dash 4.5.0

Dash Version 4.5.0

on Python PyPI

Added

• #4099 Streaming callbacks over HTTP now require shared storage and fail at server setup without it, instead of falling back to one connection per stream; WebSocket streaming callbacks do not need it.
• #4095 Make shared storage and the multiplexed streaming downlink opt-in (shared_storage= or DASH_SHARED_STORAGE), and move msgspec to a new dash[shared_storage] extra for the persistent LocalSharedStorage modes (dash[diskcache] and dash[redis] include it).
• #4026 Add DASH_SECRET_KEY so a hosting platform can give every worker and pod the same signing secret for page, background and stream tokens without editing the app (server.secret_key still wins and is not changed).
• #4026 Add DASH_SHARED_STORAGE to pick the shared-storage backend when the app does not pass shared_storage=: local, none, diskcache:///abs/path, or a redis:// / rediss:// URL.
• #4024 Add support for social media meta tags in regular Dash apps using app.title, app.description, and app.image.
• #3976 Add a new scrollToTop prop to dcc.Link to control whether the page scrolls to the top after client-side navigation. It defaults to True to preserve the existing behavior. Fixes #3974.
• #3947 Make plotly-cloud a default install dependency of Dash instead of an optional extra, so the plotly CLI and Dash's cloud integration work out of the box. The dash[cloud] extra is kept for backward compatibility.
• #3930 Add shared storage: a backend-agnostic cross-process state manager (key/value with optional TTL, plus ordered replayable pub/sub) via dash.ctx.shared_storage, started lazily. Ships LocalSharedStorage (in-memory with optional disk persistence), DiskcacheSharedStorage, and RedisSharedStorage for horizontally-scaled deployments; see .ai/ARCHITECTURE.md.
• #3931 Add streaming callbacks: an async def generator callback streams its yields to the browser as they are produced (dash.Patch yields apply incrementally). A browser's streams share one SharedWorker-hosted connection so they do not count against the per-host connection limit; closing a tab cancels its streams.
• #3977 Add partial WebSocket prop reads with get_prop(..., path=...). Closes #3975.
• #3765 Add opt-in partial pattern matching for callback Input, Output, and State via partial_pattern=True, so dictionary ID patterns can match component IDs with extra keys and combine with ALL/MATCH wildcards. Fixes #3764.
• #3880 Add experimental support for React 19 (default stays React 18.3.1); opt in with REACT_VERSION=19.2.4 or dash._dash_renderer._set_react_version("19.2.4"). Dash serves the umd-react package with a compatibility shim so component libraries built against React <=18 keep working; see .ai/ARCHITECTURE.md.
• #3925 Add optional callback request payload compression via compress_payload and compress_threshold callback parameters (default threshold 5,000 bytes), sending gzip payloads that Dash decompresses on Flask, FastAPI, and Quart. Fixes #3924.
• #3961 Added cursor position data (xPixel, yPixel) to dcc.Graph hoverData and clickData when hoveranywhere or clickanywhere is enabled in the figure.
• #3960 Rewrite dcc.Markdown and dcc.Link as Typescript components
• #3881 Added dash.remount, a wrapper for a callback-returned component that forces the renderer to remount it (resetting its internal state) instead of reconciling in place: the explicit way to reset a stateful component from a callback without changing its id.

Removed

• #3880 Remove React 16 support (16.14.0 is no longer an accepted value for REACT_VERSION / _set_react_version).
• #4039 Remove unnecessary Python version checks (pre 3.9).

Changed

• #4073 Move plotly-cloud back to the optional dash[cloud] extra (it was a default dependency in 4.5.0rc0/rc1), since it is not available on conda-forge.
• #4026 Log a warning, once per process, when a streaming request is refused because its stream token failed verification, which on multi-worker deployments usually means the workers do not share a signing secret.
• #3987 Forward FastAPI reload scope options (reload_dirs, reload_excludes, and reload_includes) to Uvicorn when reloading.
• #3986 Adjust _run_before_hooks in the fastapi backend to honor a response returned by a before_request function, matching the flask backend's behavior.

Fixed

• #4075 fastapi backend: run before_request hooks on every route of the Dash app (assets, hook routes, api_endpoint, pages, when mounted) and send a non-None hook result as the response, as on Flask. fastapi and quart also run them on the WebSocket handshake.
• #4075 Background callbacks without cache_by no longer share a result between requests with equal inputs (unread Diskcache results now expire after a day, or after expire when set, even with cache_by), and callbacks with the same source no longer share a cache key. build_cache_key takes a new callback_key argument.
• #4075 dcc.Location(refresh=True).href, html.Area.href and html.Base.href now block javascript: URLs like html.A.
• #4075 Pages path_template matching no longer errors or backtracks badly on paths with a newline.
• #4075 Add configure_mcp_server(cache_by=..., cache_maxsize=...) so apps whose layout or callbacks depend on the user can keep the MCP server's cached tool descriptions and initial values per user (128 users by default, None for no limit).
• #4052 Fix callbacks of removed components still firing after a callback returns None for children: the renderer now clears their paths. Fixes #4033.
• #4027 Support async def hook routes (dash.hooks.route) on all backends, stop hook routes from leaking the app context to the caller, and let hook routes and MCP read the request on the fastapi backend.
• #4053 Fix callbacks being registered twice under a reloader (e.g. uvicorn --reload) when Dash() is given an explicit name or is built by an app factory called from the main module. Fixes #3912.
• #3980 Fix the three before_request hooks (Dash._setup_server and the pages router_sync / router_async) publishing their "already done" guard flag before the setup work behind it had run. Under a multi-threaded WSGI worker such as gunicorn -k gthread (or under an ASGI worker for the async router), a second request arriving mid-setup could observe the flag already set, skip setup, then read registered_paths / callback_map / the pages router callback while they were still being registered - causing the first burst of component bundle requests after a restart to 500 with Error loading dependency. "<lib>" is not a registered library, or the pages router to hit DuplicateCallback when two workers raced past the guard. Each hook body now runs under a lock (threading.Lock for the two sync hooks, an asyncio.Lock bound to the running loop for the async router) and only publishes the flag after all work completes. Fixes #3971.
• #3944 Fix dash.testing runner backend detection for wrapped FastAPI/Quart servers so threaded Flask-only options are not passed to ASGI runners.
• #3955 Unpin selenium in the testing requirements (was capped at <=4.2.0 from 2022) and require >=4.11.0, so it can drive current stable Chrome via Selenium Manager and stop the widespread CI flakiness.
• #3881 Speed up the renderer layout crawl (crawlLayout and its callers) by replacing curried-ramda path/pathOr lookups with direct property access on the hot path: ~16% faster Patch().append() into a large container, with no behavior change.
• #3881 Fix pattern-matching (MATCH/ALL/ALLSMALLER) callbacks getting quadratically slower as matching components grow; a new O(1) id->path index cuts an ALL update over 400 components from ~580ms to ~140ms (~4x), with no app changes.
• #3941 Fix the FastAPI and Quart backends opening a WebSocket connection on every page load even for apps with no WebSocket callbacks; the socket now opens only when actually needed. Fixes #3939.
• #3916 Fixed a regression where dragging multiple files into dcc.Upload would upload only the first file when multiple=True
• #3922 Fix dcc.Input(type="number") stepper behavior when only min is set.
• #3936 Use the proxied url as the Jupyter server url so DASH_PROXY is honored by the external url and inline iframe in notebooks. Fixes #3401.
• #3938 Fix dcc.Patch() re-running the initial callbacks of components already on the page (including every MATCH/ALL element) and wiping their user-edited persisted values. Fixes #3681 and #3937
• #3960 Fix dcc.Markdown not rendering <dccLink /> by using newer dependencies
• #3881 Fix callback-returned children being unmounted and remounted on every update instead of reconciled in place, which reset component state and slowed large subtrees 3-4x (regression introduced in 4.2.0 by #3570); use dash.remount to force a remount. Fixes #3846.
• #3881 Fix components rendered as props (eg. dcc.Dropdown option labels, dcc.Tab labels) crashing or failing to update when the host subtree was replaced by a callback; out-of-tree ExternalWrapper components now re-insert themselves and update in place.
• #3881 Fix components that set their own initial state on mount (eg. dash-bootstrap-components Tabs) not applying it on first render, because descendant layout hashes were reset on the first fresh render (regression introduced in 4.2.0 by #3570). Fixes #3929.
• #3948 Fix page getting progressively slower as callbacks append children.
• #3915 Fix MCP tool results erroring when a figure cannot be rendered to an image (eg. Kaleido without Chrome); the image is now skipped. Fixes #3914.
• #3621 Fix component generation crashing when the path to extract-meta.js contains a space.
• #3895 Component generation errors from extract-meta.js now name the file, prop path and line where they originate. Fixes #3362.
• #4014 Disable autocomplete in DatePickerSingle and DatePickerRange inputs. Fixes #4009.
• #4007 Fix page loads failing with a 500 error on Windows when Dash is imported from an extended-length (\\?\) path, as in JupyterLab Desktop. Package resource paths are now joined with the OS separator instead of /. Fixes #3002.
• #4023 Fix extra callback registrations when an app runs from the parent directory: python app/app.py, where the script shares its folder's name, registered its callbacks twice, and python app/main.py imported a sibling app/app.py as the parent package and registered its callbacks too (regression introduced in 4.4.1 by #3883). Fixes #4011.
• #4057 Fixed background callbacks to update set_props instead of replacing. Fixes #3104.
• #3923 Fix a blank page and SyntaxError in the browser when a dict component ID has a dot in one of its values. Fixes #3480.
• #4074 Fix Pages passing percent-encoded path variables to layout and title, and the 404 page for paths with spaces or non-ASCII characters. Fixes #2360.
• #4012 Fix InvalidCallbackReturnValue raised when a no-output background callback's error handler returns None (or the job is cancelled), by treating None returns from error handlers and the cancelled-job branch the same way: NoUpdate() only when there are outputs, None otherwise. Fixes #3628.