Skip to content

build(deps): bump the dash-network group with 2 updates - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dash-network-388ad95d4c
Open

build(deps): bump the dash-network group with 2 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dash-network-388ad95d4c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on plotly and dash-improve-my-llms to permit the latest version.
Updates plotly to 7.0.0

Release notes

Sourced from plotly's releases.

v7.0.0

Fixed

  • Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @​genrichez for the contribution!
  • Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]
  • Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @​mishrakushal for the contribution!
  • Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @​lucasjamar for the contribution!
  • Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @​robertoffmoura for the contribution!

Removed

  • Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
  • Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
  • Remove support for Orca for static image generation [#5677]
  • Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]

Updated

  • Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:
    • Add quiver trace type to visualize vector fields using arrows [#7710, #7945]
    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
    • Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:
      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
      • hsv() color strings are no longer supported
      • Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported
      • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0, 0%, 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
    • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
    • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
    • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
    • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]
Changelog

Sourced from plotly's changelog.

[7.0.0] - 2026-08-25

Fixed

  • Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @​genrichez for the contribution!
  • Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]
  • Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @​mishrakushal for the contribution!
  • Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @​lucasjamar for the contribution!
  • Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @​robertoffmoura for the contribution!

Updated

  • Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:
    • Add quiver trace type to visualize vector fields using arrows [#7710, #7945]
    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
    • Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:
      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
      • hsv() color strings are no longer supported
      • Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported
      • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0 0% 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
    • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
    • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
    • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
    • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]

[7.0.0rc0] - 2026-07-29

Removed

  • Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
  • Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
  • Remove support for Orca for static image generation [#5677]
  • Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]

Updated

  • Update plotly.js from version 3.6.0 to version 4.0.0-rc.0 [#5673]. This is a major-version release candidate with many changes. See the plotly.js release notes for the full list. The most significant changes include:
    • Add quiver trace type to visualize vector fields using arrows [#7710]
    • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
    • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
      • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
    • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
    • Switch color processing library from TinyColor to color [#7536]. There are some changes to supported color string formats as a result:
      • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
      • hsv() color strings are no longer supported
      • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0, 0%, 0%)'
    • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
    • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
    • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
    • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]

... (truncated)

Commits

Updates dash-improve-my-llms to 2.10.0

Release notes

Sourced from dash-improve-my-llms's releases.

v2.10.0

Cloudflare's agent-readiness scan failed this network on checks it already satisfied in substance. Chasing those was worth one release; the thing the scan does not check was worth doing first.

Fixed — every /.well-known/* path answered 200 with the app shell

Measured on three live hosts and reproduced in-process on all three adapters: every path under /.well-known/ returned 200 and a Dash page, and so did /auth.md, and /openapi.json on the backends that have no schema. An agent asking for an API catalog, an agent card or OAuth metadata got a web page and no way to tell.

That is a soft-404 on the one namespace whose entire purpose is machine discovery, and it makes every document published there worthless: an agent that gets 200 for /.well-known/anything learns nothing from getting 200 for /.well-known/api-catalog. Refusing the unknown is what makes the known worth reading, which is why the guard ships in the same release as the documents rather than after them.

Unknown discovery paths now answer 404 with {"error":"not found","see":"/llms.txt"} and Cache-Control: no-store, on all three adapters, for every User-agent. Registered as routes rather than middleware, so precedence is the routing table's own: a host's own /.well-known/ route still wins, and Dash's page catch-all loses to both. /openapi.json is claimed only where nothing else serves it — FastAPI's real schema is untouched.

Added — Content-Signal in robots.txt

One line in the User-agent: * group, derived from the same RobotsConfig that renders the groups below it, never hand-typed: search follows allow_traditional, ai-input follows allow_ai_search, ai-train follows block_ai_training inverted. A signal that disagrees with the directives under it is worse than no signal — and Cloudflare's injected default said ai-train=no, the opposite of a host that deliberately allows training crawlers so their reads can be attributed.

Added — Accept: text/markdown on page routes

A request for a page URL whose Accept prefers markdown over HTML now receives that page's markdown twin: the same bytes /<page>/llms.txt serves, because they already are the markdown representation of that page — a second rendering would be a second thing to keep true. Content-Type: text/markdown, Vary: Accept, User-Agent, plus the Link and source-digest headers the llms routes carry.

Strictly preferred, by a real q-value parse with RFC 9110 specificity ordering: */*, a tie, and a browser's

... (truncated)

Changelog

Sourced from dash-improve-my-llms's changelog.

[2.10.0] - 2026-09-02 — the machine surface refuses what it does not serve

Cloudflare's agent-readiness scan failed this network on checks it already satisfied in substance. Chasing those was worth one release; the thing the scan does not check was worth doing first.

Fixed — every /.well-known/* path answered 200 with the app shell

Measured on three live hosts and reproduced in-process on all three adapters: every path under /.well-known/ returned 200 and a Dash page, and so did /auth.md, and /openapi.json on the backends that have no schema. An agent asking for an API catalog, an agent card or OAuth metadata got a web page and no way to tell.

That is a soft-404 on the one namespace whose entire purpose is machine discovery, and it makes every document published there worthless: an agent that gets 200 for /.well-known/anything learns nothing from getting 200 for /.well-known/api-catalog. Refusing the unknown is what makes the known worth reading, which is why the guard ships in the same release as the documents rather than after them.

Unknown discovery paths now answer 404 with {"error":"not found","see":"/llms.txt"} and Cache-Control: no-store, on all three adapters, for every User-agent. Registered as routes rather than middleware, so precedence is the routing table's own: a host's own /.well-known/ route still wins, and Dash's page catch-all loses to both. /openapi.json is claimed only where nothing else serves it — FastAPI's real schema is untouched.

Added — Content-Signal in robots.txt

One line in the User-agent: * group, derived from the same RobotsConfig that renders the groups below it, never hand-typed: search follows allow_traditional, ai-input follows allow_ai_search, ai-train follows block_ai_training inverted. A signal that disagrees with the directives under it is worse than no signal — and Cloudflare's injected default said ai-train=no, the opposite of a host that deliberately allows training crawlers so their reads can be attributed.

Added — Accept: text/markdown on page routes

A request for a page URL whose Accept prefers markdown over HTML now receives that page's markdown twin: the same bytes /<page>/llms.txt serves, because they already are the markdown representation of that page — a second rendering would be a second thing to keep true. Content-Type: text/markdown, Vary: Accept, User-Agent, plus the Link and source-digest headers the llms routes carry.

Strictly preferred, by a real q-value parse with RFC 9110 specificity

... (truncated)

Commits
  • 1244780 [2.10.0] - 2026-09-02 the machine surface refuses what it does not serve
  • b703a70 docs+tests: pin the probe convention and the record-attempts design
  • 921be3a [2.9.4] - 2026-08-31 the two 2.9.3 fixes collided on older FastAPI
  • d549ef3 [2.9.3] - 2026-08-31 HEAD everywhere, a truthful schema, a priced index
  • 49d61b9 [2.9.2] - 2026-08-30 the vendor's class reaches the row
  • 62376da [2.9.1] - 2026-08-29 name the rest of the Google family
  • d6549ca [2.9.0] - 2026-08-29 the posture on every row, twitter:url, monitors get a name
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the dash-network group with 2 updates
ba904cc 
Updates the requirements on [plotly](https://github.com/plotly/plotly.py) and [dash-improve-my-llms](https://github.com/pip-install-python/dash-improve-my-llms) to permit the latest version.

Updates `plotly` to 7.0.0
- [Release notes](https://github.com/plotly/plotly.py/releases)
- [Changelog](https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md)
- [Commits](plotly/plotly.py@v6.9.0...v7.0.0)

Updates `dash-improve-my-llms` to 2.10.0
- [Release notes](https://github.com/pip-install-python/dash-improve-my-llms/releases)
- [Changelog](https://github.com/pip-install-python/dash-improve-my-llms/blob/main/CHANGELOG.md)
- [Commits](pip-install-python/dash-improve-my-llms@v2.8.0...v2.10.0)

---
updated-dependencies:
- dependency-name: plotly
  dependency-version: 7.0.0
  dependency-type: direct:production
  dependency-group: dash-network
- dependency-name: dash-improve-my-llms
  dependency-version: 2.10.0
  dependency-type: direct:production
  dependency-group: dash-network
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants