chore: bump dash from 4.4.0 to 4.4.1

[dependabot]

Bumps dash from 4.4.0 to 4.4.1.

Release notes

Sourced from dash's releases.

Dash Version 4.4.1

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786

Changelog

Sourced from dash's changelog.

[4.4.1] - 2026-07-21

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786

Commits

• 39b5c13 Merge pull request #3909 from plotly/master-4.4.1
• 5079b04 Version 4.4.1 build artifacts
• 3130ed6 Merge branch 'dev' into master-4.4.1
• e06a351 Merge pull request #3908 from plotly/patch-4.4.1
• 8f0ec6f Version 4.4.1
• 051be28 npm audit fix
• 505958a update radix in dcc
• d282d93 Merge pull request #3902 from plotly/fix/callback-args-hardening
• f651bd5 Merge branch 'dev' into fix/callback-args-hardening
• 27bddaa Merge pull request #3903 from leontoddjohnson/patch-1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)