@stlite/desktop 0.92.0 → 0.93.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @stlite/desktop
 
+## 0.93.0
+
+### Minor Changes
+
+- [#1839](https://github.com/whitphx/stlite/pull/1839) [`c575e4c`](https://github.com/whitphx/stlite/commit/c575e4cf476c85b2a679a288618766841ba09727) Thanks [@whitphx](https://github.com/whitphx)! - Add `appMenu` option to hide the application menu bar. Set `stlite.desktop.appMenu` to `false` in your `package.json` to completely remove the Electron application menu.
+
+## 0.92.1
+
+### Patch Changes
+
+- [#1828](https://github.com/whitphx/stlite/pull/1828) [`28db6f0`](https://github.com/whitphx/stlite/commit/28db6f0639c0cb57ed2ad3b420160fd3f3ade3f2) Thanks [@whitphx](https://github.com/whitphx)! - Add security considerations documentation for NodeJS worker mode
+
 ## 0.92.0
 
 ### Minor Changes

package/README.md

@@ -125,6 +125,23 @@ If you want to hide the toolbar, hamburger menu, and footer, add the following t
 }
 ```
 
+### Hide the application menu
+
+If you want to hide the application menu bar (File, Edit, View, etc.), set `stlite.desktop.appMenu` to `false`:
+
+```json
+{
+  // ...other fields...
+  "stlite": {
+    "desktop": {
+      "appMenu": false
+    }
+  }
+}
+```
+
+On Windows and Linux, this removes the menu bar from the window entirely. On macOS, this removes the application menu from the menu bar at the top of the screen.
+
 ### File system
 
 _Stlite_ runs your Python code on [Pyodide](https://pyodide.org/), a CPython runtime compiled to Wasm, and Pyodide's backend, Emscripten, provides a virtual file system.
@@ -213,6 +230,16 @@ When you set the `stlite.desktop.nodeJsWorker` field in your `package.json` to `
 }
 ```
 
+#### Security considerations
+
+When NodeJS worker mode is enabled, the Python code executes within a Node.js worker thread in the main process. This means:
+
+- **The Python code has the same privileges as the Node.js process itself.** It can access the file system, spawn child processes, make network requests, and perform any operation that Node.js can do.
+- **There is no sandbox.** Unlike the default Web Worker mode (which runs in a browser-like sandboxed environment), NodeJS worker mode provides no isolation between your Python code and the host operating system.
+- **You are responsible for the security of your app.** If your app executes untrusted Python code or loads untrusted packages, those could potentially harm the user's system.
+
+This is an intentional design to enable powerful features like direct file system access via NODEFS. However, you should only use this mode when you trust all Python code and packages that your app will execute.
+
 ## Limitations
 
 - Navigation to external resources like `st.markdown("[link](https://streamlit.io/)")` does not work for security. See https://github.com/whitphx/stlite/pull/445 and let us know if you have use cases where you have to use such external links.