Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

De-experimentalize st.dialog #9020

Merged
merged 11 commits into from
Jul 15, 2024
Merged

De-experimentalize st.dialog #9020

merged 11 commits into from
Jul 15, 2024

Conversation

raethlein
Copy link
Collaborator

@raethlein raethlein commented Jul 3, 2024

Describe your changes

Merge after #9019

With #9019 landing, we are also de-experimentializing the @st.experimental_dialog decorator and introduce @st.dialog. As a consequence of the aforementioned PR,
dialogs can then

Update all used instances of @st.experimental_dialog to @st.dialog.

GitHub Issue Link (if applicable)

Testing Plan

  • Unit Tests (JS and/or Python)
    • Added a unit test to ensure that the experimental-decorator still continues to work

Closes #9063


Contribution License Agreement

By submitting this pull request you agree that all contributions to this project are made under the Apache 2.0 license.

@raethlein raethlein force-pushed the feature/st.dialog branch from 4a48804 to b021346 Compare July 4, 2024 11:20
@raethlein raethlein force-pushed the feature/st.dialog branch from b021346 to 32af0de Compare July 11, 2024 15:11
@vdonato vdonato force-pushed the feature/st.dialog branch from 32af0de to 1b25f9d Compare July 12, 2024 21:32
@vdonato vdonato added QA-Done QA is Complete and removed do-not-merge QA-Needed QA is Required labels Jul 15, 2024
vdonato and others added 11 commits July 15, 2024 21:30
The reason we were seeing the bug in #8591 is due to the incorrect assumption that we can always
totally clear out a session's fragment storage before a full script run as fragments will immediately
be repopulated anyway. This isn't quite true as a fragment can be added by a callback, and in this
case clearing out `FragmentStorage` before the full script run will lose it.

To fix this, we keep track of the fragments added throughout a script run, and on a full script run
we don't clear out fragments that were just added.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
I realized while working on the `st.rerun(scope="fragment")` feature that `ctx. fragment_ids_this_run`
should always be `rerun_data.fragment_id_queue` in set form. We still want to keep the distinction
around since the frontend isn't aware of the order fragments will be run, but we should simplify things
to not needlessly copy around the same information in a slightly different representation.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
This PR adds the new `scope` kwarg to the `st.rerun()` function. With `scope="app"` (the default),
`st.rerun()` work as before. If you set `scope="fragment"` within a fragment, however, it's now possible
to specify that only the currently running fragment reruns.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
…orage methods (#9011)

A source of many (but potentially not all) of the reports in #8494 involve a silly mistake that I made
where we're catching all `KeyError`s that may be thrown from a fragment and interpreting them as
coming from when we attempted to fetch the fragment from our `FragmentStorage`. Of course, they
could also be coming from the fragment function itself, and in these cases we're currently raising an
error with a misleading / incorrect / opaque message.

This PR fixes this issue by throwing and expecting a more specific subclass of `KeyError` in
`FragmentStorage` operations

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Fix two issues:
- the `current_fragment_delta_path` could have been taken from the wrong
snapshot
- always add the `current_fragment_id` to the set of new fragment ids.
This prevents an issue where a fragment rerun is triggered during full
app execution.

- Explanation of why no additional tests are needed
- Unit Tests (JS and/or Python)
- E2E Tests
- Add e2e test to ensure that the `current_fragment_id` error does not
happen
- Any manual testing needed?

---

**Contribution License Agreement**

By submitting this pull request you agree that all contributions to this
project are made under the Apache 2.0 license.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Right now, dialogs within an app always generate the same fragment id.
This is problematic and can lead to mixing contents of different
dialogs. Add a new parameter that is used by the dialog decorator to
pass the actually wrapped function name to the fragment in order to
generate the hash.
This behavior started to surface in the `feature/st.fragment` branch; prior to that we overwrote
fragments with the same id in the storage and since we only allow a single dialog at any given time, this issue stayed unrecognized.

- Unit Tests (JS and/or Python)
- Unit tests seem difficult to add for this because if we use the
`DeltaGeneratorTestCase`, the dialogs have different delta paths when
opened simultaneously versus the same delta path in a real app after a
rerun happened. Hence, I figured the e2e test resembles the chain of
sequence best.
- E2E Tests
- Add an e2e test that triggers the sequence of action that leads to the
bug

---

**Contribution License Agreement**

By submitting this pull request you agree that all contributions to this
project are made under the Apache 2.0 license.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
In the current state, an exception in a fragment will cause queued
fragments to stop from running. But instead we want queued fragments to
still run even if a previous fragment raised an exception (even if the
error happens in a full app run; the error will be displayed but the app
will continue to run).

To do so, we add except blocks into the loop and continue running the
other fragments in the queue.

Also, we want to stop app execution when a fragment raises an error
during a full app run. This is why the `exec_func_with_error_handling`
call is removed in `fragment.py`.

- Explanation of why no additional tests are needed
- Unit Tests (JS and/or Python)
- E2E Tests
- Any manual testing needed?

---

**Contribution License Agreement**

By submitting this pull request you agree that all contributions to this
project are made under the Apache 2.0 license.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
@raethlein raethlein force-pushed the feature/st.dialog branch from 1b25f9d to dbaeb8a Compare July 15, 2024 19:48
@raethlein raethlein merged commit 340f3f7 into develop Jul 15, 2024
33 checks passed
@raethlein raethlein deleted the feature/st.dialog branch August 8, 2024 14:06
sawyerh referenced this pull request in sawyerh/highlights Sep 2, 2024
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [streamlit](https://streamlit.io)
([source](https://togithub.com/streamlit/streamlit),
[changelog](https://docs.streamlit.io/develop/quick-reference/changelog))
| `1.35.0` -> `1.38.0` |
[![age](https://developer.mend.io/api/mc/badges/age/pypi/streamlit/1.38.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/streamlit/1.38.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/streamlit/1.35.0/1.38.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/streamlit/1.35.0/1.38.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>streamlit/streamlit (streamlit)</summary>

###
[`v1.38.0`](https://togithub.com/streamlit/streamlit/releases/tag/1.38.0)

[Compare
Source](https://togithub.com/streamlit/streamlit/compare/1.37.1...1.38.0)

<!-- Release notes generated using configuration in .github/release.yml
at 1.38.0 -->

#### What's Changed

##### Breaking Changes 🛠

- Remove pydantic fix in bootstrap by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9257](https://togithub.com/streamlit/streamlit/pull/9257)
- Remove experimental cached widget replay logic by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9305](https://togithub.com/streamlit/streamlit/pull/9305)

##### New Features 🎉

- \[RFC] Only rerun script on reconnect if a script run was interrupted
by [@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9083](https://togithub.com/streamlit/streamlit/pull/9083)
- Add syntax highlighting for diff by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9172](https://togithub.com/streamlit/streamlit/pull/9172)
- Support `to_pandas` method to return a Pandas Series by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9175](https://togithub.com/streamlit/streamlit/pull/9175)
- Add support for Kubernetes / directory with mounted file style secrets
by [@&#8203;sfc-gh-mochen](https://togithub.com/sfc-gh-mochen) in
[https://github.com/streamlit/streamlit/pull/9078](https://togithub.com/streamlit/streamlit/pull/9078)
- Extend dataframe-handling support for collection-like types by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9205](https://togithub.com/streamlit/streamlit/pull/9205)
- Add support for Snowpark Pandas Index by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9222](https://togithub.com/streamlit/streamlit/pull/9222)
- Add data handling support for Polars by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9230](https://togithub.com/streamlit/streamlit/pull/9230)
- Add data handling support for xarray by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9235](https://togithub.com/streamlit/streamlit/pull/9235)
- Add data handling support for Dask by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9240](https://togithub.com/streamlit/streamlit/pull/9240)
- Add data handling support for Ray by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9256](https://togithub.com/streamlit/streamlit/pull/9256)
- Type-hint improvements for
[#&#8203;8717](https://togithub.com/streamlit/streamlit/issues/8717) and
[#&#8203;7801](https://togithub.com/streamlit/streamlit/issues/7801) by
[@&#8203;Asaurus1](https://togithub.com/Asaurus1) in
[https://github.com/streamlit/streamlit/pull/9048](https://togithub.com/streamlit/streamlit/pull/9048)
- Allow configurable expansion depth for `st.json` by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/8984](https://togithub.com/streamlit/streamlit/pull/8984)
- Add data handling support for DB API 2.0 by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9274](https://togithub.com/streamlit/streamlit/pull/9274)
- Add data handling support for Pydantic instances by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9290](https://togithub.com/streamlit/streamlit/pull/9290)
- Add support for dataframe interchange protocol by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9289](https://togithub.com/streamlit/streamlit/pull/9289)
- Add line wrapping to st code by
[@&#8203;sfc-gh-tteixeira](https://togithub.com/sfc-gh-tteixeira) in
[https://github.com/streamlit/streamlit/pull/8558](https://togithub.com/streamlit/streamlit/pull/8558)

##### Bug Fixes 🐛

- Make the magic support for-else, while-else, try-else, try-except\*,
and match by [@&#8203;whitphx](https://togithub.com/whitphx) in
[https://github.com/streamlit/streamlit/pull/9110](https://togithub.com/streamlit/streamlit/pull/9110)
- Fix copy-buttons in dialogs by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9130](https://togithub.com/streamlit/streamlit/pull/9130)
- Support theming in embed better by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/9103](https://togithub.com/streamlit/streamlit/pull/9103)
- Fix
[#&#8203;8638](https://togithub.com/streamlit/streamlit/issues/8638) by
[@&#8203;kajarenc](https://togithub.com/kajarenc) in
[https://github.com/streamlit/streamlit/pull/9101](https://togithub.com/streamlit/streamlit/pull/9101)
- Bugfix: Multiple Stale Maps by
[@&#8203;sfc-gh-nbellante](https://togithub.com/sfc-gh-nbellante) in
[https://github.com/streamlit/streamlit/pull/9092](https://togithub.com/streamlit/streamlit/pull/9092)
- Bugfix: Upgrade plotly.js to resolve hover tooltip bug by
[@&#8203;sfc-gh-nbellante](https://togithub.com/sfc-gh-nbellante) in
[https://github.com/streamlit/streamlit/pull/9144](https://togithub.com/streamlit/streamlit/pull/9144)
- Make ScriptControlException inherit from BaseException again by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9167](https://togithub.com/streamlit/streamlit/pull/9167)
- Print deprecation warnings when dialog/fragment functions are called
by [@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9170](https://togithub.com/streamlit/streamlit/pull/9170)
- Revert "Remove fragment_ids_this_run from script run context
([#&#8203;8953](https://togithub.com/streamlit/streamlit/issues/8953))"
and tweaks some types by [@&#8203;vdonato](https://togithub.com/vdonato)
in
[https://github.com/streamlit/streamlit/pull/9178](https://togithub.com/streamlit/streamlit/pull/9178)
- Allow adding Plotly toolbar buttons by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9190](https://togithub.com/streamlit/streamlit/pull/9190)
- Ignore all headings in markdown labels by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9189](https://togithub.com/streamlit/streamlit/pull/9189)
- Don't raise FragmentStorageKeyError for auto_rerun fragments by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9183](https://togithub.com/streamlit/streamlit/pull/9183)
- Fix ghost tabs issue in fragments by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9186](https://togithub.com/streamlit/streamlit/pull/9186)
- Fix empty anchor scrolling by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9206](https://togithub.com/streamlit/streamlit/pull/9206)
- Only clear up fragment-related stale widgets by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9215](https://togithub.com/streamlit/streamlit/pull/9215)
- Fix issue with empty Azure OpenAI chunk by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9234](https://togithub.com/streamlit/streamlit/pull/9234)
- Fix grey-out for selectbox index columns by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9231](https://togithub.com/streamlit/streamlit/pull/9231)
- Fix options support for `dict.items()` by
[@&#8203;lukasmasuch](https://togithub.com/lukasmasuch) in
[https://github.com/streamlit/streamlit/pull/9241](https://togithub.com/streamlit/streamlit/pull/9241)
- When clearing forward queue add a stopped for rerun message by
[@&#8203;dannyopts](https://togithub.com/dannyopts) in
[https://github.com/streamlit/streamlit/pull/9187](https://togithub.com/streamlit/streamlit/pull/9187)
- Do not preserve children of a block if the block type changes by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/9276](https://togithub.com/streamlit/streamlit/pull/9276)
- Unstale just updated fragments by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9285](https://togithub.com/streamlit/streamlit/pull/9285)
- Fix logo + sidebar sizing interaction by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9298](https://togithub.com/streamlit/streamlit/pull/9298)

##### Other Changes

- Print bottom container always at the end of the app content by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9129](https://togithub.com/streamlit/streamlit/pull/9129)
- Remove a type ignore by
[@&#8203;wyattscarpenter](https://togithub.com/wyattscarpenter) in
[https://github.com/streamlit/streamlit/pull/9149](https://togithub.com/streamlit/streamlit/pull/9149)
- Use material icons in streamlit hello page nav and favicons by
[@&#8203;snehankekre](https://togithub.com/snehankekre) in
[https://github.com/streamlit/streamlit/pull/9225](https://togithub.com/streamlit/streamlit/pull/9225)
- Fix nested fragment stale elements by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9246](https://togithub.com/streamlit/streamlit/pull/9246)
- Use overloads to make the return types of st.feedback more precise.
(with type tests) by
[@&#8203;wyattscarpenter](https://togithub.com/wyattscarpenter) in
[https://github.com/streamlit/streamlit/pull/9216](https://togithub.com/streamlit/streamlit/pull/9216)

#### New Contributors

- [@&#8203;wyattscarpenter](https://togithub.com/wyattscarpenter) made
their first contribution in
[https://github.com/streamlit/streamlit/pull/9149](https://togithub.com/streamlit/streamlit/pull/9149)
- [@&#8203;sfc-gh-mochen](https://togithub.com/sfc-gh-mochen) made their
first contribution in
[https://github.com/streamlit/streamlit/pull/9078](https://togithub.com/streamlit/streamlit/pull/9078)
- [@&#8203;dannyopts](https://togithub.com/dannyopts) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/9187](https://togithub.com/streamlit/streamlit/pull/9187)

**Full Changelog**:
streamlit/streamlit@1.37.1...1.38.0

###
[`v1.37.1`](https://togithub.com/streamlit/streamlit/releases/tag/1.37.1)

[Compare
Source](https://togithub.com/streamlit/streamlit/compare/1.37.0...1.37.1)

<!-- Release notes generated using configuration in .github/release.yml
at 1.37.1 -->

**Full Changelog**:
streamlit/streamlit@1.37.0...1.37.1

###
[`v1.37.0`](https://togithub.com/streamlit/streamlit/releases/tag/1.37.0)

[Compare
Source](https://togithub.com/streamlit/streamlit/compare/1.36.0...1.37.0)

<!-- Release notes generated using configuration in .github/release.yml
at 1.37.0 -->

#### What's Changed

##### New Features 🎉

- Stacking options - `st.bar_chart` by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8945](https://togithub.com/streamlit/streamlit/pull/8945)
- Support `graphviz.sources.Source` object for `st.graphviz_chart` by
[@&#8203;sfc-gh-kbregula](https://togithub.com/sfc-gh-kbregula) in
[https://github.com/streamlit/streamlit/pull/8993](https://togithub.com/streamlit/streamlit/pull/8993)
- Add support for material icons in markdown by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8889](https://togithub.com/streamlit/streamlit/pull/8889)
- Fix lag when closing dialog by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9023](https://togithub.com/streamlit/streamlit/pull/9023)
- Stacking options - `st.area_chart` by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8992](https://togithub.com/streamlit/streamlit/pull/8992)
- Add feedback widget by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8915](https://togithub.com/streamlit/streamlit/pull/8915)
- READ only headers and cookies by
[@&#8203;kajarenc](https://togithub.com/kajarenc) in
[https://github.com/streamlit/streamlit/pull/8976](https://togithub.com/streamlit/streamlit/pull/8976)
- De-experimentalize st.fragment by
[@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9019](https://togithub.com/streamlit/streamlit/pull/9019)
- De-experimentalize st.dialog by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9020](https://togithub.com/streamlit/streamlit/pull/9020)

##### Bug Fixes 🐛

- Show fragment errors in fragment-path for main app runs by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8868](https://togithub.com/streamlit/streamlit/pull/8868)
- Fix st.rerun fragment thread reuse issue by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8798](https://togithub.com/streamlit/streamlit/pull/8798)
- Support non-unix style paths for MPA loading by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8988](https://togithub.com/streamlit/streamlit/pull/8988)
- Set theme hash properly on load if a custom theme is active to start
by [@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8989](https://togithub.com/streamlit/streamlit/pull/8989)
- Don't remove session refs on fragment runs by
[@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9010](https://togithub.com/streamlit/streamlit/pull/9010)
- Improvements to NumberInput formatting by
[@&#8203;sfc-gh-nbellante](https://togithub.com/sfc-gh-nbellante) in
[https://github.com/streamlit/streamlit/pull/9035](https://togithub.com/streamlit/streamlit/pull/9035)
- Hide all Particles upon printing by
[@&#8203;sfc-gh-nbellante](https://togithub.com/sfc-gh-nbellante) in
[https://github.com/streamlit/streamlit/pull/9053](https://togithub.com/streamlit/streamlit/pull/9053)
- Fix: MPA support of custom themes by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8994](https://togithub.com/streamlit/streamlit/pull/8994)
- `st.switch_page` clears non-embed query params by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9059](https://togithub.com/streamlit/streamlit/pull/9059)
- Fix secrets.toml Windows Path Bug by
[@&#8203;sfc-gh-nbellante](https://togithub.com/sfc-gh-nbellante) in
[https://github.com/streamlit/streamlit/pull/9061](https://togithub.com/streamlit/streamlit/pull/9061)
- Bugfix: Fixes two st.map width bugs by
[@&#8203;sfc-gh-nbellante](https://togithub.com/sfc-gh-nbellante) in
[https://github.com/streamlit/streamlit/pull/9070](https://togithub.com/streamlit/streamlit/pull/9070)
- Validate the path using Tornado before performing checks by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8990](https://togithub.com/streamlit/streamlit/pull/8990)
- Reset ctx.current_fragment_id to last ID instead of None by
[@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9114](https://togithub.com/streamlit/streamlit/pull/9114)

##### Other Changes

- Update emojis used for validation by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8923](https://togithub.com/streamlit/streamlit/pull/8923)
- Add support for numpy 2.x by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8940](https://togithub.com/streamlit/streamlit/pull/8940)
- Remove a bunch of deprecated experimental features by
[@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/8943](https://togithub.com/streamlit/streamlit/pull/8943)
- Migrate custom icons from material outlined to rounded by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8998](https://togithub.com/streamlit/streamlit/pull/8998)
- Remove old config options - part 1 by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9005](https://togithub.com/streamlit/streamlit/pull/9005)
- Remove old config options - part 2 by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9013](https://togithub.com/streamlit/streamlit/pull/9013)
- Remove `deprecation.showPyplotGlobalUse` config option by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/9018](https://togithub.com/streamlit/streamlit/pull/9018)
- Fix broken `st.navigation` docstring by
[@&#8203;mahotd](https://togithub.com/mahotd) in
[https://github.com/streamlit/streamlit/pull/9027](https://togithub.com/streamlit/streamlit/pull/9027)
- Update the feedback widget design by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9094](https://togithub.com/streamlit/streamlit/pull/9094)

#### New Contributors

- [@&#8203;Dev-iL](https://togithub.com/Dev-iL) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/8947](https://togithub.com/streamlit/streamlit/pull/8947)
- [@&#8203;quant12345](https://togithub.com/quant12345) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/8968](https://togithub.com/streamlit/streamlit/pull/8968)
- [@&#8203;mahotd](https://togithub.com/mahotd) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/9027](https://togithub.com/streamlit/streamlit/pull/9027)

**Full Changelog**:
streamlit/streamlit@1.36.0...1.37.0

###
[`v1.36.0`](https://togithub.com/streamlit/streamlit/releases/tag/1.36.0)

[Compare
Source](https://togithub.com/streamlit/streamlit/compare/1.35.0...1.36.0)

<!-- Release notes generated using configuration in .github/release.yml
at 1.36.0 -->

#### What's Changed

##### Breaking Changes 🛠

- Remove legacy caching logic by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8737](https://togithub.com/streamlit/streamlit/pull/8737)
- Deprecate the `experimental_allow_widgets` caching parameter by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8817](https://togithub.com/streamlit/streamlit/pull/8817)

##### New Features 🎉

- Allow passing on_change_callback for CustomComponents by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8633](https://togithub.com/streamlit/streamlit/pull/8633)
- Use raw number for number column overlay and copy by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8708](https://togithub.com/streamlit/streamlit/pull/8708)
- Introduce st.navigation and st.Page by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8744](https://togithub.com/streamlit/streamlit/pull/8744)
- Make st.write call st.json to display Streamlit secrets object by
[@&#8203;snehankekre](https://togithub.com/snehankekre) in
[https://github.com/streamlit/streamlit/pull/8659](https://togithub.com/streamlit/streamlit/pull/8659)
- Streamlit Charts: Customizable Axis Labels by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8846](https://togithub.com/streamlit/streamlit/pull/8846)
- Add vertical alignment parameter to `st.columns` by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8568](https://togithub.com/streamlit/streamlit/pull/8568)
- Add `icon` parameter to st.expander by
[@&#8203;snehankekre](https://togithub.com/snehankekre) in
[https://github.com/streamlit/streamlit/pull/8716](https://togithub.com/streamlit/streamlit/pull/8716)
- Use the default widget height for non-stacked checkbox & toggle
widgets by [@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8835](https://togithub.com/streamlit/streamlit/pull/8835)
- Horizontal `st.bar_chart` by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8877](https://togithub.com/streamlit/streamlit/pull/8877)

##### Bug Fixes 🐛

- Remove non-existent kwargs in ast.Call() call by
[@&#8203;JelleZijlstra](https://togithub.com/JelleZijlstra) in
[https://github.com/streamlit/streamlit/pull/8711](https://togithub.com/streamlit/streamlit/pull/8711)
- Don't instantiate the LocalSourcesWatcher if file watching is disabled
by [@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/8741](https://togithub.com/streamlit/streamlit/pull/8741)
- Make the session state writes disallowed message more generic by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8720](https://togithub.com/streamlit/streamlit/pull/8720)
- Ensure SessionInfo is set before performing an action by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8779](https://togithub.com/streamlit/streamlit/pull/8779)
- Unify the minimum height of most element by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8797](https://togithub.com/streamlit/streamlit/pull/8797)
- Don't allow writing widgets outside the fragment by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8756](https://togithub.com/streamlit/streamlit/pull/8756)
- Fix element replay regression for plotly charts by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8770](https://togithub.com/streamlit/streamlit/pull/8770)
- Improve exception text when selectbox index larger than options by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8775](https://togithub.com/streamlit/streamlit/pull/8775)
- Prevent images in markdown to go beyond the container width by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8794](https://togithub.com/streamlit/streamlit/pull/8794)
- Ensure current page script hash and active script hash is correct at
script start by [@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8830](https://togithub.com/streamlit/streamlit/pull/8830)
- Revert "Handle Altair resolve_scale
([#&#8203;8497](https://togithub.com/streamlit/streamlit/issues/8497))"
by [@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8845](https://togithub.com/streamlit/streamlit/pull/8845)
- Update custom-components import paths and tests by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8666](https://togithub.com/streamlit/streamlit/pull/8666)
- Raise exception if st.Page is given an invalid path by
[@&#8203;vdonato](https://togithub.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/8878](https://togithub.com/streamlit/streamlit/pull/8878)

##### Other Changes

- Explicitly export experimental_dialog by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8728](https://togithub.com/streamlit/streamlit/pull/8728)
- Remove default value for title of dialog_decorator by
[@&#8203;raethlein](https://togithub.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8729](https://togithub.com/streamlit/streamlit/pull/8729)
- Docstrings for 1.35.0 (and type consistency for charts) by
[@&#8203;sfc-gh-dmatthews](https://togithub.com/sfc-gh-dmatthews) in
[https://github.com/streamlit/streamlit/pull/8740](https://togithub.com/streamlit/streamlit/pull/8740)
- Migrate streamlit hello to MPAv2 by
[@&#8203;kmcgrady](https://togithub.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8806](https://togithub.com/streamlit/streamlit/pull/8806)
- Fix `use_container_width` docstring when default is `True` by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8809](https://togithub.com/streamlit/streamlit/pull/8809)
- Allow protobuf v5 as dependency by
[@&#8203;LukasMasuch](https://togithub.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8627](https://togithub.com/streamlit/streamlit/pull/8627)
- Fix: Remove title appending · Streamlit by
[@&#8203;mayagbarnes](https://togithub.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8900](https://togithub.com/streamlit/streamlit/pull/8900)

#### New Contributors

- [@&#8203;JelleZijlstra](https://togithub.com/JelleZijlstra) made their
first contribution in
[https://github.com/streamlit/streamlit/pull/8711](https://togithub.com/streamlit/streamlit/pull/8711)

**Full Changelog**:
streamlit/streamlit@1.35.0...1.36.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on the first day of the
month" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/sawyerh/highlights).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM4LjU2LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
holtskinner referenced this pull request in GoogleCloudPlatform/generative-ai Sep 17, 2024
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [streamlit](https://streamlit.io)
([source](https://redirect.github.com/streamlit/streamlit),
[changelog](https://docs.streamlit.io/develop/quick-reference/changelog))
| `1.36.0` -> `1.37.0` |
[![age](https://developer.mend.io/api/mc/badges/age/pypi/streamlit/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/streamlit/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/streamlit/1.36.0/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/streamlit/1.36.0/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for
more information.

### GitHub Vulnerability Alerts

####
[CVE-2024-42474](https://redirect.github.com/streamlit/streamlit/security/advisories/GHSA-rxff-vr5r-8cj5)

### 1. Impacted Products
Streamilt Open Source versions before 1.37.0.

### 2. Introduction
Snowflake Streamlit open source addressed a security vulnerability via
the [static file sharing
feature](https://docs.streamlit.io/develop/concepts/configuration/serving-static-files).
The vulnerability was patched on Jul 25, 2024, as part of Streamlit open
source version 1.37.0. The vulnerability only affects Windows.

### 3. Path Traversal Vulnerability 

#### 3.1 Description
On May 12, 2024, Streamlit was informed via our bug bounty program about
a path traversal vulnerability in the open source library. We fixed and
merged a patch remediating the vulnerability on Jul 25, 2024. The issue
was determined to be in the moderate severity range with a maximum
CVSSv3 base score of
[5.9](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N)

#### 3.2 Scenarios and attack vector(s)
Users of hosted Streamlit app(s) on Windows were vulnerable to a path
traversal vulnerability when the [static file sharing
feature](https://docs.streamlit.io/develop/concepts/configuration/serving-static-files)
is enabled. An attacker could utilize the vulnerability to leak the
password hash of the Windows user running Streamlit.

#### 3.3 Resolution
The vulnerability has been fixed in all Streamlit versions released
since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.

### 4. Contact
Please contact security@snowflake.com if you have any questions
regarding this advisory. If you discover a security vulnerability in one
of our products or websites, please report the issue to HackerOne. For
more information, please see our [Vulnerability Disclosure
Policy](https://hackerone.com/snowflake?type=team).

---

### Release Notes

<details>
<summary>streamlit/streamlit (streamlit)</summary>

###
[`v1.37.0`](https://redirect.github.com/streamlit/streamlit/releases/tag/1.37.0)

[Compare
Source](https://redirect.github.com/streamlit/streamlit/compare/1.36.0...1.37.0)

<!-- Release notes generated using configuration in .github/release.yml
at 1.37.0 -->

#### What's Changed

##### New Features 🎉

- Stacking options - `st.bar_chart` by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8945](https://redirect.github.com/streamlit/streamlit/pull/8945)
- Support `graphviz.sources.Source` object for `st.graphviz_chart` by
[@&#8203;sfc-gh-kbregula](https://redirect.github.com/sfc-gh-kbregula)
in
[https://github.com/streamlit/streamlit/pull/8993](https://redirect.github.com/streamlit/streamlit/pull/8993)
- Add support for material icons in markdown by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8889](https://redirect.github.com/streamlit/streamlit/pull/8889)
- Fix lag when closing dialog by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9023](https://redirect.github.com/streamlit/streamlit/pull/9023)
- Stacking options - `st.area_chart` by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8992](https://redirect.github.com/streamlit/streamlit/pull/8992)
- Add feedback widget by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8915](https://redirect.github.com/streamlit/streamlit/pull/8915)
- READ only headers and cookies by
[@&#8203;kajarenc](https://redirect.github.com/kajarenc) in
[https://github.com/streamlit/streamlit/pull/8976](https://redirect.github.com/streamlit/streamlit/pull/8976)
- De-experimentalize st.fragment by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9019](https://redirect.github.com/streamlit/streamlit/pull/9019)
- De-experimentalize st.dialog by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9020](https://redirect.github.com/streamlit/streamlit/pull/9020)

##### Bug Fixes 🐛

- Show fragment errors in fragment-path for main app runs by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8868](https://redirect.github.com/streamlit/streamlit/pull/8868)
- Fix st.rerun fragment thread reuse issue by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8798](https://redirect.github.com/streamlit/streamlit/pull/8798)
- Support non-unix style paths for MPA loading by
[@&#8203;kmcgrady](https://redirect.github.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8988](https://redirect.github.com/streamlit/streamlit/pull/8988)
- Set theme hash properly on load if a custom theme is active to start
by [@&#8203;kmcgrady](https://redirect.github.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8989](https://redirect.github.com/streamlit/streamlit/pull/8989)
- Don't remove session refs on fragment runs by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9010](https://redirect.github.com/streamlit/streamlit/pull/9010)
- Improvements to NumberInput formatting by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9035](https://redirect.github.com/streamlit/streamlit/pull/9035)
- Hide all Particles upon printing by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9053](https://redirect.github.com/streamlit/streamlit/pull/9053)
- Fix: MPA support of custom themes by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8994](https://redirect.github.com/streamlit/streamlit/pull/8994)
- `st.switch_page` clears non-embed query params by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9059](https://redirect.github.com/streamlit/streamlit/pull/9059)
- Fix secrets.toml Windows Path Bug by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9061](https://redirect.github.com/streamlit/streamlit/pull/9061)
- Bugfix: Fixes two st.map width bugs by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9070](https://redirect.github.com/streamlit/streamlit/pull/9070)
- Validate the path using Tornado before performing checks by
[@&#8203;kmcgrady](https://redirect.github.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8990](https://redirect.github.com/streamlit/streamlit/pull/8990)
- Reset ctx.current_fragment_id to last ID instead of None by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9114](https://redirect.github.com/streamlit/streamlit/pull/9114)

##### Other Changes

- Update emojis used for validation by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8923](https://redirect.github.com/streamlit/streamlit/pull/8923)
- Add support for numpy 2.x by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8940](https://redirect.github.com/streamlit/streamlit/pull/8940)
- Remove a bunch of deprecated experimental features by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/8943](https://redirect.github.com/streamlit/streamlit/pull/8943)
- Migrate custom icons from material outlined to rounded by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8998](https://redirect.github.com/streamlit/streamlit/pull/8998)
- Remove old config options - part 1 by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9005](https://redirect.github.com/streamlit/streamlit/pull/9005)
- Remove old config options - part 2 by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9013](https://redirect.github.com/streamlit/streamlit/pull/9013)
- Remove `deprecation.showPyplotGlobalUse` config option by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/9018](https://redirect.github.com/streamlit/streamlit/pull/9018)
- Fix broken `st.navigation` docstring by
[@&#8203;mahotd](https://redirect.github.com/mahotd) in
[https://github.com/streamlit/streamlit/pull/9027](https://redirect.github.com/streamlit/streamlit/pull/9027)
- Update the feedback widget design by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9094](https://redirect.github.com/streamlit/streamlit/pull/9094)

#### New Contributors

- [@&#8203;Dev-iL](https://redirect.github.com/Dev-iL) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/8947](https://redirect.github.com/streamlit/streamlit/pull/8947)
- [@&#8203;quant12345](https://redirect.github.com/quant12345) made
their first contribution in
[https://github.com/streamlit/streamlit/pull/8968](https://redirect.github.com/streamlit/streamlit/pull/8968)
- [@&#8203;mahotd](https://redirect.github.com/mahotd) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/9027](https://redirect.github.com/streamlit/streamlit/pull/9027)

**Full Changelog**:
streamlit/streamlit@1.36.0...1.37.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/GoogleCloudPlatform/generative-ai).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC44MC4wIiwidXBkYXRlZEluVmVyIjoiMzguODAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
nhootan referenced this pull request in nhootan/generative-ai Sep 18, 2024
…eCloudPlatform#1104)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [streamlit](https://streamlit.io)
([source](https://redirect.github.com/streamlit/streamlit),
[changelog](https://docs.streamlit.io/develop/quick-reference/changelog))
| `1.36.0` -> `1.37.0` |
[![age](https://developer.mend.io/api/mc/badges/age/pypi/streamlit/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/streamlit/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/streamlit/1.36.0/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/streamlit/1.36.0/1.37.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for
more information.

### GitHub Vulnerability Alerts

####
[CVE-2024-42474](https://redirect.github.com/streamlit/streamlit/security/advisories/GHSA-rxff-vr5r-8cj5)

### 1. Impacted Products
Streamilt Open Source versions before 1.37.0.

### 2. Introduction
Snowflake Streamlit open source addressed a security vulnerability via
the [static file sharing
feature](https://docs.streamlit.io/develop/concepts/configuration/serving-static-files).
The vulnerability was patched on Jul 25, 2024, as part of Streamlit open
source version 1.37.0. The vulnerability only affects Windows.

### 3. Path Traversal Vulnerability 

#### 3.1 Description
On May 12, 2024, Streamlit was informed via our bug bounty program about
a path traversal vulnerability in the open source library. We fixed and
merged a patch remediating the vulnerability on Jul 25, 2024. The issue
was determined to be in the moderate severity range with a maximum
CVSSv3 base score of
[5.9](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N)

#### 3.2 Scenarios and attack vector(s)
Users of hosted Streamlit app(s) on Windows were vulnerable to a path
traversal vulnerability when the [static file sharing
feature](https://docs.streamlit.io/develop/concepts/configuration/serving-static-files)
is enabled. An attacker could utilize the vulnerability to leak the
password hash of the Windows user running Streamlit.

#### 3.3 Resolution
The vulnerability has been fixed in all Streamlit versions released
since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.

### 4. Contact
Please contact security@snowflake.com if you have any questions
regarding this advisory. If you discover a security vulnerability in one
of our products or websites, please report the issue to HackerOne. For
more information, please see our [Vulnerability Disclosure
Policy](https://hackerone.com/snowflake?type=team).

---

### Release Notes

<details>
<summary>streamlit/streamlit (streamlit)</summary>

###
[`v1.37.0`](https://redirect.github.com/streamlit/streamlit/releases/tag/1.37.0)

[Compare
Source](https://redirect.github.com/streamlit/streamlit/compare/1.36.0...1.37.0)

<!-- Release notes generated using configuration in .github/release.yml
at 1.37.0 -->

#### What's Changed

##### New Features 🎉

- Stacking options - `st.bar_chart` by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8945](https://redirect.github.com/streamlit/streamlit/pull/8945)
- Support `graphviz.sources.Source` object for `st.graphviz_chart` by
[@&#8203;sfc-gh-kbregula](https://redirect.github.com/sfc-gh-kbregula)
in
[https://github.com/streamlit/streamlit/pull/8993](https://redirect.github.com/streamlit/streamlit/pull/8993)
- Add support for material icons in markdown by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8889](https://redirect.github.com/streamlit/streamlit/pull/8889)
- Fix lag when closing dialog by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9023](https://redirect.github.com/streamlit/streamlit/pull/9023)
- Stacking options - `st.area_chart` by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8992](https://redirect.github.com/streamlit/streamlit/pull/8992)
- Add feedback widget by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8915](https://redirect.github.com/streamlit/streamlit/pull/8915)
- READ only headers and cookies by
[@&#8203;kajarenc](https://redirect.github.com/kajarenc) in
[https://github.com/streamlit/streamlit/pull/8976](https://redirect.github.com/streamlit/streamlit/pull/8976)
- De-experimentalize st.fragment by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9019](https://redirect.github.com/streamlit/streamlit/pull/9019)
- De-experimentalize st.dialog by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9020](https://redirect.github.com/streamlit/streamlit/pull/9020)

##### Bug Fixes 🐛

- Show fragment errors in fragment-path for main app runs by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8868](https://redirect.github.com/streamlit/streamlit/pull/8868)
- Fix st.rerun fragment thread reuse issue by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/8798](https://redirect.github.com/streamlit/streamlit/pull/8798)
- Support non-unix style paths for MPA loading by
[@&#8203;kmcgrady](https://redirect.github.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8988](https://redirect.github.com/streamlit/streamlit/pull/8988)
- Set theme hash properly on load if a custom theme is active to start
by [@&#8203;kmcgrady](https://redirect.github.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8989](https://redirect.github.com/streamlit/streamlit/pull/8989)
- Don't remove session refs on fragment runs by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9010](https://redirect.github.com/streamlit/streamlit/pull/9010)
- Improvements to NumberInput formatting by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9035](https://redirect.github.com/streamlit/streamlit/pull/9035)
- Hide all Particles upon printing by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9053](https://redirect.github.com/streamlit/streamlit/pull/9053)
- Fix: MPA support of custom themes by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/8994](https://redirect.github.com/streamlit/streamlit/pull/8994)
- `st.switch_page` clears non-embed query params by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9059](https://redirect.github.com/streamlit/streamlit/pull/9059)
- Fix secrets.toml Windows Path Bug by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9061](https://redirect.github.com/streamlit/streamlit/pull/9061)
- Bugfix: Fixes two st.map width bugs by
[@&#8203;sfc-gh-nbellante](https://redirect.github.com/sfc-gh-nbellante)
in
[https://github.com/streamlit/streamlit/pull/9070](https://redirect.github.com/streamlit/streamlit/pull/9070)
- Validate the path using Tornado before performing checks by
[@&#8203;kmcgrady](https://redirect.github.com/kmcgrady) in
[https://github.com/streamlit/streamlit/pull/8990](https://redirect.github.com/streamlit/streamlit/pull/8990)
- Reset ctx.current_fragment_id to last ID instead of None by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/9114](https://redirect.github.com/streamlit/streamlit/pull/9114)

##### Other Changes

- Update emojis used for validation by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8923](https://redirect.github.com/streamlit/streamlit/pull/8923)
- Add support for numpy 2.x by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8940](https://redirect.github.com/streamlit/streamlit/pull/8940)
- Remove a bunch of deprecated experimental features by
[@&#8203;vdonato](https://redirect.github.com/vdonato) in
[https://github.com/streamlit/streamlit/pull/8943](https://redirect.github.com/streamlit/streamlit/pull/8943)
- Migrate custom icons from material outlined to rounded by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/8998](https://redirect.github.com/streamlit/streamlit/pull/8998)
- Remove old config options - part 1 by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9005](https://redirect.github.com/streamlit/streamlit/pull/9005)
- Remove old config options - part 2 by
[@&#8203;mayagbarnes](https://redirect.github.com/mayagbarnes) in
[https://github.com/streamlit/streamlit/pull/9013](https://redirect.github.com/streamlit/streamlit/pull/9013)
- Remove `deprecation.showPyplotGlobalUse` config option by
[@&#8203;LukasMasuch](https://redirect.github.com/LukasMasuch) in
[https://github.com/streamlit/streamlit/pull/9018](https://redirect.github.com/streamlit/streamlit/pull/9018)
- Fix broken `st.navigation` docstring by
[@&#8203;mahotd](https://redirect.github.com/mahotd) in
[https://github.com/streamlit/streamlit/pull/9027](https://redirect.github.com/streamlit/streamlit/pull/9027)
- Update the feedback widget design by
[@&#8203;raethlein](https://redirect.github.com/raethlein) in
[https://github.com/streamlit/streamlit/pull/9094](https://redirect.github.com/streamlit/streamlit/pull/9094)

#### New Contributors

- [@&#8203;Dev-iL](https://redirect.github.com/Dev-iL) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/8947](https://redirect.github.com/streamlit/streamlit/pull/8947)
- [@&#8203;quant12345](https://redirect.github.com/quant12345) made
their first contribution in
[https://github.com/streamlit/streamlit/pull/8968](https://redirect.github.com/streamlit/streamlit/pull/8968)
- [@&#8203;mahotd](https://redirect.github.com/mahotd) made their first
contribution in
[https://github.com/streamlit/streamlit/pull/9027](https://redirect.github.com/streamlit/streamlit/pull/9027)

**Full Changelog**:
streamlit/streamlit@1.36.0...1.37.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/GoogleCloudPlatform/generative-ai).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC44MC4wIiwidXBkYXRlZEluVmVyIjoiMzguODAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
benjamin-awd pushed a commit to benjamin-awd/streamlit that referenced this pull request Sep 29, 2024
## Describe your changes

Merge **after** streamlit#9019

With streamlit#9019 landing, we are
also de-experimentializing the `@st.experimental_dialog` decorator and
introduce `@st.dialog`. As a consequence of the aforementioned PR,
dialogs can then
- call other fragments or be opened from fragments, although dialogs are
not allowed to open other dialogs
- dialogs can be opened by callbacks (closes
streamlit#8591)

Update all used instances of `@st.experimental_dialog` to `@st.dialog`.

## GitHub Issue Link (if applicable)

## Testing Plan

- Unit Tests (JS and/or Python)
- Added a unit test to ensure that the experimental-decorator still
continues to work

Closes streamlit#9063

---

**Contribution License Agreement**

By submitting this pull request you agree that all contributions to this
project are made under the Apache 2.0 license.

---------

Co-authored-by: Vincent Donato <vincent@streamlit.io>
edegp pushed a commit to edegp/streamlit that referenced this pull request Jan 19, 2025
## Describe your changes

Merge **after** streamlit#9019

With streamlit#9019 landing, we are
also de-experimentializing the `@st.experimental_dialog` decorator and
introduce `@st.dialog`. As a consequence of the aforementioned PR,
dialogs can then
- call other fragments or be opened from fragments, although dialogs are
not allowed to open other dialogs
- dialogs can be opened by callbacks (closes
streamlit#8591)

Update all used instances of `@st.experimental_dialog` to `@st.dialog`.

## GitHub Issue Link (if applicable)

## Testing Plan

- Unit Tests (JS and/or Python)
- Added a unit test to ensure that the experimental-decorator still
continues to work

Closes streamlit#9063

---

**Contribution License Agreement**

By submitting this pull request you agree that all contributions to this
project are made under the Apache 2.0 license.

---------

Co-authored-by: Vincent Donato <vincent@streamlit.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants