bump(deps): bump nicegui from 3.9.0 to 3.12.1

[dependabot]

Bumps nicegui from 3.9.0 to 3.12.1.

Release notes

Sourced from nicegui's releases.

v3.12.1

Bugfixes

• Fix auto-prune timers being skipped in script mode (#6072, #6074 by @​evnchn, @​falkoschindler)
• Fix RuntimeError in native mode on Python 3.14+ Linux (#6062, #6065 by @​noafilou, @​evnchn, @​falkoschindler)
• Fix ui.upload routes listed in /docs and /openapi.json (#6063 by @​jsb-zz, @​falkoschindler, @​evnchn)

Documentation

• Add a note on how to fix non-working ui.aggrid events (#2878, #6067 by @​BlankAdventure, @​KrilleGH, @​evnchn, @​falkoschindler)

---

Special thanks to our top sponsors DiscoLike Inc., Lechler GmbH and joet-s ✨

and all our other sponsors and contributors for supporting this project!

🙏 Want to support this project? Check out our GitHub Sponsors page to help us keep building amazing features!

v3.12.0

Security

• ⚠️ Prevent local file disclosure in ui.restructured_text via Docutils file insertion directives (GHSA-jfrm-rx66-g536 by @​dennyabrahamsinaga, @​h3ri0s, @​falkoschindler, @​evnchn)
• ⚠️ Prevent unauthenticated log-volume denial of service in dynamic resource and ESM module routes (GHSA-pq7c-x8g4-rvp6 by @​bitinerant, @​evnchn, @​falkoschindler)

New features and enhancements

• Make enable(), disable(), set_enabled(), set_visibility() and many more methods chainable (#6014, #6016 by @​stragrothsk, @​falkoschindler, @​evnchn)
• Auto-dedent ui.mermaid content like ui.markdown does (#6011, #6012 by @​BasementSociety, @​falkoschindler, @​evnchn)
• Suppress alarming KeyboardInterrupt traceback from run.cpu_bound workers on Ctrl-C (#6025, #6027 by @​justus2510, @​falkoschindler, @​evnchn)

Bugfixes

• Fix RuntimeError: A SemLock created in a fork context is being shared with a process in a spawn context in ui.run(native=True, reload=True) on CPython ≥ 3.11.5 (#1841, #6045 by @​swrpug, @​evnchn, @​falkoschindler, @​rodja, @​JensOgorek, @​yuanxion, @​electronstudio, @​knoppmyth, @​Qhawaq, @​sagarbehere, @​frankhuurman, @​MrGibus, @​BanDroid)
• Fix KeyError: 'error' when calling ValidationElement.validate() after the error prop was removed via props(remove=...) (#5977, #6042 by @​manu-ns, @​falkoschindler, @​evnchn)
• Fix silent window.location.reload() on every WebSocket reconnect (#6018, #6019 by @​arodidev, @​falkoschindler, @​evnchn)
• Resolve ElementFilter.DEFAULT_LOCAL_SCOPE at runtime so changing the class variable actually affects new instances (#6005, #6013 by @​gzu300, @​DarkRiddle1212, @​falkoschindler)
• Fix duplicate app.timer and lifecycle handler (on_connect, on_disconnect, on_delete, on_shutdown, on_exception) registration in script mode (#6003, #6006 by @​EchterTimo, @​falkoschindler, @​evnchn)
• Preserve a meaningful DataFrame index in ui.aggrid.from_pandas and ui.table.from_pandas (#5995, #6002 by @​NichtJens, @​DarkRiddle1212, @​falkoschindler, @​evnchn) Note: DataFrames with an informative index now produce additional column(s) in the resulting grid/table. To restore the previous "drop the index" behavior, call df.reset_index(drop=True) before passing the DataFrame.
• Bracket IPv6 hosts and omit default ports in printed URLs (#5996 by @​bulletmark, @​falkoschindler, @​evnchn)
• Fix ui.code reporting the wrong language and throwing a ReferenceError in the CodeMirror findLanguage error path (#5982 by @​Jepson2k, @​falkoschindler)
• Fix material settings not applying to GLTF models in ui.scene (#3515, #5708 by @​maria-korosteleva, @​evnchn, @​falkoschindler, @​fabian0702)

Documentation

• Add llms.md — a self-contained LLM reference covering NiceGUI's API surface, mental models, and common anti-patterns for AI-assisted development (#6021, #6049 by @​joko-zauberzeug, @​falkoschindler, @​evnchn, @​rodja)
• Restructure CONTRIBUTING.md around the contributor journey, drop rule duplication, and split out a new "For maintainers" section (#6029 by @​falkoschindler, @​evnchn)
• Restructure AI agent instructions: extract code-review guidance into REVIEW.md, trim AGENTS.md, and tighten Cursor/Copilot prompts (#6030 by @​falkoschindler, @​evnchn)
• Document packaging with Nuitka (#6009, #6010 by @​SHDocter, @​falkoschindler, @​evnchn)

... (truncated)

Commits

• 2c8402d Fix auto-prune timers being skipped in script mode (#6074)
• cb592ec remove TestMu AI sponsor
• 459eb72 fix Dependabot alerts 280 and 281
• 73abb65 Add docs on how to fix non-working aggrid events (#6067)
• 2ee7c3f Hide ui.upload route from OpenAPI schema by default (#6063)
• ba4b7c4 Use spawn context for native window subprocess (#6065)
• ec74aa6 Revert "Randomize test ports/dirs for parallel pytest sessions (#5960)"
• c0124f7 fix Dependabot alerts 264, 265, 266, 267 and 268
• 5328b59 Randomize test ports/dirs for parallel pytest sessions (#5960)
• 44cc19e add DiscoLike sponsor
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Nicola Franco (franconicola)]

LGTM