integration work out of the box. The dash[cloud] extra is kept for backward compatibility.

#3930 Add shared storage: a backend-agnostic cross-process state manager (key/value with optional TTL, plus ordered replayable pub/sub) via dash.ctx.shared_storage, started lazily. Ships LocalSharedStorage (in-memory with optional disk persistence), DiskcacheSharedStorage, and RedisSharedStorage for horizontally-scaled deployments; see .ai/ARCHITECTURE.md.

#3931 Add streaming callbacks: an async def generator callback streams its yields to the browser as they are produced (dash.Patch yields apply incrementally). A browser's streams share one SharedWorker-hosted connection so they do not count against the per-host connection limit; closing a tab cancels its streams.

#3977 Add partial WebSocket prop reads with get_prop(..., path=...). Closes #3975.

#3765 Add opt-in partial pattern matching for callback Input, Output, and State via partial_pattern=True, so dictionary ID patterns can match component IDs with extra keys and combine with ALL/MATCH wildcards. Fixes #3764.

#3880 Add experimental support for React 19 (default stays React 18.3.1); opt in with REACT_VERSION=19.2.4 or dash._dash_renderer._set_react_version("19.2.4"). Dash serves the umd-react package with a compatibility shim so component libraries built against React <=18 keep working; see .ai/ARCHITECTURE.md.

#3925 Add optional callback request payload compression via compress_payload and compress_threshold callback parameters (default threshold 5,000 bytes), sending gzip payloads that Dash decompresses on Flask, FastAPI, and Quart. Fixes #3924.

#3961 Added cursor position data (xPixel, yPixel) to dcc.Graph hoverData and clickData when hoveranywhere or clickanywhere is enabled in the figure.

#3960 Rewrite dcc.Markdown and dcc.Link as Typescript components

#3881 Added dash.remount, a wrapper for a callback-returned component that forces the renderer to remount it (resetting its internal state) instead of reconciling in place: the explicit way to reset a stateful component from a callback without changing its id.

Removed

#3880 Remove React 16 support (16.14.0 is no longer an accepted value for REACT_VERSION / _set_react_version).

#4039 Remove unnecessary Python version checks (pre 3.9).

Changed

#4073 Move plotly-cloud back to the optional dash[cloud] extra (it was a default dependency in 4.5.0rc0/rc1), since it is not available on conda-forge.

#4026 Log a warning, once per process, when a streaming request is refused because its stream token failed verification, which on multi-worker deployments usually means the workers do not share a signing secret.

#3987 Forward FastAPI reload scope options (reload_dirs, reload_excludes, and reload_includes) to Uvicorn when reloading.

#3986 Adjust _run_before_hooks in the fastapi backend to honor a response returned by a before_request function, matching the flask backend's behavior.

Fixed

#4075 fastapi backend: run before_request hooks on every route of the Dash app (assets, hook routes, api_endpoint, pages, when mounted) and send a non-None hook result as the response, as on Flask. fastapi and quart also run them on the WebSocket handshake.

#4075 Background callbacks without cache_by no longer share a result between requests with equal inputs (unread Diskcache results now expire after a day, or after expire when set, even with cache_by), and callbacks with the same source no longer share a cache key. build_cache_key takes a new callback_key argument.

#4075 dcc.Location(refresh=True).href, html.Area.href and html.Base.href now block javascript: URLs like html.A.

#4075 Pages path_template matching no longer errors or backtracks badly on paths with a newline.

#4075 Add configure_mcp_server(cache_by=..., cache_maxsize=...) so apps whose layout or callbacks depend on the user can keep the MCP server's cached tool descriptions and initial values per user (128 users by default, None for no limit).

#4052 Fix callbacks of removed components still firing after a callback returns None for children: the renderer now clears their paths. Fixes #4033.

#4027 Support async def hook routes (dash.hooks.route) on all backends, stop hook routes from leaking the app context to the caller, and let hook routes and MCP read the request on the fastapi backend.

#4053 Fix callbacks being registered twice under a reloader (e.g. uvicorn --reload) when Dash() is given an explicit name or is built by an app factory called from the main module. Fixes #3912.

#3980 Fix the three before_request hooks (Dash._setup_server and the pages router_sync / router_async) publishing their "already done" guard flag before the setup work behind it had run. Under a multi-threaded WSGI worker such as gunicorn -k gthread (or under an ASGI worker for the async router), a second request arriving mid-setup could observe the flag already set, skip setup, then read registered_paths / callback_map / the pages router callback while they were still being registered - causing the first burst of component bundle requests after a restart to 500 with Error loading dependency. "<lib>" is not a registered library, or the pages router to hit DuplicateCallback when two workers raced past the guard. Each hook body now runs under a lock (threading.Lock for the two sync hooks, an asyncio.Lock bound to the running loop for the async router) and only publishes the flag after all work completes. Fixes #3971.

#3944 Fix dash.testing runner backend detection for wrapped FastAPI/Quart servers so threaded Flask-only options are not passed to ASGI runners.

#3955 Unpin selenium in the testing requirements (was capped at <=4.2.0 from 2022) and require >=4.11.0, so it can drive current stable Chrome via Selenium Manager and stop the widespread CI flakiness.

#3881 Speed up the renderer layout crawl (crawlLayout and its callers) by replacing curried-ramda path/pathOr lookups with direct property access on the hot path: ~16% faster Patch().append() into a large container, with no behavior change.

#3881 Fix pattern-matching (MATCH/ALL/ALLSMALLER) callbacks getting quadratically slower as matching components grow; a new O(1) id->path index cuts an ALL update over 400 components from ~580ms to ~140ms (~4x), with no app changes.

#3941 Fix the FastAPI and Quart backends opening a WebSocket connection on every page load even for apps with no WebSocket callbacks; the socket now opens only when actually needed. Fixes #3939.

#3916 Fixed a regression where dragging multiple files into dcc.Upload would upload only the first file when multiple=True

#3922 Fix dcc.Input(type="number") stepper behavior when only min is set.

#3936 Use the proxied url as the Jupyter server url so DASH_PROXY is honored by the external url and inline iframe in notebooks. Fixes #3401.

#3938 Fix dcc.Patch() re-running the initial callbacks of components already on the page (including every MATCH/ALL element) and wiping their user-edited persisted values. Fixes #3681 and #3937

#3960 Fix dcc.Markdown not rendering <dccLink /> by using newer dependencies

... (truncated)

Changelog

Sourced from dash's changelog.

[4.5.0] - 2026-10-29

Added

#4099 Streaming callbacks over HTTP now require shared storage and fail at server setup without it, instead of falling back to one connection per stream; WebSocket streaming callbacks do not need it.

#4095 Make shared storage and the multiplexed streaming downlink opt-in (shared_storage= or DASH_SHARED_STORAGE), and move msgspec to a new dash[shared_storage] extra for the persistent LocalSharedStorage modes (dash[diskcache] and dash[redis] include it).

#4026 Add DASH_SECRET_KEY so a hosting platform can give every worker and pod the same signing secret for page, background and stream tokens without editing the app (server.secret_key still wins and is not changed).

#4026 Add DASH_SHARED_STORAGE to pick the shared-storage backend when the app does not pass shared_storage=: local, none, diskcache:///abs/path, or a redis:// / rediss:// URL.

#4024 Add support for social media meta tags in regular Dash apps using app.title, app.description, and app.image.

#3976 Add a new scrollToTop prop to dcc.Link to control whether the page scrolls to the top after client-side navigation. It defaults to True to preserve the existing behavior. Fixes #3974.

#3947 Make plotly-cloud a default install dependency of Dash instead of an optional extra, so the plotly CLI and Dash's cloud integration work out of the box. The dash[cloud] extra is kept for backward compatibility.

#3930 Add shared storage: a backend-agnostic cross-process state manager (key/value with optional TTL, plus ordered replayable pub/sub) via dash.ctx.shared_storage, started lazily. Ships LocalSharedStorage (in-memory with optional disk persistence), DiskcacheSharedStorage, and RedisSharedStorage for horizontally-scaled deployments; see .ai/ARCHITECTURE.md.

#3931 Add streaming callbacks: an async def generator callback streams its yields to the browser as they are produced (dash.Patch yields apply incrementally). A browser's streams share one SharedWorker-hosted connection so they do not count against the per-host connection limit; closing a tab cancels its streams.

#3977 Add partial WebSocket prop reads with get_prop(..., path=...). Closes #3975.

#3765 Add opt-in partial pattern matching for callback Input, Output, and State via partial_pattern=True, so dictionary ID patterns can match component IDs with extra keys and combine with ALL/MATCH wildcards. Fixes #3764.

#3880 Add experimental support for React 19 (default stays React 18.3.1); opt in with REACT_VERSION=19.2.4 or dash._dash_renderer._set_react_version("19.2.4"). Dash serves the umd-react package with a compatibility shim so component libraries built against React <=18 keep working; see .ai/ARCHITECTURE.md.

#3925 Add optional callback request payload compression via compress_payload and compress_threshold callback parameters (default threshold 5,000 bytes), sending gzip payloads that Dash decompresses on Flask, FastAPI, and Quart. Fixes #3924.

#3961 Added cursor position data (xPixel, yPixel) to dcc.Graph hoverData and clickData when hoveranywhere or clickanywhere is enabled in the figure.

#3960 Rewrite dcc.Markdown and dcc.Link as Typescript components

#3881 Added dash.remount, a wrapper for a callback-returned component that forces the renderer to remount it (resetting its internal state) instead of reconciling in place: the explicit way to reset a stateful component from a callback without changing its id.

Removed

#3880 Remove React 16 support (16.14.0 is no longer an accepted value for REACT_VERSION / _set_react_version).

#4039 Remove unnecessary Python version checks (pre 3.9).

Changed

#4073 Move plotly-cloud back to the optional dash[cloud] extra (it was a default dependency in 4.5.0rc0/rc1), since it is not available on conda-forge.

#4026 Log a warning, once per process, when a streaming request is refused because its stream token failed verification, which on multi-worker deployments usually means the workers do not share a signing secret.

#3987 Forward FastAPI reload scope options (reload_dirs, reload_excludes, and reload_includes) to Uvicorn when reloading.

#3986 Adjust _run_before_hooks in the fastapi backend to honor a response returned by a before_request function, matching the flask backend's behavior.

Fixed

#4075 fastapi backend: run before_request hooks on every route of the Dash app (assets, hook routes, api_endpoint, pages, when mounted) and send a non-None hook result as the response, as on Flask. fastapi and quart also run them on the WebSocket handshake.

#4075 Background callbacks without cache_by no longer share a result between requests with equal inputs (unread Diskcache results now expire after a day, or after expire when set, even with cache_by), and callbacks with the same source no longer share a cache key. build_cache_key takes a new callback_key argument.

#4075 dcc.Location(refresh=True).href, html.Area.href and html.Base.href now block javascript: URLs like html.A.

#4075 Pages path_template matching no longer errors or backtracks badly on paths with a newline.

#4075 Add configure_mcp_server(cache_by=..., cache_maxsize=...) so apps whose layout or callbacks depend on the user can keep the MCP server's cached tool descriptions and initial values per user (128 users by default, None for no limit).

#4052 Fix callbacks of removed components still firing after a callback returns None for children: the renderer now clears their paths. Fixes #4033.

#4027 Support async def hook routes (dash.hooks.route) on all backends, stop hook routes from leaking the app context to the caller, and let hook routes and MCP read the request on the fastapi backend.

#4053 Fix callbacks being registered twice under a reloader (e.g. uvicorn --reload) when Dash() is given an explicit name or is built by an app factory called from the main module. Fixes #3912.

#3980 Fix the three before_request hooks (Dash._setup_server and the pages router_sync / router_async) publishing their "already done" guard flag before the setup work behind it had run. Under a multi-threaded WSGI worker such as gunicorn -k gthread (or under an ASGI worker for the async router), a second request arriving mid-setup could observe the flag already set, skip setup, then read registered_paths / callback_map / the pages router callback while they were still being registered - causing the first burst of component bundle requests after a restart to 500 with Error loading dependency. "<lib>" is not a registered library, or the pages router to hit DuplicateCallback when two workers raced past the guard. Each hook body now runs under a lock (threading.Lock for the two sync hooks, an asyncio.Lock bound to the running loop for the async router) and only publishes the flag after all work completes. Fixes #3971.

#3944 Fix dash.testing runner backend detection for wrapped FastAPI/Quart servers so threaded Flask-only options are not passed to ASGI runners.

#3955 Unpin selenium in the testing requirements (was capped at <=4.2.0 from 2022) and require >=4.11.0, so it can drive current stable Chrome via Selenium Manager and stop the widespread CI flakiness.

#3881 Speed up the renderer layout crawl (crawlLayout and its callers) by replacing curried-ramda path/pathOr lookups with direct property access on the hot path: ~16% faster Patch().append() into a large container, with no behavior change.

#3881 Fix pattern-matching (MATCH/ALL/ALLSMALLER) callbacks getting quadratically slower as matching components grow; a new O(1) id->path index cuts an ALL update over 400 components from ~580ms to ~140ms (~4x), with no app changes.

#3941 Fix the FastAPI and Quart backends opening a WebSocket connection on every page load even for apps with no WebSocket callbacks; the socket now opens only when actually needed. Fixes #3939.

#3916 Fixed a regression where dragging multiple files into dcc.Upload would upload only the first file when multiple=True

#3922 Fix dcc.Input(type="number") stepper behavior when only min is set.

#3936 Use the proxied url as the Jupyter server url so DASH_PROXY is honored by the external url and inline iframe in notebooks. Fixes #3401.

#3938 Fix dcc.Patch() re-running the initial callbacks of components already on the page (including every MATCH/ALL element) and wiping their user-edited persisted values. Fixes #3681 and #3937

#3960 Fix dcc.Markdown not rendering <dccLink /> by using newer dependencies

... (truncated)

Commits

9b04a1d Merge pull request #4101 from plotly/master-4.5.0
f7ad523 Version 4.5.0 build artifacts
fa4f243 Merge remote-tracking branch 'origin/dev' into master-4.5.0
00b8ed6 Merge pull request #4100 from plotly/release-4.5.0
3ba04eb Backfill 4.5.0 CHANGELOG entries and PR links
28b5375 version 4.5.0
3bc84a4 Merge pull request #4099 from plotly/stream-requires-shared-storage
acd5383 Add PR number to CHANGELOG
076e5af Require shared storage for HTTP streaming callbacks
5abb55c Merge pull request #4095 from plotly/shared-storage-opt-in
Additional commits viewable in compare view

Updates dash-mantine-components to 3.0.0

Release notes

Sourced from dash-mantine-components's releases.

3.0.0

Change Log

3.0.0

DMC v3 is based on Mantine v9, upgrading from Mantine v8.

See live examples and complete changelog in Dash Mantine Components v3 Release

Breaking Changes

See the Mantine v9 migration guide for additional details on upstream changes.

See the Dash Mantine Components Migration Guide for details on migrating Dash apps.

DMC v3 requires Dash >= 4.5 and React 19.2.4. PR738

TypographyStylesProvider renamed to Typography. PR738

Grid: Renamed gutter to gap. PR738

Popover and Tooltip: Removed positionDependencies. PR738

Spoiler: Renamed initialState to defaultExpanded. PR746

Default theme updates for light variant colors, border radius, and font weights. See the migration guide for details.

New Components

Added Pill component. PR746

Added Marquee component. PR 753 by @budescode

Added Splitter: Provides a resizable split-pane layout. PR750 by @datenzauberai

Added

Collapse: Updated the internal prop from in to expanded. The DMC API continues to use opened. Added orientation="horizontal" and keepMounted. PR738

Card: Added orientation="horizontal".

Checkbox.Group: Added maxSelectedValues.

Input components: Added loading and loadingPosition.

MultiSelect and TagsInput: Added renderPill and withPillsReorder.

Clearable inputs: Added clearSectionMode.

PasswordInput: Added visibilityToggleFocusable.

ColorInput: Added fullWidth

Highlight: Added per-term colors, wholeWord, caseInsensitive, and accentInsensitive.

Pagination: Added startValue, support for input size values, responsive layout, and function support for formatLabel.

Slider and RangeSlider: Added vertical orientation and support for hidden marks. Slider also adds thumbLabel, thumbProps, and startPointValue. RangeSlider adds thumbLabel, thumbValueText, and hiddenInputProps.

SimpleGrid: Added minColWidth, autoFlow, and autoRows.

DatePicker: Added fullWidth to the calendar.

Date pickers: Added function support for valueFormat and valueFormatter, plus withNativeLevelSupport and yearsSelectRange.

DateTimePicker: Added type="range".

MonthPickerInput and YearPickerInput: Added presets.

TimePicker: Added type="duration" and closes the dropdown when a preset is selected.

ScrollArea: Added startScrollPosition and verticalScrollbarPosition.

Stepper, Tree, Accordion, NavLink, and Tabs.Panel: Added keepMounted.

Stepper: Added labelPosition

Accordion: Added disableCollapse.

... (truncated)

Changelog

Sourced from dash-mantine-components's changelog.

3.0.0

See live examples and complete changelog in Dash Mantine Components v3 Release

Breaking Changes

See the Mantine v9 migration guide for additional details on upstream changes.

See the Dash Mantine Components Migration Guide for details on migrating Dash apps.

DMC v3 requires Dash >= 4.5 and React 19.2.4. PR738

TypographyStylesProvider renamed to Typography. PR738

Grid: Renamed gutter to gap. PR738

Popover and Tooltip: Removed positionDependencies. PR738

Spoiler: Renamed initialState to defaultExpanded. PR746

Default theme updates for light variant colors, border radius, and font weights. See the migration guide for details.

New Components

Added Pill component. PR746

Added Marquee component. PR 753 by @budescode

Added Splitter: Provides a resizable split-pane layout. PR750 by @datenzauberai

Added

Collapse: Updated the internal prop from in to expanded. The DMC API continues to use opened. Added orientation="horizontal" and keepMounted. PR738

Card: Added orientation="horizontal".

Checkbox.Group: Added maxSelectedValues.

Input components: Added loading and loadingPosition.

MultiSelect and TagsInput: Added renderPill and withPillsReorder.

Clearable inputs: Added clearSectionMode.

PasswordInput: Added visibilityToggleFocusable.

ColorInput: Added fullWidth

Highlight: Added per-term colors, wholeWord, caseInsensitive, and accentInsensitive.

Pagination: Added startValue, support for input size values, responsive layout, and function support for formatLabel.

Slider and RangeSlider: Added vertical orientation and support for hidden marks. Slider also adds thumbLabel, thumbProps, and startPointValue. RangeSlider adds thumbLabel, thumbValueText, and hiddenInputProps.

SimpleGrid: Added minColWidth, autoFlow, and autoRows.

DatePicker: Added fullWidth to the calendar.

Date pickers: Added function support for valueFormat and valueFormatter, plus withNativeLevelSupport and yearsSelectRange.

DateTimePicker: Added type="range".

MonthPickerInput and YearPickerInput: Added presets.

TimePicker: Added type="duration" and closes the dropdown when a preset is selected.

ScrollArea: Added startScrollPosition and verticalScrollbarPosition.

Stepper, Tree, Accordion, NavLink, and Tabs.Panel: Added keepMounted.

Stepper: Added labelPosition

Accordion: Added disableCollapse.

Indicator: Added maxValue, showZero, and support for offset={{x, y}}.

NumberInput: Added selectAllOnFocus.

RingProgress: Added sectionGap, startAngle, and transitionDuration.

List: Added start and reversed.

JsonInput: Added indentSpaces.

... (truncated)

Commits

7533ddc Merge pull request #756 from snehilvj/v3
8c60f75 update requirements.txt
ee77bbc update changelog
b7fe0e5 update changelog
939ce0f update to 9.7.4 and dmc version to 3.0.0
5cf67d3 Updated splitter types and removed sample apps
d20c863 Merge pull request #750 from datenzauberai/v3-add-splitter-component
162ddfc Another try to add a CHANGELOG entry
8f66931 Merge branch 'v3' into v3-add-splitter-component
4651960 CHANGELOG
Additional commits viewable in compare view

Updates dash-improve-my-llms to 2.10.0

Release notes

Sourced from dash-improve-my-llms's releases.

v2.10.0

Cloudflare's agent-readiness scan failed this network on checks it already satisfied in substance. Chasing those was worth one release; the thing the scan does not check was worth doing first.

Fixed — every /.well-known/* path answered 200 with the app shell

Measured on three live hosts and reproduced in-process on all three adapters: every path under /.well-known/ returned 200 and a Dash page, and so did /auth.md, and /openapi.json on the backends that have no schema. An agent asking for an API catalog, an agent card or OAuth metadata got a web page and no way to tell.

That is a soft-404 on the one namespace whose entire purpose is machine discovery, and it makes every document published there worthless: an agent that gets 200 for /.well-known/anything learns nothing from getting 200 for /.well-known/api-catalog. Refusing the unknown is what makes the known worth reading, which is why the guard ships in the same release as the documents rather than after them.

Unknown discovery paths now answer 404 with {"error":"not found","see":"/llms.txt"} and Cache-Control: no-store, on all three adapters, for every User-agent. Registered as routes rather than middleware, so precedence is the routing table's own: a host's own /.well-known/ route still wins, and Dash's page catch-all loses to both. /openapi.json is claimed only where nothing else serves it — FastAPI's real schema is untouched.

Added — Content-Signal in robots.txt

One line in the User-agent: * group, derived from the same RobotsConfig that renders the groups below it, never hand-typed: search follows allow_traditional, ai-input follows allow_ai_search, ai-train follows block_ai_training inverted. A signal that disagrees with the directives under it is worse than no signal — and Cloudflare's injected default said ai-train=no, the opposite of a host that deliberately allows training crawlers so their reads can be attributed.

Added — Accept: text/markdown on page routes

A request for a page URL whose Accept prefers markdown over HTML now receives that page's markdown twin: the same bytes /<page>/llms.txt serves, because they already are the markdown representation of that page — a second rendering would be a second thing to keep true. Content-Type: text/markdown, Vary: Accept, User-Agent, plus the Link and source-digest headers the llms routes carry.

Strictly preferred, by a real q-value parse with RFC 9110 specificity ordering: */*, a tie, and a browser's

... (truncated)

Changelog

Sourced from dash-improve-my-llms's changelog.

[2.10.0] - 2026-09-02 — the machine surface refuses what it does not serve

Cloudflare's agent-readiness scan failed this network on checks it already satisfied in substance. Chasing those was worth one release; the thing the scan does not check was worth doing first.

Fixed — every /.well-known/* path answered 200 with the app shell

Measured on three live hosts and reproduced in-process on all three adapters: every path under /.well-known/ returned 200 and a Dash page, and so did /auth.md, and /openapi.json on the backends that have no schema. An agent asking for an API catalog, an agent card or OAuth metadata got a web page and no way to tell.

That is a soft-404 on the one namespace whose entire purpose is machine discovery, and it makes every document published there worthless: an agent that gets 200 for /.well-known/anything learns nothing from getting 200 for /.well-known/api-catalog. Refusing the unknown is what makes the known worth reading, which is why the guard ships in the same release as the documents rather than after them.

Unknown discovery paths now answer 404 with {"error":"not found","see":"/llms.txt"} and Cache-Control: no-store, on all three adapters, for every User-agent. Registered as routes rather than middleware, so precedence is the rou...
Description has been truncated

…dates Updates the requirements on [plotly](https://github.com/plotly/plotly.py), [dash](https://github.com/plotly/dash), [dash-mantine-components](https://github.com/snehilvj/dash-mantine-components) and [dash-improve-my-llms](https://github.com/pip-install-python/dash-improve-my-llms) to permit the latest version. Updates `plotly` to 7.1.0 - [Release notes](https://github.com/plotly/plotly.py/releases) - [Changelog](https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md) - [Commits](plotly/plotly.py@v6.9.0...v7.1.0) Updates `dash` to 4.5.0 - [Release notes](https://github.com/plotly/dash/releases) - [Changelog](https://github.com/plotly/dash/blob/dev/CHANGELOG.md) - [Commits](plotly/dash@v4.4.1...v4.5.0) Updates `dash-mantine-components` to 3.0.0 - [Release notes](https://github.com/snehilvj/dash-mantine-components/releases) - [Changelog](https://github.com/snehilvj/dash-mantine-components/blob/master/CHANGELOG.md) - [Commits](snehilvj/dash-mantine-components@2.8.0...3.0.0) Updates `dash-improve-my-llms` to 2.10.0 - [Release notes](https://github.com/pip-install-python/dash-improve-my-llms/releases) - [Changelog](https://github.com/pip-install-python/dash-improve-my-llms/blob/main/CHANGELOG.md) - [Commits](pip-install-python/dash-improve-my-llms@v2.8.0...v2.10.0) --- updated-dependencies: - dependency-name: plotly dependency-version: 7.1.0 dependency-type: direct:production dependency-group: dash-network - dependency-name: dash dependency-version: 4.5.0 dependency-type: direct:production dependency-group: dash-network - dependency-name: dash-mantine-components dependency-version: 3.0.0 dependency-type: direct:production dependency-group: dash-network - dependency-name: dash-improve-my-llms dependency-version: 2.10.0 dependency-type: direct:production dependency-group: dash-network ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 2, 2026

Navigation Menu

Repository navigation

build(deps): bump the dash-network group across 1 directory with 4 updates - #13

build(deps): bump the dash-network group across 1 directory with 4 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dash-network-9801c9e61a

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026

v7.1.0

Added

Fixed

Updated

[7.1.0] - 2026-09-15

Added

Fixed

Updated

[7.0.0] - 2026-08-25

Fixed

Updated

Dash Version 4.5.0

Added

Removed

Changed

Fixed

[4.5.0] - 2026-10-29

Added

Removed

Changed

Fixed

3.0.0

Change Log

3.0.0

Breaking Changes

New Components

Added

3.0.0

Breaking Changes

New Components

Added

v2.10.0

Fixed — every /.well-known/* path answered 200 with the app shell

Added — Content-Signal in robots.txt

Added — Accept: text/markdown on page routes

[2.10.0] - 2026-09-02 — the machine surface refuses what it does not serve

Fixed — every /.well-known/* path answered 200 with the app shell

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Fixed — every `/.well-known/*` path answered 200 with the app shell

Added — `Content-Signal` in robots.txt

Added — `Accept: text/markdown` on page routes

Fixed — every `/.well-known/*` path answered 200 with the app shell