[dependabot]

Bumps nicegui from 3.18.0 to 4.0.0.

Release notes

Sourced from nicegui's releases.

v4.0.0

NiceGUI 4.0 is a major release focused on cleaning up: it removes the APIs deprecated during 3.x, corrects a few defaults and catches up on the bundled JavaScript libraries. Nothing changes as fundamentally as the auto-index page did in 3.0, so most apps should only need small adjustments. Some changes don't raise any error, though, so please read the migration guide before upgrading.

How to upgrade

1. Update to the latest 3.19 release, run your app and tests, and fix all deprecation warnings. They name the replacement for most of what is removed in 4.0.
2. Check the new minimum requirements below.
3. Upgrade and run a type checker like mypy or pyright. It flags many leftovers, e.g. sanitize=None, before the first run.
4. Go through the behavior changes below, because most of them won't show up as an error.

New features and enhancements

• Support Python 3.15 (#6394 by @​falkoschindler, @​evnchn)
• Reduce the memory per connected client by about 14% and another 13% on a measured page, using __slots__ on observable collections and dropping the bindable property registry (#6409, #6410, #6412, #6434 by @​evnchn, @​falkoschindler)
• Give text inputs a single empty state, so that the value type of ui.input and related elements narrows to str (#6421, #6435 by @​falkoschindler, @​evnchn, @​emmanuelprecieuxargent)
• Add a pagination_controls parameter to ui.table that controls the pagination bar independently of pagination, so that assigning table.pagination later now shows the controls as well, and add on_pagination_change to ui.table.from_pandas and ui.table.from_polars (#6235, #6275 by @​evnchn, @​SaadZahem, @​falkoschindler)
• Use "spawn" as the default start method of the run.cpu_bound process pool, because "fork" is unsafe in a threaded process (#6117, #6419 by @​falkoschindler, @​evnchn)
• Let run.io_bound and run.cpu_bound keep working in app.on_shutdown handlers and stop them from swallowing task.cancel() (#6420 by @​falkoschindler, @​evnchn)
• Allow plotly.py 7 for ui.plotly (#6327, #6441 by @​falkoschindler, @​evnchn)
• Add the Quasar language packs ckb, lb, sr-Cyrl, sq and ur-PK (#6440 by @​falkoschindler, @​evnchn)

Bugfixes

• Prevent custom Object3D and Layer objects created after an await from landing in another client's scene or map (#6345, #6361, #6401 by @​evnchn, @​falkoschindler, @​wolfgang-aura)
• Fix router pages in app.remove_route() and endpoint_documentation with current FastAPI versions (#6373, #6416 by @​falkoschindler, @​evnchn, @​Melvin0hd)
• Make objects with bindable properties picklable, e.g. as arguments to run.cpu_bound, and stop keeping their classes alive (#6412, #6434 by @​evnchn, @​falkoschindler)
• Let ui.leaflet add its layers before await map.initialized() returns, so that layer methods no longer return None (#6470 by @​falkoschindler)

⚠️ Migration guide

Minimum requirements

Requirement	3.19	4.0	Ticket
Python	3.10	3.11	#6393 by @​falkoschindler, @​evnchn
FastAPI	0.109.1	0.143.1	#6373, #6416 by @​falkoschindler, @​evnchn, @​Melvin0hd
Pillow (matplotlib extra)	12.3	13.0	#6467 by @​falkoschindler
Chrome / Edge	111	121	#6440 by @​falkoschindler, @​evnchn
Safari	16.4	17.2	#6440 by @​falkoschindler, @​evnchn
HTTP client	httpx	httpx2	#5876, #6024, #6398 by @​falkoschindler, @​evnchn, @​KrilleGH, @​cervelas, @​samuller

• httpx is no longer installed. Apps importing it have to declare it themselves or switch to httpx2, which has the same API. The testing API now uses httpx2 types: User(client: httpx2.AsyncClient), and UserDownload.http_responses and UserDownload.next() hold or return httpx2.Response. In general, please declare every package you import instead of relying on what NiceGUI happens to pull in.
• Python 3.15 on glibc-based Linux needs glibc 2.39 or newer (e.g. Ubuntu 24.04+, Debian 13+) for orjson's wheels. Older systems need a source build with Rust and a C compiler.
• The Docker image now ships pandas 3, polars 2 and numpy 2.5, and no longer includes pytz. Install it yourself or switch to zoneinfo.

Behavior changes

These changes mostly don't raise an error, so your code won't tell you about them.

1. Old prop names are ignored (#6397 by @​falkoschindler, @​evnchn)

... (truncated)

Commits

• 69edb3f fix Dependabot alerts 602, 603 and 604
• 38010cd Merge branch '4.0'
• 5c1f842 Update llms.md for 4.0
• 7eed60f Update Python and npm dependencies (#6467)
• b8c4565 Fix small issues found before the 4.0 release (#6470)
• f1eb0f2 Remove the unused rename mechanism from Props (#6471)
• 851856a Merge branch 'main' into 4.0
• 824bb9a Merge commit from fork
• 3c9f017 Merge commit from fork
• 2bfb176 Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[gerardo-navarro]

We should consider the migration warning from the NiceGUI release, see https://github.com/zauberzeug/nicegui/releases/tag/v4.0.0