Upgrade bundled plotly.js to 4.x

Motivation

The upgrade removes trace types and changes defaults, so it is a breaking change for NiceGUI users and belongs in 4.0.

We currently bundle plotly.js 3.1.1 in nicegui/elements/plotly. Two reasons to move to 4.x:

• plotly.py 7.0.0 (released 2026-08-25) ships plotly.js 4.0.0 and generates figure JSON for it. Our plotly extra pins plotly>=5.13,<7.0, so users are stuck on plotly.py 6.x until we upgrade the bundle.
• Dependabot alert 410 (maplibre-gl XSS, GHSA-jrc7-96c5-q579) is compiled into the prebuilt plotly.min.js we import, so it can only be fixed by a plotly.js release that bundles maplibre-gl >= 6.4.1. Upstream is tracking this in plotly/plotly.js#8031 with Dependabot PR plotly/plotly.js#8030 on main, i.e. the 4.x line. An npm override on our side would only hide the alert without changing the shipped code.

Implementation

• Bump plotly.js in nicegui/elements/plotly/package.json to the first 4.x release that includes maplibre-gl >= 6.4.1, rebuild dist/, regenerate DEPENDENCIES.md.
• Relax the plotly extra to allow plotly.py 7.x.
• Check the documentation demos, especially the map demos, against the changed defaults.
• Mention the breaking changes in the release notes, including the new "Share chart" modebar button (plotly.js and plotly.py 7 both enable it by default; users who don't want it pass config={'showSendToCloud': False}).

Breaking changes for users (from the plotly.js 4.0.0 release notes)

• scattermapbox, choroplethmapbox, densitymapbox traces, the mapbox subplot and mapboxAccessToken are removed; use the *map equivalents.
• Color parsing switched from TinyColor to culori: rgb() with 0-1 fractions and hsv() strings are no longer accepted, invalid CSS color strings are rejected, rgb() now accepts an alpha channel.
• layout.geo.fitbounds defaults to 'locations'; scattermap and densitymap auto-fit center and zoom unless layout.map.fitbounds is set to false.
• MathJax v2 is no longer supported (v3 and v4 are).
• splom.axis.matches defaults to true; overlaying axes default to tickmode: 'sync'.
• hoveranywhere / clickanywhere events return actual data values for xvals / yvals (strings for date and category axes).

Progress

• Wait for a plotly.js 4.x release that includes maplibre-gl >= 6.4.1
• Bump plotly.js, rebuild dist, regenerate DEPENDENCIES.md
• Relax the plotly extra to <8.0
• Verify documentation demos
• Release notes