Update dependency streamlit to v1.37.0 [SECURITY] #10
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
renovate
bot
force-pushed
the
renovate/pypi-streamlit-vulnerability
branch
from
b88cf47 to
aadb186
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
renovate
bot
force-pushed
the
renovate/pypi-streamlit-vulnerability
branch
from
aadb186 to
e1f2824
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.22.0->==1.37.0GitHub Vulnerability Alerts
GHSA-8qw9-gf7w-42x5
Impact
The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.
Patches
We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.
Workarounds
No additional workarounds are necessary once the update to version 1.30.0 is applied.
For more information
If you have any questions or comments about this advisory:
CVE-2024-42474
1. Impacted Products
Streamilt Open Source versions before 1.37.0.
2. Introduction
Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
3. Path Traversal Vulnerability
3.1 Description
On May 12, 2024, Streamlit was informed via our bug bounty program about a path traversal vulnerability in the open source library. We fixed and merged a patch remediating the vulnerability on Jul 25, 2024. The issue was determined to be in the moderate severity range with a maximum CVSSv3 base score of 5.9
3.2 Scenarios and attack vector(s)
Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit.
3.3 Resolution
The vulnerability has been fixed in all Streamlit versions released since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.
4. Contact
Please contact security@snowflake.com if you have any questions regarding this advisory. If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Release Notes
streamlit/streamlit (streamlit)
v1.37.0Compare Source
What's Changed
New Features 🎉
st.bar_chartby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8945graphviz.sources.Sourceobject forst.graphviz_chartby @sfc-gh-kbregula in https://github.com/streamlit/streamlit/pull/8993st.area_chartby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8992Bug Fixes 🐛
st.switch_pageclears non-embed query params by @mayagbarnes in https://github.com/streamlit/streamlit/pull/9059Other Changes
deprecation.showPyplotGlobalUseconfig option by @LukasMasuch in https://github.com/streamlit/streamlit/pull/9018st.navigationdocstring by @mahotd in https://github.com/streamlit/streamlit/pull/9027New Contributors
Full Changelog: streamlit/streamlit@1.36.0...1.37.0
v1.36.0Compare Source
What's Changed
Breaking Changes 🛠
experimental_allow_widgetscaching parameter by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8817New Features 🎉
st.columnsby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8568iconparameter to st.expander by @snehankekre in https://github.com/streamlit/streamlit/pull/8716st.bar_chartby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8877Bug Fixes 🐛
Other Changes
use_container_widthdocstring when default isTrueby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8809New Contributors
Full Changelog: streamlit/streamlit@1.35.0...1.36.0
v1.35.0Compare Source
What's Changed
New Features 🎉
st.plotly_chartby @willhuang1997 in https://github.com/streamlit/streamlit/pull/8191st.logoby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8554st.altair_chart&st.vega_lite_chartby @willhuang1997 in https://github.com/streamlit/streamlit/pull/8302Bug Fixes 🐛
Other Changes
st.tableby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8621.updateand.from_dictby @Asaurus1 in https://github.com/streamlit/streamlit/pull/8614New Contributors
Full Changelog: streamlit/streamlit@1.34.0...1.35.0
v1.34.0Compare Source
What's Changed
New Features 🎉
st.dataframeandst.data_editorby @LukasMasuch in https://github.com/streamlit/streamlit/pull/7987<cached_func>.clear()by @OscarSaharoy in https://github.com/streamlit/streamlit/pull/8297st.audioandst.videomedia by @snehankekre in https://github.com/streamlit/streamlit/pull/8481Bug Fixes 🐛
st.statusby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8369st.multiselectusage with empty sets or tuples by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8471st.write_streamby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8560Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.33.0...1.34.0
v1.33.0Compare Source
What's Changed
Breaking Changes 🛠
New Features 🎉
AreaChartColumnto column config by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8237start_timeandend_time. by @kajarenc in https://github.com/streamlit/streamlit/pull/8348st.htmlby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8366Bug Fixes 🐛
rerunand triggered widgets are used together in AppTest by @AnOctopus in https://github.com/streamlit/streamlit/pull/8264st.popovercontainer by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8266Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.32.2...1.33.0
v1.32.2Compare Source
Full Changelog: streamlit/streamlit@1.32.1...1.32.2
v1.32.1Compare Source
Full Changelog: streamlit/streamlit@1.32.0...1.32.1
v1.32.0Compare Source
What's Changed
New Features 🎉
st.radiooptions by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8028st.write_streamby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8036st.writeby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8039st.popoverlayout container by @LukasMasuch in https://github.com/streamlit/streamlit/pull/7908from_functionargs by @AnOctopus in https://github.com/streamlit/streamlit/pull/8183st.videoby @kajarenc in https://github.com/streamlit/streamlit/pull/8057Bug Fixes 🐛
st.query_paramsto string by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8030time_inputmenu colors in dark mode by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8056st.imageon windows. by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8092st.page_link&st.switch_pagehandling / prefixed paths by @mayagbarnes in https://github.com/streamlit/streamlit/pull/8085st.switch_pageandst.page_linkby @kajarenc in https://github.com/streamlit/streamlit/pull/8103st.page_linkURL preview shows file path by @mayagbarnes in https://github.com/streamlit/streamlit/pull/8086Other Changes
deprecation.showPyplotGlobalUseconfig option by @LukasMasuch in https://github.com/streamlit/streamlit/pull/81333000is used by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8152New Contributors
Full Changelog: streamlit/streamlit@1.31.1...1.32.0
v1.31.1Compare Source
Full Changelog: streamlit/streamlit@1.31.0...1.31.1
v1.31.0Compare Source
What's Changed
New Features 🎉
st.chat_inputby @LukasMasuch in https://github.com/streamlit/streamlit/pull/7896st.page_linkby @mayagbarnes in https://github.com/streamlit/streamlit/pull/7965st.write_streamcommand to handle generators or OpenAI output by @LukasMasuch in https://github.com/streamlit/streamlit/pull/7906Bug Fixes 🐛
noneorpollwatcher type by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8024Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.30.0...1.31.0
v1.30.0Compare Source
What's Changed
New Features 🎉
heightparameter by @LukasMasuch in https://github.com/streamlit/streamlit/pull/7697LinkColumnby @LukasMasuch in https://github.com/streamlit/streamlit/pull/7784st.switch_pageby @mayagbarnes in https://github.com/streamlit/streamlit/pull/7853Bug Fixes 🐛
st.togglebackground color by @sfc-gh-jgarcia in https://github.com/streamlit/streamlit/pull/7788Other Changes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.