From a794780c02a579a649d5da7a1980fe68ce3ec923 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 16:48:10 +0000 Subject: [PATCH 1/2] Bump the pip-dependencies group with 4 updates Updates the requirements on [selenium](https://github.com/SeleniumHQ/Selenium), [black](https://github.com/psf/black), [pylint](https://github.com/pylint-dev/pylint) and [redis](https://github.com/redis/redis-py) to permit the latest version. Updates `selenium` to 4.48.0 - [Release notes](https://github.com/SeleniumHQ/Selenium/releases) - [Commits](https://github.com/SeleniumHQ/Selenium/compare/selenium-4.11.0...selenium-4.48.0) Updates `black` from 22.3.0 to 26.5.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/compare/22.3.0...26.5.1) Updates `pylint` from 3.0.3 to 4.0.8 - [Release notes](https://github.com/pylint-dev/pylint/releases) - [Commits](https://github.com/pylint-dev/pylint/compare/v3.0.3...v4.0.8) Updates `redis` to 8.1.0 - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](https://github.com/redis/redis-py/compare/3.5.3...v8.1.0) --- updated-dependencies: - dependency-name: selenium dependency-version: 4.48.0 dependency-type: direct:production dependency-group: pip-dependencies - dependency-name: black dependency-version: 26.5.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-dependencies - dependency-name: pylint dependency-version: 4.0.8 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-dependencies - dependency-name: redis dependency-version: 8.1.0 dependency-type: direct:production dependency-group: pip-dependencies ... Signed-off-by: dependabot[bot] --- requirements/ci.txt | 4 ++-- requirements/redis.txt | 2 +- requirements/testing.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/ci.txt b/requirements/ci.txt index db3c682712..7e0e90654c 100644 --- a/requirements/ci.txt +++ b/requirements/ci.txt @@ -1,5 +1,5 @@ # Dependencies used by CI on github.com/plotly/dash -black==22.3.0 +black==26.5.1 flake8==7.3.0 flaky==3.8.1 flask-talisman==1.1.0 @@ -13,7 +13,7 @@ orjson>=3.10.11 openpyxl pandas>=1.4.0 pyarrow -pylint==3.0.3 +pylint==4.0.8 pytest-mock pytest-split pytest-sugar==1.1.1 diff --git a/requirements/redis.txt b/requirements/redis.txt index 5cc9c3dc9e..c4903b4540 100644 --- a/requirements/redis.txt +++ b/requirements/redis.txt @@ -1,4 +1,4 @@ # Dependency used by RedisSharedStorage. # Kept in sync with the redis pin in celery.txt; in Dash 5.0 redis will be # removed from the celery extra and live here only. -redis>=3.5.3,<=5.0.4 +redis>=3.5.3,<=8.1.0 diff --git a/requirements/testing.txt b/requirements/testing.txt index c4ad6bf401..1af5dbf9a9 100644 --- a/requirements/testing.txt +++ b/requirements/testing.txt @@ -5,7 +5,7 @@ lxml>=4.6.2 percy-python-selenium>=1.0.0 pytest>=6.0.2 requests[security]>=2.21.0 -selenium>=4.11.0,<=4.47.0 +selenium>=4.11.0,<=4.48.0 waitress>=1.4.4 multiprocess>=0.70.12 psutil>=5.8.0 From 1fc7c8dfc2ed23a0e4af8ffafc9b5f5b46d4cd55 Mon Sep 17 00:00:00 2001 From: philippe Date: Mon, 21 Sep 2026 14:14:28 -0400 Subject: [PATCH 2/2] Hold black/pylint pins; keep selenium and redis bumps The Dependabot group bumped black to 26.5.1 and pylint to 4.0.8, both of which require Python >=3.10 and cannot install on the Python 3.9 CI jobs (Dash still supports 3.9), so every 3.9 job failed at pip install. Revert those two pins to their current versions and keep the selenium and redis range-cap bumps, which resolve to 3.9-compatible builds. Add a Dependabot ignore so the py3.10-only black/pylint versions stop being re-proposed. --- .github/dependabot.yml | 10 ++++++++++ requirements/ci.txt | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d8b865f29c..2f291f31cb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -176,6 +176,16 @@ updates: - "*" # jupyterlab is pinned <4.0.0: jupyterlab 4.x ships jlpm as Yarn Berry, which # cannot consume @plotly/dash-jupyterlab's Yarn 1 lockfile and breaks the build. + # + # black >=25.12.0 and pylint >=4.0.0 require Python >=3.10 and cannot install + # on the 3.9 CI jobs (Dash still supports Python 3.9). Upgrading either past + # its last 3.9-compatible release (black 25.11.0, pylint 3.3.9) also forces a + # repo-wide reformat / lint-fix pass, so linter bumps are done deliberately, + # not via Dependabot. ignore: - dependency-name: "jupyterlab" versions: [">=4.0.0"] + - dependency-name: "black" + versions: [">=25.12.0"] + - dependency-name: "pylint" + versions: [">=4.0.0"] diff --git a/requirements/ci.txt b/requirements/ci.txt index 7e0e90654c..db3c682712 100644 --- a/requirements/ci.txt +++ b/requirements/ci.txt @@ -1,5 +1,5 @@ # Dependencies used by CI on github.com/plotly/dash -black==26.5.1 +black==22.3.0 flake8==7.3.0 flaky==3.8.1 flask-talisman==1.1.0 @@ -13,7 +13,7 @@ orjson>=3.10.11 openpyxl pandas>=1.4.0 pyarrow -pylint==4.0.8 +pylint==3.0.3 pytest-mock pytest-split pytest-sugar==1.1.1