Merge branch 'dev' into fix/quart-threadedrunner-stop-graceful-shutdown

Author: T4rk1n

.envrc

@@ -6,3 +6,8 @@ for venv_dir in .venv .env venv env .venv* env* ENV; do
         break
     fi
 done
+
+# Include optional, local-only environment overrides
+if [ -f .env ]; then
+    dotenv
+fi

.github/actions/percy-exec/action.yml

@@ -13,6 +13,10 @@ inputs:
     description: 'Working directory for the command'
     required: false
     default: '.'
+  browser-executable:
+    description: 'Path to a Chrome/Chromium binary for Percy to use. Defaults to the one found on PATH.'
+    required: false
+    default: ''
 
 runs:
   using: 'composite'
@@ -23,7 +27,19 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         PERCY_TOKEN: ${{ inputs.percy-token }}
-      run: npx percy exec -- ${{ inputs.command }}
+        PERCY_BROWSER_EXECUTABLE: ${{ inputs.browser-executable }}
+      run: |
+        # Percy otherwise downloads its own Chromium from storage.googleapis.com
+        # on the first snapshot. That download stalls in CI, which blocks the
+        # synchronous percy_snapshot() calls (so pytest never finishes and writes
+        # no JUnit) and leaves an empty Percy build with no snapshots. Point Percy
+        # at the Chrome already installed in the job so it skips the download.
+        if [ -z "${PERCY_BROWSER_EXECUTABLE:-}" ]; then
+          PERCY_BROWSER_EXECUTABLE="$(command -v google-chrome || command -v google-chrome-stable || command -v chrome || command -v chromium || command -v chromium-browser || true)"
+          export PERCY_BROWSER_EXECUTABLE
+        fi
+        echo "PERCY_BROWSER_EXECUTABLE=${PERCY_BROWSER_EXECUTABLE:-<unset: Percy will download Chromium>}"
+        npx percy exec -- ${{ inputs.command }}
 
     - name: Run without Percy (fork PR)
       if: inputs.percy-token == ''

.github/dependabot.yml

@@ -43,8 +43,6 @@ updates:
       - dependency-name: "babel-loader"
       - dependency-name: "ts-loader"
       - dependency-name: "cookie"
-      - dependency-name: "eslint*"
-      - dependency-name: "prettier"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
 
@@ -75,10 +73,12 @@ updates:
       - dependency-name: "@types/*"
       - dependency-name: "@babel/*"
       - dependency-name: "babel-loader"
-      - dependency-name: "eslint*"
-      - dependency-name: "prettier"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
 
   # Components - dash-html-components
   - package-ecosystem: "npm"
@@ -101,9 +101,12 @@ updates:
       - dependency-name: "@types/*"
       - dependency-name: "@babel/*"
       - dependency-name: "babel-loader"
-      - dependency-name: "eslint*"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
 
   # Components - dash-table
   - package-ecosystem: "npm"
@@ -130,10 +133,12 @@ updates:
       - dependency-name: "css-loader"
       - dependency-name: "less"
       - dependency-name: "less-loader"
-      - dependency-name: "eslint*"
-      - dependency-name: "prettier"
       - dependency-name: "webpack*"
       - dependency-name: "typescript"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
 
   # Python dependencies
   - package-ecosystem: "pip"
@@ -143,6 +148,10 @@ updates:
       day: "monday"
     cooldown:
       default-days: 14
+    # Keep lower bounds (e.g. Flask>=1.0.4 in install.txt) low: only raise a
+    # floor when the latest release is incompatible with the current range.
+    # Exact (==) pins in ci/dev/testing still update as normal.
+    versioning-strategy: increase-if-necessary
     groups:
       pip-dependencies:
         applies-to: version-updates
@@ -152,3 +161,8 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+    # jupyterlab is pinned <4.0.0: jupyterlab 4.x ships jlpm as Yarn Berry, which
+    # cannot consume @plotly/dash-jupyterlab's Yarn 1 lockfile and breaks the build.
+    ignore:
+      - dependency-name: "jupyterlab"
+        versions: [">=4.0.0"]

.github/workflows/post-test-status.yml

@@ -65,17 +65,63 @@ jobs:
               }
             }
 
+      - name: Post Percy status for fork/Dependabot PRs
+        # Percy needs PERCY_TOKEN to run, which is unavailable to fork PRs (and to
+        # Dependabot unless added to Dependabot secrets). Without a build, the
+        # Percy GitHub App never posts the required `percy/dash` status and the PR
+        # is blocked. Post a success status here so the check resolves — but only
+        # if Percy hasn't already posted one, so a real Percy result is never
+        # clobbered (e.g. when Dependabot does have the token).
+        if: >
+          github.event.workflow_run.head_repository.full_name != github.repository ||
+          github.event.workflow_run.actor.login == 'dependabot[bot]'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const sha = context.payload.workflow_run.head_sha;
+            const statusContext = 'percy/dash';
+
+            const { data: { statuses } } = await github.rest.repos.getCombinedStatus({
+              owner,
+              repo,
+              ref: sha,
+            });
+
+            if (statuses.some(s => s.context === statusContext)) {
+              console.log(`'${statusContext}' already posted — leaving it untouched.`);
+              return;
+            }
+
+            await github.rest.repos.createCommitStatus({
+              owner,
+              repo,
+              sha,
+              state: 'success',
+              context: statusContext,
+              description: 'Skipped — Percy unavailable for fork/Dependabot PRs',
+            });
+            console.log(`Posted skipped status for ${statusContext}`);
+
   test-report:
     name: Consolidated Test Report (Fork PR)
     runs-on: ubuntu-latest
-    # Only run for fork PRs (non-fork PRs are handled in the main workflow)
+    # Run for fork PRs and Dependabot PRs. Both run with a read-only
+    # GITHUB_TOKEN in the main workflow, so the check run is created here in the
+    # base-repo context instead. Other same-repo PRs are handled in the main workflow.
     if: |
       github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.head_repository.full_name != github.repository
+      (github.event.workflow_run.head_repository.full_name != github.repository ||
+       github.event.workflow_run.actor.login == 'dependabot[bot]')
     permissions:
       checks: write
       actions: read
     steps:
+      # dorny/test-reporter runs `git ls-files` to resolve test paths, so the
+      # repo must be checked out. This workflow_run job otherwise has no checkout.
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
       - name: Download test results artifact
         uses: actions/download-artifact@v4
         with:

.github/workflows/testing.yml

@@ -70,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
 
     steps:
       - name: Checkout repository
@@ -108,7 +108,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip wheel
           python -m pip install "setuptools<80.0.0"
-          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[dev,ci,testing]"' \;
+          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[dev,ci,testing,diskcache]"' \;
 
       - name: Install dash-renderer dependencies
         working-directory: dash/dash-renderer
@@ -122,6 +122,8 @@ jobs:
           echo "DISPLAY=:99" >> $GITHUB_ENV
 
       - name: Run lint
+        env:
+          PYLINT_EXTRA_ARGS: ${{ matrix.python-version == '3.9' && '--ignored-modules=mcp' || '' }}
         run: npm run lint
 
       - name: Run unit tests
@@ -229,7 +231,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip wheel
           python -m pip install "setuptools<80.0.0"
-          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev]"' \;
+          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev,diskcache]"' \;
 
       - name: Build/Setup test components
         run: npm run setup-tests.py  # TODO build the packages and save them to packages/ in build job
@@ -613,13 +615,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
         test-group: ["1", "2", "3"]
 
     env:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
       PERCY_ENABLE: ${{ matrix.python-version == '3.12' && '1' || '0' }}
       PERCY_PARALLEL_TOTAL: -1
+      # Pin the build identity so every shard joins the same parallel build and
+      # Percy links it to the PR. Auto-detection otherwise uses the ephemeral
+      # merge SHA (refs/pull/N/merge), so the build never shows up on the PR.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
 
     steps:
       - name: Checkout repository
@@ -654,6 +664,7 @@ jobs:
           find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev,celery,diskcache]"' \;
 
       - name: Setup Chrome and ChromeDriver
+        id: setup-chrome
         uses: browser-actions/setup-chrome@v1
         with:
           chrome-version: stable
@@ -678,6 +689,7 @@ jobs:
         with:
           command: pytest --headless --nopercyfinalize --junitxml=test-reports/junit_intg.xml tests/integration --splits 3 --group ${{ matrix.test-group }}
           percy-token: ${{ secrets.PERCY_TOKEN }}
+          browser-executable: ${{ steps.setup-chrome.outputs.chrome-path }}
 
       - name: Upload test results
         if: always()
@@ -707,12 +719,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
 
     env:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
       PERCY_ENABLE: ${{ matrix.python-version == '3.12' && '1' || '0' }}
       PERCY_PARALLEL_TOTAL: -1
+      # Pin the build identity so every shard joins the same parallel build and
+      # Percy links it to the PR. Auto-detection otherwise uses the ephemeral
+      # merge SHA (refs/pull/N/merge), so the build never shows up on the PR.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
 
     steps:
       - name: Checkout repository
@@ -747,6 +767,7 @@ jobs:
           find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev]"' \;
 
       - name: Setup Chrome and ChromeDriver
+        id: setup-chrome
         uses: browser-actions/setup-chrome@v1
         with:
           chrome-version: stable
@@ -773,6 +794,7 @@ jobs:
         with:
           command: pytest --headless --nopercyfinalize --junitxml=test-reports/junit_html.xml
           percy-token: ${{ secrets.PERCY_TOKEN }}
+          browser-executable: ${{ steps.setup-chrome.outputs.chrome-path }}
           working-directory: components/dash-html-components
 
       - name: Upload test results
@@ -844,7 +866,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
 
     steps:
       - name: Checkout repository
@@ -892,13 +914,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
         test-group: ["1", "2", "3"]
 
     env:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
       PERCY_ENABLE: ${{ matrix.python-version == '3.12' && '1' || '0' }}
       PERCY_PARALLEL_TOTAL: -1
+      # Pin the build identity so every shard joins the same parallel build and
+      # Percy links it to the PR. Auto-detection otherwise uses the ephemeral
+      # merge SHA (refs/pull/N/merge), so the build never shows up on the PR.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
 
     steps:
       - name: Checkout repository
@@ -1016,6 +1046,7 @@ jobs:
           find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev]"' \;
 
       - name: Setup Chrome and ChromeDriver
+        id: setup-chrome
         uses: browser-actions/setup-chrome@v1
         with:
           chrome-version: stable
@@ -1034,6 +1065,10 @@ jobs:
       - name: Run Table visual tests
         if: env.PERCY_TOKEN != ''
         working-directory: components/dash-table
+        # percy-storybook bundles an old puppeteer whose Chromium is absent on
+        # the runner; point it at the system Chrome installed above.
+        env:
+          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
         run: npm run test.visual
 
       - name: Skip Table visual tests (fork PR)
@@ -1056,6 +1091,13 @@ jobs:
     if: always()
     env:
       PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
+      # Must match the snapshot jobs so finalize targets the same parallel build
+      # and the result is attached to the PR head commit, not the merge SHA.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
     steps:
       - name: Finalize Main Percy Build
         if: |
@@ -1093,8 +1135,9 @@ jobs:
 
       - name: Publish Test Report
         uses: dorny/test-reporter@v1
-        # Skip for fork PRs - handled by post-test-status.yml workflow_run
-        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        # Skip for fork PRs and Dependabot PRs - both run with a read-only
+        # GITHUB_TOKEN, so they're handled by post-test-status.yml workflow_run.
+        if: always() && (github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'))
         with:
           name: Test Results Summary
           path: 'test-results/**/*.xml'

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

.pylintrc

@@ -431,7 +431,7 @@ max-returns=6
 max-statements=50
 
 # Minimum number of public methods for a class (see R0903).
-min-public-methods=2
+min-public-methods=1
 
 
 [IMPORTS]