chore(deps): update dependency streamlit to v1.37.0 [security] #1412
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
forking-renovate
bot
added
lang: python
NimJay
approved these changes
Aug 15, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.34.0->==1.37.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2024-42474
1. Impacted Products
Streamilt Open Source versions before 1.37.0.
2. Introduction
Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
3. Path Traversal Vulnerability
3.1 Description
On May 12, 2024, Streamlit was informed via our bug bounty program about a path traversal vulnerability in the open source library. We fixed and merged a patch remediating the vulnerability on Jul 25, 2024. The issue was determined to be in the moderate severity range with a maximum CVSSv3 base score of 5.9
3.2 Scenarios and attack vector(s)
Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit.
3.3 Resolution
The vulnerability has been fixed in all Streamlit versions released since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.
4. Contact
Please contact [email protected] if you have any questions regarding this advisory. If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Release Notes
streamlit/streamlit (streamlit)
v1.37.0Compare Source
What's Changed
New Features 🎉
st.bar_chartby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8945graphviz.sources.Sourceobject forst.graphviz_chartby @sfc-gh-kbregula in https://github.com/streamlit/streamlit/pull/8993st.area_chartby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8992Bug Fixes 🐛
st.switch_pageclears non-embed query params by @mayagbarnes in https://github.com/streamlit/streamlit/pull/9059Other Changes
deprecation.showPyplotGlobalUseconfig option by @LukasMasuch in https://github.com/streamlit/streamlit/pull/9018st.navigationdocstring by @mahotd in https://github.com/streamlit/streamlit/pull/9027New Contributors
Full Changelog: streamlit/streamlit@1.36.0...1.37.0
v1.36.0Compare Source
What's Changed
Breaking Changes 🛠
experimental_allow_widgetscaching parameter by @LukasMasuch in https://github.com/streamlit/streamlit/pull/8817New Features 🎉
st.columnsby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8568iconparameter to st.expander by @snehankekre in https://github.com/streamlit/streamlit/pull/8716st.bar_chartby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8877Bug Fixes 🐛
Other Changes
use_container_widthdocstring when default isTrueby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8809New Contributors
Full Changelog: streamlit/streamlit@1.35.0...1.36.0
v1.35.0Compare Source
What's Changed
New Features 🎉
st.plotly_chartby @willhuang1997 in https://github.com/streamlit/streamlit/pull/8191st.logoby @mayagbarnes in https://github.com/streamlit/streamlit/pull/8554st.altair_chart&st.vega_lite_chartby @willhuang1997 in https://github.com/streamlit/streamlit/pull/8302Bug Fixes 🐛
Other Changes
st.tableby @LukasMasuch in https://github.com/streamlit/streamlit/pull/8621.updateand.from_dictby @Asaurus1 in https://github.com/streamlit/streamlit/pull/8614New Contributors
Full Changelog: streamlit/streamlit@1.34.0...1.35.0
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.