Dash Files

Fixed

• #3902 Fix background callbacks trusting the client-supplied job/oldJob/cancelJob and cacheKey query parameters verbatim, which let an unauthenticated client terminate an arbitrary process (with DiskcacheManager, by sending its PID) or read and delete arbitrary result-cache entries. The cacheKey/job handles are now HMAC-signed by the server and bound to a per-page-load token, so forged or replayed values are rejected. Handles stay opaque to the renderer, so no app or callback code changes are required.
• 3883 Fix callbacks being registered twice when running the app file as a script with a server that loads it by import string, e.g. uvicorn.run("app:server", reload=True) with backend="fastapi". The spawned worker re-executes the main module as __mp_main__ and the import string then executed the same file a second time, duplicating every callback in _dash-dependencies and triggering Duplicate callback outputs errors in the renderer. Dash() now pre-registers the running main module in sys.modules under its canonical import name so the second import reuses it instead of re-executing the file. Fixes #3818.
• 3885 Fix Flask-WTF CSRFProtect (and Quart-WTF) exemptions breaking after the backend refactor. The callback dispatch view is now exposed with the fully-qualified name dash.dash.dispatch again, so csrf._exempt_views.add("dash.dash.dispatch") works as it did in Dash 4.1.0. Fixes #3827.
• #3882 Fix dcc.Graph user interactions (pan, zoom, edited shapes & annotations, ...) being reverted by a subsequent Patch update, by syncing all relayout changes back to the figure prop instead of only shapes. Fixes #3810.
• #3903 Fix missing comm dependency, fix #3657.
• Updated radix-ui to fix #3786