chore(deps): bump shiny from 1.6.0 to 1.6.4

[dependabot]

Bumps shiny from 1.6.0 to 1.6.4.

Release notes

Sourced from shiny's releases.

shiny 1.6.4

Bug fixes

• Fixed a path-traversal vulnerability in bookmark restore (CWE-22). Introduced in 1.4.0. Reported by @​0xRenSec.
• When bookmarked state cannot be restored, the notification shown in the client is now a generic message. The reason is logged server-side as a warning on the shiny.bookmark._restore_state logger, so app authors can still see it. (1d8ecb46)

Full Changelog: https://github.com/posit-dev/py-shiny/blob/v1.6.4/CHANGELOG.md

shiny 1.6.3

New features

• session.destroy() now accepts an optional module id. The parent that inserted a module's UI under an id can tear down that module's scope with session.destroy(id), without the module having to hand back a cleanup handle. (#2264)
• Added the brite theme preset, available wherever Shiny theme presets are accepted (e.g. ui.Theme() and ui.page_*(theme=)). (#2246)

Bug fixes

• Fixed output resize/visibility detection for nested HTML outputs. The IntersectionObserver now observes the nearest non-shiny-html-output ancestor, so the native-observer pipeline introduced in 1.6.1 works correctly when outputs are nested inside other dynamic UI. (#2246)
• Fixed ui.input_submit_textarea() failing inside module namespaces. The internal submit button's ID was built from the already-resolved (namespaced) textarea ID, causing a double-namespace when input_task_button resolved it again. (#2262)

Full Changelog: https://github.com/posit-dev/py-shiny/blob/v1.6.3/CHANGELOG.md

shiny 1.6.2

Bug fixes

• Adapted py-shiny to the htmltools 0.7.0 sibling-classes refactor. No runtime behavior change. (#2244)
• Bumped lodash/lodash-es to 4.18.1 in the js-react template lockfile for CVE-2025-13465. (#2233)
• Fixed render.DataGrid() column headers and hovered rows not adapting to dark mode when ui.input_dark_mode() is enabled. The data grid now uses Bootstrap 5.3 mode-aware color tokens (--bs-tertiary-bg, --bs-primary-bg-subtle, --bs-emphasis-color, --bs-secondary-color), with the legacy values preserved as fallbacks. (#1635)

Full Changelog: https://github.com/posit-dev/py-shiny/blob/v1.6.2/CHANGELOG.md

shiny 1.6.1

New features

• Added session.destroy() and session.on_destroy() for cleaning up reactive objects (effects, calcs, values) when dynamically inserted module UI is removed. Calling session.destroy() on a module's session fires all registered destroy callbacks, which stop effects, invalidate calcs and values, and remove namespaced inputs and outputs from the reactive graph. Reactive objects automatically register weak destroy callbacks so they can be garbage collected when no longer referenced, even before session end. (#2209)

Improvements

• @reactive.calc, @reactive.effect, and render decorators (e.g. @render.text) now raise a TypeError if the decorated function has required parameters, since Shiny never supplies arguments to these functions. Functions with default parameter values emit a warning, as the defaults will always be used. (Thanks, @​mvanhorn!) (#2200)

• Output resize/visibility detection now uses native browser observers (ResizeObserver, IntersectionObserver) instead of relying on jQuery shown/hidden events and window.resize. This makes Shiny's client-side output-info pipeline (image/plot sizing, hidden-state tracking, theme reporting) work automatically in any layout — including CSS-only show/hide, third-party tab components, and non-Bootstrap frameworks — without requiring custom event hooks. This also introduces a shiny:themechangerstudio/shiny#3682

• panel_conditional() no longer briefly flashes its contents on app start when the condition is initially Falserstudio/shiny#3505

Bug fixes

• Fixed server-side input deduplication so that all values received from the client always trigger reactive invalidation. (#1600, #2219)

• Fixed a caret drift issue in ui.input_code_editor() where the cursor would appear to the right of the actual text insertion point when certain themes or on some operating systems. (#2223)

• Fixed OpenTelemetry name inference for reactive.Value to handle type-annotated assignments (e.g., counter: reactive.Value[int] = reactive.Value(https://github.com/posit-dev/py-shiny/blob/HEAD/0)), generic subscript calls (e.g., reactive.Value[int](https://github.com/posit-dev/py-shiny/blob/HEAD/0)), and multiline assignments where the Value() call is on a continuation line. This fixes anonymous OTel labels for packages like shinychat that use multiline reactive.Value assignments. (#2205)

Changelog

Sourced from shiny's changelog.

[1.6.4] - 2026-07-28

Bug fixes

• Fixed a path-traversal vulnerability in bookmark restore (CWE-22). Introduced in 1.4.0. Reported by @​0xRenSec.

• When bookmarked state cannot be restored, the notification shown in the client is now a generic message. The reason is logged server-side as a warning on the shiny.bookmark._restore_state logger, so app authors can still see it. (ab10e069)

Bug fixes

• Fixed session.user and session.groups raising AttributeError in module sessions (SessionProxy) and Express apps (ExpressStubSession). Both now correctly return the authenticated user's identity from the root session. As part of this fix, user and groups are now read-only properties on the Session ABC — app code can no longer accidentally overwrite credentials that are derived from immutable HTTP headers. (#2276)

[1.6.3] - 2026-06-01

New features

• session.destroy() now accepts an optional module id. The parent that inserted a module's UI under an id can tear down that module's scope with session.destroy(id), without the module having to hand back a cleanup handle. (#2264)

• Added the brite theme preset, available wherever Shiny theme presets are accepted (e.g. ui.Theme() and ui.page_*(theme=)). (#2246)

Bug fixes

• Fixed output resize/visibility detection for nested HTML outputs. The IntersectionObserver now observes the nearest non-shiny-html-output ancestor, so the native-observer pipeline introduced in 1.6.1 works correctly when outputs are nested inside other dynamic UI. (#2246)

• Fixed ui.input_submit_textarea() failing inside module namespaces. The internal submit button's ID was built from the already-resolved (namespaced) textarea ID, causing a double-namespace when input_task_button resolved it again. (#2262)

[1.6.2] - 2026-05-21

Bug fixes

• Adapted py-shiny to the htmltools 0.7.0 sibling-classes refactor. No runtime behavior change. (#2244)

• Bumped lodash/lodash-es to 4.18.1 in the js-react template lockfile for CVE-2025-13465. (#2233)

• Fixed render.DataGrid() column headers and hovered rows not adapting to dark mode when ui.input_dark_mode() is enabled. The data grid now uses Bootstrap 5.3 mode-aware color tokens (--bs-tertiary-bg, --bs-primary-bg-subtle, --bs-emphasis-color, --bs-secondary-color), with the legacy values preserved as fallbacks. (#1635)

[1.6.1] - 2026-05-01

New features

• Added session.destroy() and session.on_destroy() for cleaning up reactive objects (effects, calcs, values) when dynamically inserted module UI is removed. Calling session.destroy() on a module's session fires all registered destroy callbacks, which stop effects, invalidate calcs and values, and remove namespaced inputs and outputs from the reactive graph. Reactive objects automatically register weak destroy callbacks so they can be garbage collected when no longer referenced, even before session end. (#2209)

Improvements

• @reactive.calc, @reactive.effect, and render decorators (e.g. @render.text) now raise a TypeError if the decorated function has required parameters, since Shiny never supplies arguments to these functions. Functions with default parameter values emit a warning, as the defaults will always be used. (Thanks, @​mvanhorn!) (#2200)

• Output resize/visibility detection now uses native browser observers (ResizeObserver, IntersectionObserver) instead of relying on jQuery shown/hidden events and window.resize. This makes Shiny's client-side output-info pipeline (image/plot sizing, hidden-state tracking, theme reporting) work automatically in any layout — including CSS-only show/hide, third-party tab components, and non-Bootstrap frameworks — without requiring custom event hooks. This also introduces a shiny:themechangerstudio/shiny#3682

• panel_conditional() no longer briefly flashes its contents on app start

... (truncated)

Commits

• 31ea912 release: v1.6.4
• 6abdf60 fix(ci): Warn instead of fail on unused syrupy snapshots in playwright runs (...
• 99d8f4c fix(tests): De-race chat update_user_input test by numbering responses (#2342)
• 3f8309c fix(tests): Read UserInput.text in chat module test app (#2327)
• 6b6ce4e fix: Update chat Playwright tests for shinychat 0.5.x (#2277)
• 4ee7d24 docs(bookmark): point code references at the fix commit
• 1d8ecb4 Merge commit from fork
• 48b4faa release: v1.6.3 (#2266)
• 5c6847b chore: Improve py-shiny release skill with lessons from v1.6.1 (#2232)
• a44ec8c ci: Bump pinned htmltools to v0.7.0 in deploy tests (#2265)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.