[T4rk1n]

Combines the Dependabot updates that are safe to take now. All are patch/minor bumps that need no code changes.

Included:

• Bump the npm-dependencies group across 1 directory with 3 updates #4062 renderer: @types/node, @types/ws, webpack-sources
• Bump the npm-dependencies group across 1 directory with 2 updates #4061 dcc: @types/node, webpack-sources
• Bump the npm-dependencies group across 1 directory with 2 updates #4060 html: @types/node, webpack-sources
• Bump the npm-dependencies-security group across 2 directories with 4 updates #4059 security: fast-uri, lodash-es, minimist (dash-jupyterlab), @babel/traverse (eslint-config-dash)
• From Bump the pip-dependencies group across 1 directory with 5 updates #4070: selenium <=4.50.0 and mimesis <=22.2.0 (both need py>=3.10; py3.9 CI still resolves to the older versions)

Left out:

• Bump the pip-dependencies group across 1 directory with 5 updates #4070 black 25.11.0: reformats ~20 files, needs its own PR
• Bump the pip-dependencies group across 1 directory with 5 updates #4070 flake8 7.4.1: requires Python 3.10, breaks the py3.9 install
• Bump the pip-dependencies group across 1 directory with 5 updates #4070 pylint 3.3.9: adds new too-many-positional-arguments and possibly-used-before-assignment errors, needs a cleanup PR
• Bump the npm-dependencies group across 8 directories with 25 updates #4071: majors in the test components (webpack-cli 4 to 7, babel-loader 8 to 9, react-jsx-parser 1 to 2) and its build fails

Earlier failures on #4059 (cbsc008, known coalescing flake) and #4060 (benchmark job) don't come from the bumps.

Tested locally with selenium 4.50.0 and mimesis 22.2.0: test_store_data.py (uses mimesis for the 5MB fixture) and basic callback tests pass.

[github-actions]

Dash performance benchmarks

✅ all within thresholds

	scenario	metric	p90 (ms)	median	growth	baseline p90	note
✅	callback_chain	chain_ms	415.4	399.7	0.93x	499.1
✅	callback_chain	graph_ms	2.4	2.4	1.0x	2.4
✅	callback_fanout	fanout_ms	82.9	74.8	0.87x	92.5
✅	deep_nesting	render_ms	55.3	53.5	1.01x	56.8
✅	full_children_replace	replace_ms	5181.7	1900.1	17.24x	4697.1
✅	initial_render_large	render_ms	828.8	585.8	1.01x	694.4
✅	initial_render_small	render_ms	98.4	92.2	1.03x	104.0
✅	patch_append_nested	append_ms	130.7	97.5	2.39x	192.3
✅	patch_append_toplevel	append_ms	116.9	81.7	2.21x	140.2
✅	patch_scalar_update_large	update_ms	155.9	139.1	0.89x	202.9
✅	wildcard_all_resolve	wildcard_ms	298.7	283.5	0.94x	313.6
✅	wildcard_all_resolve	graph_ms	1.0	1.0	1.0x	1.3

growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state.

machine scale vs baseline: 0.96x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on initial_render_small.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud