dash 4.5.0rc1

Dash Version 4.5.0rc1

on Python PyPI

Added

• #4026 Add DASH_SECRET_KEY so a hosting platform can give every worker and pod the same signing secret for page, background and stream tokens without editing the app (server.secret_key still wins and is not changed).
• #4026 Add DASH_SHARED_STORAGE to pick the shared-storage backend when the app does not pass shared_storage=: local, none, diskcache:///abs/path, or a redis:// / rediss:// URL.
• #4024 Add support for social media meta tags in regular Dash apps using app.title, app.description, and app.image.
• #3976 Add a new scrollToTop prop to dcc.Link to control whether the page scrolls to the top after client-side navigation. It defaults to True to preserve the existing behavior. Fixes #3974.

Changed

• #4026 Log a warning, once per process, when a streaming request is refused because its stream token failed verification, which on multi-worker deployments usually means the workers do not share a signing secret.
• #3987 Forward FastAPI reload scope options (reload_dirs, reload_excludes, and reload_includes) to Uvicorn when reloading.

Fixed

• #4027 Support async def hook routes (dash.hooks.route) on all backends, stop hook routes from leaking the app context to the caller, and let hook routes and MCP read the request on the fastapi backend.
• #4053 Fix callbacks being registered twice under a reloader (e.g. uvicorn --reload) when Dash() is given an explicit name or is built by an app factory called from the main module. Fixes #3912.
• #4023 Fix extra callback registrations when an app runs from the parent directory: python app/app.py, where the script shares its folder's name, registered its callbacks twice, and python app/main.py imported a sibling app/app.py as the parent package and registered its callbacks too (regression introduced in 4.4.1 by #3883). Fixes #4011.
• #3980 Fix the three before_request hooks (Dash._setup_server and the pages router_sync / router_async) publishing their "already done" guard flag before the setup work behind it had run. Under a multi-threaded WSGI worker such as gunicorn -k gthread (or under an ASGI worker for the async router), a second request arriving mid-setup could observe the flag already set, skip setup, then read registered_paths / callback_map / the pages router callback while they were still being registered - causing the first burst of component bundle requests after a restart to 500 with Error loading dependency. "<lib>" is not a registered library, or the pages router to hit DuplicateCallback when two workers raced past the guard. Each hook body now runs under a lock (threading.Lock for the two sync hooks, an asyncio.Lock bound to the running loop for the async router) and only publishes the flag after all work completes. Fixes #3971.
• #4057 Fixed background callbacks to update set_props instead of replacing. Fixes #3104.
• #3923 Fix a blank page and SyntaxError in the browser when a dict component ID has a dot in one of its values. Fixes #3480.
• #4014 Disable autocomplete in DatePickerSingle and DatePickerRange inputs. Fixes #4009.
• #4007 Fix page loads failing with a 500 error on Windows when Dash is imported from an extended-length (\\?\) path, as in JupyterLab Desktop. Package resource paths are now joined with the OS separator instead of /. Fixes #3002.