Update dash requirement from <4,>=2.18 to >=2.18,<5

[dependabot]

Updates the requirements on dash to permit the latest version.

Release notes

Sourced from dash's releases.

Dash Version 4.2.0

[4.2.0] - 2026-06-01 - The Freedom Update

This release marks a major milestone for Dash, bringing unprecedented flexibility to how you build and deploy your applications.

🚀 Multiple Backend Support

Dash is no longer tied to Flask. You can now run your Dash apps on FastAPI or Quart, or even bring your own backend implementation:

# FastAPI backend
app = Dash(__name__, backend="fastapi")
Quart backend (async-native)
app = Dash(name, backend="quart")
Or use an existing server
from fastapi import FastAPI
server = FastAPI()
app = Dash(name, server=server)

Install with pip install dash[fastapi] or pip install dash[quart].

⚡ Websocket Callbacks

Real-time, bidirectional communication is here. Websocket callbacks enable persistent connections for live updates without polling:

@callback(
    Output("live-output", "children"),
    Input("trigger", "n_clicks"),
    websocket=True,
    persistent=True
)
def live_updates(n_clicks):
    ws = ctx.websocket
    while True:
        data = fetch_live_data()
        ws.send(Output("live-output", "children", data))
        time.sleep(1)

🔓 Relaxed Pattern Matching Rules

MATCH wildcards are now allowed in Input and State even when your Output has no wildcards, making dynamic UIs simpler to build:

@callback(
    Output("summary", "children"),  # Fixed ID output
    Input({"type": "item", "index": MATCH}, "value")  # MATCH input - now allowed!
)
def update_summary(value):
</tr></table> 

... (truncated)

Changelog

Sourced from dash's changelog.

[4.2.0] - 2026-06-01 - The Freedom Update

This release marks a major milestone for Dash, bringing unprecedented flexibility to how you build and deploy your applications.

🚀 Multiple Backend Support

Dash is no longer tied to Flask. You can now run your Dash apps on FastAPI or Quart, or even bring your own backend implementation:

# FastAPI backend
app = Dash(__name__, backend="fastapi")
Quart backend (async-native)
app = Dash(name, backend="quart")
Or use an existing server
from fastapi import FastAPI
server = FastAPI()
app = Dash(name, server=server)

Install with pip install dash[fastapi] or pip install dash[quart].

⚡ Websocket Callbacks

Real-time, bidirectional communication is here. Websocket callbacks enable persistent connections for live updates without polling:

@callback(
    Output("live-output", "children"),
    Input("trigger", "n_clicks"),
    websocket=True,
    persistent=True
)
def live_updates(n_clicks):
    ws = ctx.websocket
    while True:
        data = fetch_live_data()
        ws.send(Output("live-output", "children", data))
        time.sleep(1)

🔓 Relaxed Pattern Matching Rules

MATCH wildcards are now allowed in Input and State even when your Output has no wildcards, making dynamic UIs simpler to build:

@callback(
    Output("summary", "children"),  # Fixed ID output
    Input({"type": "item", "index": MATCH}, "value")  # MATCH input - now allowed!
)
def update_summary(value):
    return f"Selected: {value}"
</tr></table> 

... (truncated)

Commits

• 887fd67 build artifacts for 4.2.0
• 805b3ce Merge pull request #3804 from plotly/master-4.2.0
• 3b483d1 build artifacts for 4.2.0
• ed2363d Merge branch 'dev' into master-4.2.0
• d0f78b6 Merge pull request #3803 from plotly/version-4.2.0
• 6c3fdab Version 4.2.0
• c41939b Merge pull request #3797 from plotly/fix/ws-connection-management
• 8c2329f add configuration for heartbeat and proper te\sts for reconnect
• e15ef05 Merge branch 'dev' into fix/ws-connection-management
• 715dae8 Merge pull request #3798 from plotly/fix/init-flask-run-command
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)