Merge dev to master

.envrc

@@ -6,3 +6,8 @@ for venv_dir in .venv .env venv env .venv* env* ENV; do
         break
     fi
 done
+
+# Include optional, local-only environment overrides
+if [ -f .env ]; then
+    dotenv
+fi

.github/actions/percy-exec/action.yml

@@ -13,6 +13,10 @@ inputs:
     description: 'Working directory for the command'
     required: false
     default: '.'
+  browser-executable:
+    description: 'Path to a Chrome/Chromium binary for Percy to use. Defaults to the one found on PATH.'
+    required: false
+    default: ''
 
 runs:
   using: 'composite'
@@ -23,7 +27,19 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         PERCY_TOKEN: ${{ inputs.percy-token }}
-      run: npx percy exec -- ${{ inputs.command }}
+        PERCY_BROWSER_EXECUTABLE: ${{ inputs.browser-executable }}
+      run: |
+        # Percy otherwise downloads its own Chromium from storage.googleapis.com
+        # on the first snapshot. That download stalls in CI, which blocks the
+        # synchronous percy_snapshot() calls (so pytest never finishes and writes
+        # no JUnit) and leaves an empty Percy build with no snapshots. Point Percy
+        # at the Chrome already installed in the job so it skips the download.
+        if [ -z "${PERCY_BROWSER_EXECUTABLE:-}" ]; then
+          PERCY_BROWSER_EXECUTABLE="$(command -v google-chrome || command -v google-chrome-stable || command -v chrome || command -v chromium || command -v chromium-browser || true)"
+          export PERCY_BROWSER_EXECUTABLE
+        fi
+        echo "PERCY_BROWSER_EXECUTABLE=${PERCY_BROWSER_EXECUTABLE:-<unset: Percy will download Chromium>}"
+        npx percy exec -- ${{ inputs.command }}
 
     - name: Run without Percy (fork PR)
       if: inputs.percy-token == ''

.github/workflows/post-test-status.yml

@@ -68,10 +68,13 @@ jobs:
   test-report:
     name: Consolidated Test Report (Fork PR)
     runs-on: ubuntu-latest
-    # Only run for fork PRs (non-fork PRs are handled in the main workflow)
+    # Run for fork PRs and Dependabot PRs. Both run with a read-only
+    # GITHUB_TOKEN in the main workflow, so the check run is created here in the
+    # base-repo context instead. Other same-repo PRs are handled in the main workflow.
     if: |
       github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.head_repository.full_name != github.repository
+      (github.event.workflow_run.head_repository.full_name != github.repository ||
+       github.event.workflow_run.actor.login == 'dependabot[bot]')
     permissions:
       checks: write
       actions: read

.github/workflows/testing.yml

@@ -108,7 +108,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip wheel
           python -m pip install "setuptools<80.0.0"
-          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[dev,ci,testing]"' \;
+          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[dev,ci,testing,diskcache]"' \;
 
       - name: Install dash-renderer dependencies
         working-directory: dash/dash-renderer
@@ -122,6 +122,8 @@ jobs:
           echo "DISPLAY=:99" >> $GITHUB_ENV
 
       - name: Run lint
+        env:
+          PYLINT_EXTRA_ARGS: ${{ matrix.python-version == '3.8' && '--ignored-modules=mcp' || '' }}
         run: npm run lint
 
       - name: Run unit tests
@@ -193,7 +195,7 @@ jobs:
   test-typing:
     name: Typing Tests
     runs-on: ubuntu-latest
-    if: github.ref_name != 'master'
+    if: github.ref_name != 'master' && github.base_ref != 'master'
     needs: build
     timeout-minutes: 30
     strategy:
@@ -229,7 +231,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip wheel
           python -m pip install "setuptools<80.0.0"
-          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev]"' \;
+          find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev,diskcache]"' \;
 
       - name: Build/Setup test components
         run: npm run setup-tests.py  # TODO build the packages and save them to packages/ in build job
@@ -620,6 +622,14 @@ jobs:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
       PERCY_ENABLE: ${{ matrix.python-version == '3.12' && '1' || '0' }}
       PERCY_PARALLEL_TOTAL: -1
+      # Pin the build identity so every shard joins the same parallel build and
+      # Percy links it to the PR. Auto-detection otherwise uses the ephemeral
+      # merge SHA (refs/pull/N/merge), so the build never shows up on the PR.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
 
     steps:
       - name: Checkout repository
@@ -654,6 +664,7 @@ jobs:
           find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev,celery,diskcache]"' \;
 
       - name: Setup Chrome and ChromeDriver
+        id: setup-chrome
         uses: browser-actions/setup-chrome@v1
         with:
           chrome-version: stable
@@ -678,6 +689,7 @@ jobs:
         with:
           command: pytest --headless --nopercyfinalize --junitxml=test-reports/junit_intg.xml tests/integration --splits 3 --group ${{ matrix.test-group }}
           percy-token: ${{ secrets.PERCY_TOKEN }}
+          browser-executable: ${{ steps.setup-chrome.outputs.chrome-path }}
 
       - name: Upload test results
         if: always()
@@ -713,6 +725,14 @@ jobs:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
       PERCY_ENABLE: ${{ matrix.python-version == '3.12' && '1' || '0' }}
       PERCY_PARALLEL_TOTAL: -1
+      # Pin the build identity so every shard joins the same parallel build and
+      # Percy links it to the PR. Auto-detection otherwise uses the ephemeral
+      # merge SHA (refs/pull/N/merge), so the build never shows up on the PR.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
 
     steps:
       - name: Checkout repository
@@ -747,6 +767,7 @@ jobs:
           find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev]"' \;
 
       - name: Setup Chrome and ChromeDriver
+        id: setup-chrome
         uses: browser-actions/setup-chrome@v1
         with:
           chrome-version: stable
@@ -773,6 +794,7 @@ jobs:
         with:
           command: pytest --headless --nopercyfinalize --junitxml=test-reports/junit_html.xml
           percy-token: ${{ secrets.PERCY_TOKEN }}
+          browser-executable: ${{ steps.setup-chrome.outputs.chrome-path }}
           working-directory: components/dash-html-components
 
       - name: Upload test results
@@ -899,6 +921,14 @@ jobs:
       PERCY_TOKEN: ${{ matrix.python-version == '3.12' && secrets.PERCY_TOKEN || '' }}
       PERCY_ENABLE: ${{ matrix.python-version == '3.12' && '1' || '0' }}
       PERCY_PARALLEL_TOTAL: -1
+      # Pin the build identity so every shard joins the same parallel build and
+      # Percy links it to the PR. Auto-detection otherwise uses the ephemeral
+      # merge SHA (refs/pull/N/merge), so the build never shows up on the PR.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
 
     steps:
       - name: Checkout repository
@@ -1016,6 +1046,7 @@ jobs:
           find packages -name dash-*.whl -print -exec sh -c 'pip install "{}[ci,testing,dev]"' \;
 
       - name: Setup Chrome and ChromeDriver
+        id: setup-chrome
         uses: browser-actions/setup-chrome@v1
         with:
           chrome-version: stable
@@ -1034,6 +1065,10 @@ jobs:
       - name: Run Table visual tests
         if: env.PERCY_TOKEN != ''
         working-directory: components/dash-table
+        # percy-storybook bundles an old puppeteer whose Chromium is absent on
+        # the runner; point it at the system Chrome installed above.
+        env:
+          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
         run: npm run test.visual
 
       - name: Skip Table visual tests (fork PR)
@@ -1056,6 +1091,13 @@ jobs:
     if: always()
     env:
       PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
+      # Must match the snapshot jobs so finalize targets the same parallel build
+      # and the result is attached to the PR head commit, not the merge SHA.
+      PERCY_PARALLEL_NONCE: ${{ github.run_id }}-${{ github.run_attempt }}
+      PERCY_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+      PERCY_BRANCH: ${{ github.head_ref || github.ref_name }}
+      PERCY_PULL_REQUEST: ${{ github.event.pull_request.number }}
+      PERCY_TARGET_BRANCH: ${{ github.base_ref }}
     steps:
       - name: Finalize Main Percy Build
         if: |
@@ -1093,8 +1135,9 @@ jobs:
 
       - name: Publish Test Report
         uses: dorny/test-reporter@v1
-        # Skip for fork PRs - handled by post-test-status.yml workflow_run
-        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        # Skip for fork PRs and Dependabot PRs - both run with a read-only
+        # GITHUB_TOKEN, so they're handled by post-test-status.yml workflow_run.
+        if: always() && (github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'))
         with:
           name: Test Results Summary
           path: 'test-results/**/*.xml'

.pylintrc

@@ -431,7 +431,7 @@ max-returns=6
 max-statements=50
 
 # Minimum number of public methods for a class (see R0903).
-min-public-methods=2
+min-public-methods=1
 
 
 [IMPORTS]

CHANGELOG.md

@@ -2,7 +2,32 @@
 All notable changes to `dash` will be documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
-## [UNRELEASED]
+## [4.3.0] - 2026-06-18
+
+## Added
+- [#3796](https://github.com/plotly/dash/pull/3796) MCP: Add `configure_mcp_server()` to toggle which content the MCP server exposes (`include_layout`, `include_callbacks`, `include_clientside_callbacks`, `include_pages`, `expose_callback_docstrings`). Only the parameters explicitly passed are updated; omitted parameters retain their current value.
+
+## Changed
+- [#3796](https://github.com/plotly/dash/pull/3796) MCP: Remove the `mcp_expose_docstrings` `Dash()` constructor argument; callback docstring exposure is now controlled via `configure_mcp_server(expose_callback_docstrings=...)`.
+
+## Fixed
+- [#3817](https://github.com/plotly/dash/pull/3817) Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes [#3816](https://github.com/plotly/dash/issues/3816).
+- [#3805](https://github.com/plotly/dash/pull/3805) Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes [#3801](https://github.com/plotly/dash/issues/3801).
+- [#3813](https://github.com/plotly/dash/pull/3813) Fix websockets using incorrect path when deployed behind a proxy
+- [#3830](https://github.com/plotly/dash/pull/3830) MCP: Respond to the Streamable HTTP `GET` (SSE) request with an empty event stream instead of `405 Method Not Allowed`
+
+## [4.3.0rc0] - 2026-05-21
+
+## Added
+- [#3710](https://github.com/plotly/dash/pull/3710) MCP: Framework utilities, types for interacting with layout
+- [#3711](https://github.com/plotly/dash/pull/3711) MCP: `CallbackAdapter` for representing callback-related data in MCP-friendly format
+- [#3712](https://github.com/plotly/dash/pull/3712) MCP: `Resources` for exposing app layout, components, and pages
+- [#3731](https://github.com/plotly/dash/pull/3731) MCP: Expose callbacks as `Tools`
+- [#3747](https://github.com/plotly/dash/pull/3747) MCP: Support pattern-matching callbacks in Tools
+- [#3748](https://github.com/plotly/dash/pull/3748) MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)
+- [#3749](https://github.com/plotly/dash/pull/3749) MCP: `get_dash_component` Tool and callback execution
+- [#3750](https://github.com/plotly/dash/pull/3750) MCP: Server routes, `mcp_enabled` function decorator, and Streamable HTTP transport
+- [#3766](https://github.com/plotly/dash/pull/3766) MCP: Support background callbacks in Tools
 
 ## [4.2.0] - 2026-06-01 - *The Freedom Update*