Version 4.4.1

CHANGELOG.md

@@ -2,13 +2,15 @@
 All notable changes to `dash` will be documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
-## [Unreleased]
+## [4.4.1] - 2026-07-21
 
 ## Fixed
 - [#3902](https://github.com/plotly/dash/pull/3902) Fix background callbacks trusting the client-supplied `job`/`oldJob`/`cancelJob` and `cacheKey` query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with `DiskcacheManager`, by sending its PID) or read and delete arbitrary result-cache entries. The `cacheKey`/`job` handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
 - [3883](https://github.com/plotly/dash/pull/3883) Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. `uvicorn.run("app:server", reload=True)` with `backend="fastapi"`. The spawned worker re-executes the main module as `__mp_main__` and the import string then executed the same file a second time, duplicating every callback in `_dash-dependencies` and triggering `Duplicate callback outputs` errors in the renderer. `Dash()` now pre-registers the running main module in `sys.modules` under its canonical import name so the second import reuses it instead of re-executing the file. Fixes [#3818](https://github.com/plotly/dash/issues/3818).
 - [3885](https://github.com/plotly/dash/pull/3885) Fix Flask-WTF `CSRFProtect` (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name `dash.dash.dispatch` again, so `csrf._exempt_views.add("dash.dash.dispatch")` works as it did in Dash 4.1.0. Fixes [#3827](https://github.com/plotly/dash/issues/3827).
 - [#3882](https://github.com/plotly/dash/pull/3882) Fix `dcc.Graph` user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent `Patch` update, by syncing all relayout changes back to the `figure` prop instead of only shapes. Fixes [#3810](https://github.com/plotly/dash/issues/3810).
+- [#3903](https://github.com/plotly/dash/pull/3903) Fix missing comm dependency, fix [#3657](https://github.com/plotly/dash/issues/3657).
+- Updated radix-ui to fix [#3786](https://github.com/plotly/dash/issues/3786)
 
 ## [4.4.0] - 2026-07-03
 

components/dash-core-components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dash-core-components",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "Core component suite for Dash",
   "repository": {
     "type": "git",
@@ -41,10 +41,10 @@
     "@fortawesome/free-solid-svg-icons": "^5.15.4",
     "@fortawesome/react-fontawesome": "^0.1.17",
     "@radix-ui/react-icons": "^1.3.2",
-    "@radix-ui/react-popover": "^1.1.15",
-    "@radix-ui/react-select": "^2.1.3",
-    "@radix-ui/react-slider": "^1.3.6",
-    "@radix-ui/react-tooltip": "^1.2.8",
+    "@radix-ui/react-popover": "^1.1.20",
+    "@radix-ui/react-select": "^2.3.4",
+    "@radix-ui/react-slider": "^1.4.4",
+    "@radix-ui/react-tooltip": "^1.2.13",
     "base64-js": "^1.5.1",
     "d3-format": "^1.4.5",
     "date-fns": "^4.1.0",

components/dash-html-components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dash-html-components",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "Vanilla HTML components for Dash",
   "main": "lib/index.js",
   "repository": {