solara-ui 1.57.0__tar.gz → 1.57.2__tar.gz

{solara_ui-1.57.0 → solara_ui-1.57.2}/.gitignore

@@ -67,6 +67,7 @@ python/.idea
 test/.idea
 venv
 .venv
+uv.lock
 tmp
 python/vaex/version.py # gets generated
 **/*.egg-info/

{solara_ui-1.57.0 → solara_ui-1.57.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: solara-ui
-Version: 1.57.0
+Version: 1.57.2
 Dynamic: Summary
 Project-URL: Home, https://www.github.com/widgetti/solara
 Project-URL: Documentation, https://solara.dev

{solara_ui-1.57.0 → solara_ui-1.57.2}/solara/__init__.py

@@ -1,6 +1,6 @@
 """Build webapps using IPywidgets"""
 
-__version__ = "1.57.0"
+__version__ = "1.57.2"
 github_url = "https://github.com/widgetti/solara"
 git_branch = "master"
 

{solara_ui-1.57.0 → solara_ui-1.57.2}/solara/components/figure_altair.py

@@ -25,11 +25,15 @@ def FigureAltair(
 
     with alt.renderers.enable("mimetype"):
         bundle = chart._repr_mimebundle_()[0]
-        key4 = "application/vnd.vegalite.v4+json"
-        key5 = "application/vnd.vegalite.v5+json"
-        if key4 not in bundle and key5 not in bundle:
-            raise KeyError(f"{key4} and {key5} not in mimebundle:\n\n{bundle}")
-        spec = bundle.get(key5, bundle.get(key4))
+        # Find the Vega-Lite spec from the bundle (supports v4, v5, v6+)
+        # MIME type format varies: v4/v5 use "+json" suffix, v6 uses ".json"
+        spec = None
+        for key in bundle:
+            if key.startswith("application/vnd.vegalite.v"):
+                spec = bundle[key]
+                break
+        if spec is None:
+            raise KeyError(f"No Vega-Lite MIME type found in mimebundle: {list(bundle.keys())}")
         return solara.widgets.VegaLite.element(
             spec=spec, on_click=on_click, listen_to_click=on_click is not None, on_hover=on_hover, listen_to_hover=on_hover is not None
         )

{solara_ui-1.57.0 → solara_ui-1.57.2}/solara/server/static/solara_bootstrap.py

@@ -119,7 +119,7 @@ async def main():
     ]
     for dep in requirements:
         await micropip.install(dep, keep_going=True)
-    await micropip.install("/wheels/solara-1.57.0-py2.py3-none-any.whl", keep_going=True)
+    await micropip.install("/wheels/solara-1.57.2-py2.py3-none-any.whl", keep_going=True)
     import solara
 
     el = solara.Warning("lala")

{solara_ui-1.57.0 → solara_ui-1.57.2}/solara/server/utils.py

@@ -27,7 +27,11 @@ def path_is_child_of(path: Path, parent: Path) -> bool:
         # on windows, we sometimes get different casing (only seen on CI)
         path_string = path_string.lower()
         parent_string = parent_string.lower()
-    return path_string.startswith(parent_string)
+    # Ensure we check for a proper path boundary, not just string prefix.
+    # Without the separator, "/parent_sibling" would match "/parent"
+    if not parent_string.endswith(os.sep):
+        parent_string = parent_string + os.sep
+    return path_string.startswith(parent_string) or path_string == parent_string.rstrip(os.sep)
 
 
 @contextlib.contextmanager

{solara_ui-1.57.0 → solara_ui-1.57.2}/solara/toestand.py

@@ -4,6 +4,7 @@ import logging
 import os
 import sys
 import threading
+import weakref
 from types import FrameType
 import warnings
 import copy
@@ -929,37 +930,83 @@ class AutoSubscribeContextManagerBase:
         thread_local.reactive_watch = self.previous_reactive_watch
         self.unsubscribe_previous()
         self.subscribed_previous_run = self.subscribed.copy()
+        # Clear saved references to avoid preventing garbage collection.
+        # Without this, a Computed's AutoSubscribeContextManager retains
+        # previous_reactive_watch (a bound method from the component's
+        # AutoSubscribeContextManagerReacton), which transitively keeps
+        # the _RenderContext alive through closure cells.
+        self.previous_reactive_watch = None
+        self.reactive_used_before = None
 
 
 class Context:
     def __init__(self, render_context, kernel_context):
         # combine the render context *and* the kernel context into one context
-        self.render_context = render_context
-        self.kernel_context = kernel_context
+        # Use weakrefs for both render_context and kernel_context to avoid
+        # preventing garbage collection when contexts are closed.
+        # Subscriptions (e.g. from Computed/AutoSubscribeContextManager)
+        # capture Context objects in listeners dicts. Without weakrefs, these
+        # keep the contexts alive even after close(), causing memory leaks.
+        if render_context is not None:
+            self._render_context_ref: Optional[weakref.ref] = weakref.ref(render_context)
+            self._render_context_id: Optional[int] = id(render_context)
+        else:
+            self._render_context_ref = None
+            self._render_context_id = None
+        # Use weakref for kernel_context when possible. nullcontext (used when
+        # there is no kernel) doesn't support weakrefs, so fall back to strong ref.
+        try:
+            self._kernel_context_ref: Optional[weakref.ref] = weakref.ref(kernel_context)
+            self._kernel_context_id: Optional[int] = id(kernel_context)
+            self._kernel_context_strong: Any = None
+        except TypeError:
+            self._kernel_context_ref = None
+            self._kernel_context_id = id(kernel_context) if kernel_context is not None else None
+            self._kernel_context_strong = kernel_context
+
+    @property
+    def render_context(self):
+        if self._render_context_ref is not None:
+            return self._render_context_ref()
+        return None
+
+    @property
+    def kernel_context(self):
+        if self._kernel_context_ref is not None:
+            return self._kernel_context_ref()
+        return self._kernel_context_strong
 
     def __enter__(self):
-        if self.render_context is not None:
-            self.render_context.__enter__()
-        self.kernel_context.__enter__()
+        rc = self.render_context
+        if rc is not None:
+            rc.__enter__()
+        kc = self.kernel_context
+        if kc is not None:
+            kc.__enter__()
 
     def __exit__(self, exc_type, exc_val, exc_tb):
-        if self.render_context is not None:
+        rc = self.render_context
+        if rc is not None:
             # this will trigger a render
-            res1 = self.render_context.__exit__(exc_type, exc_val, exc_tb)
+            res1 = rc.__exit__(exc_type, exc_val, exc_tb)
         else:
             res1 = None
 
         # pop the current context from the stack
-        res2 = self.kernel_context.__exit__(exc_type, exc_val, exc_tb)
+        kc = self.kernel_context
+        if kc is not None:
+            res2 = kc.__exit__(exc_type, exc_val, exc_tb)
+        else:
+            res2 = None
         return res1 or res2
 
     def __eq__(self, value: object) -> bool:
         if not isinstance(value, Context):
             return False
-        return self.render_context == value.render_context and self.kernel_context == value.kernel_context
+        return self._render_context_id == value._render_context_id and self._kernel_context_id == value._kernel_context_id
 
     def __hash__(self) -> int:
-        return hash(id(self.render_context)) ^ hash(id(self.kernel_context))
+        return hash(self._render_context_id) ^ hash(self._kernel_context_id)
 
     def __repr__(self) -> str:
         return f"Context(render_context={self.render_context}, kernel_context={self.kernel_context})"

{solara_ui-1.57.0 → solara_ui-1.57.2}/solara/website/pages/changelog/changelog.md

@@ -1,5 +1,92 @@
 # Solara Changelog
 
+## Version 1.57.1
+
+   * Bug Fix: Support Altair 6+ Vega-Lite MIME types in `FigureAltair`. [724c01c8](https://github.com/widgetti/solara/commit/724c01c8)
+
+## Version 1.57.0
+
+   * Feature: Add `watch` option to `FileBrowser` for automatic file change detection. [a0c75202](https://github.com/widgetti/solara/commit/a0c75202)
+   * Bug Fix: Prevent `FileBrowser` from using relative paths for directory sync. [7be73e88](https://github.com/widgetti/solara/commit/7be73e88)
+
+## Version 1.56.0
+
+   * Feature: On disconnect and reconnect, force a page reload. [8d6fb2f1](https://github.com/widgetti/solara/commit/8d6fb2f1)
+   * Feature: Allow `data` function in `FileDownload` to be a coroutine. [a395f090](https://github.com/widgetti/solara/commit/a395f090)
+   * Breaking change: Drop Python 3.7 support. [abd9400d](https://github.com/widgetti/solara/commit/abd9400d)
+
+## Version 1.55.1
+
+   * Bug Fix: False positive for returns in async defs for hook use validation. [67381dc6](https://github.com/widgetti/solara/commit/67381dc6)
+
+## Version 1.55.0
+
+   * Feature: Allows tasks to have their own kernel context. [3a97835a](https://github.com/widgetti/solara/commit/3a97835a)
+   * Bug Fix: Python 3.14 compatibility - fix RuntimeError in BaseSettings iteration. [4bf31d5a](https://github.com/widgetti/solara/commit/4bf31d5a)
+
+## Version 1.54.0
+
+   * Feature: Use different port in `pytest-ipywidgets` for different workers in `pytest-xdist`. [7e924e21](https://github.com/widgetti/solara/commit/7e924e21)
+
+## Version 1.53.0
+
+   * Feature: With `--log-level=info` we can see where a reactive variable was set. [771df82f](https://github.com/widgetti/solara/commit/771df82f)
+   * Bug Fix: Hash and search were flipped, causing strange URLs/locations. [375fd9ba](https://github.com/widgetti/solara/commit/375fd9ba)
+
+## Version 1.52.0
+
+   * Feature: In Vue template, support both `event_foo` and `foo` to avoid LLM confusion. [3ba93278](https://github.com/widgetti/solara/commit/3ba93278)
+   * Feature: Allow custom serializers in Vue components. [cd1beabb](https://github.com/widgetti/solara/commit/cd1beabb)
+   * Bug Fix: Exclude breaking ipykernel releases. [9858c013](https://github.com/widgetti/solara/commit/9858c013)
+   * Bug Fix: Support modern versions of uvicorn. [ce2abebd](https://github.com/widgetti/solara/commit/ce2abebd)
+
+## Version 1.51.1
+
+   * Bug Fix: Enhance thread init patching to handle latest anyio (4.10.0) which may not populate name field properly. [93f78c6f](https://github.com/widgetti/solara/commit/93f78c6f)
+
+## Version 1.51.0
+
+   * Feature: Configure the initial title before the app runs/loads. [4515a8c3](https://github.com/widgetti/solara/commit/4515a8c3)
+   * Bug Fix: Do not crash on `use_close_menu`. [d0032943](https://github.com/widgetti/solara/commit/d0032943)
+
+## Version 1.50.1
+
+   * Bug Fix: `FileBrowser` could go two directories up if ".." was selected. [68e99e58](https://github.com/widgetti/solara/commit/68e99e58)
+   * Bug Fix: Tornado async gives no issues with event loops. [6706f6ed](https://github.com/widgetti/solara/commit/6706f6ed)
+
+## Version 1.50.0
+
+   * Feature: Support `Optional[str]` / optional for `InputText`. [814a8a6c](https://github.com/widgetti/solara/commit/814a8a6c)
+   * Feature: Give more control over the underlying Vuetify text input. [c5b47a84](https://github.com/widgetti/solara/commit/c5b47a84)
+   * Bug Fix: Sanitize infinite values in `/resourcez` JSON response. [6aacbff4](https://github.com/widgetti/solara/commit/6aacbff4)
+
+## Version 1.49.0
+
+   * Feature: Control selected file or directory externally in `FileBrowser`. [73a26dde](https://github.com/widgetti/solara/commit/73a26dde)
+   * Feature: Support relative paths in `FileBrowser`. [4b172244](https://github.com/widgetti/solara/commit/4b172244)
+
+## Version 1.48.0
+
+   * Feature: Expose `col_num` and `row_height` options for `GridLayout`. [8f40eeb5](https://github.com/widgetti/solara/commit/8f40eeb5)
+   * Feature: Warn if task is being called from a component. [e454b953](https://github.com/widgetti/solara/commit/e454b953)
+   * Bug Fix: Decrease `chunk_size` for `FileDrop` to 1MB to avoid Modal max 2MB limit. [fa65d5a1](https://github.com/widgetti/solara/commit/fa65d5a1)
+   * Bug Fix: Resolve logger warnings. [#1059](https://github.com/widgetti/solara/pull/1059)
+   * Bug Fix: A `use_task` with `dependencies=None` (user called) can have arguments. [da2f8cfe](https://github.com/widgetti/solara/commit/da2f8cfe)
+
+## Version 1.47.0
+
+   * Feature: Add `on_layer_updated` to `GridLayout`. [1163b89d](https://github.com/widgetti/solara/commit/1163b89d)
+   * Bug Fix: Classes were not applied to `ColumnsResponsive` when `wrap` was `False`. [ce879dad](https://github.com/widgetti/solara/commit/ce879dad)
+   * Bug Fix: Tasks did not have a stable key, causing hot reloads to miss values. [e1567f9d](https://github.com/widgetti/solara/commit/e1567f9d)
+   * Bug Fix: Re-run app on hot reload before running `on_kernel_start` callbacks. [cf4f5c1a](https://github.com/widgetti/solara/commit/cf4f5c1a)
+   * Bug Fix: Display port in runtime error when server is running. [cafe757c](https://github.com/widgetti/solara/commit/cafe757c)
+
+## Version 1.46.0
+
+   * Feature: When tasks fail to set results, handle it gracefully. [e6c1ce07](https://github.com/widgetti/solara/commit/e6c1ce07)
+   * Bug Fix: Follow ASGI spec and also check if text or bytes are `None` (Modal fix). [396c58ac](https://github.com/widgetti/solara/commit/396c58ac)
+   * Bug Fix: Make task threads daemon, so the Solara server can stop when tasks are running. [da346063](https://github.com/widgetti/solara/commit/da346063)
+
 ## Version 1.45.0
 
    * Bug Fix: Correctly handle expected websocket errors instead of logging them. [#1013](https://github.com/widgetti/solara/pull/1013)

{solara_ui-1.57.0 → solara_ui-1.57.2}/tests/integration/server_test.py

@@ -231,6 +231,14 @@ def test_cdn_secure(solara_server, solara_app, extra_include_path):
         response = requests.get(url)
         assert response.status_code == 404
 
+        # test sibling directory with similar prefix
+        sibling_dir = settings.assets.proxy_cache_dir.parent / (settings.assets.proxy_cache_dir.name + "_sibling")
+        sibling_dir.mkdir(exist_ok=True)
+        (sibling_dir / "secret").write_text("not allowed")
+        url = cdn_url + "/..%2f" + sibling_dir.name + "%2fsecret"
+        response = requests.get(url)
+        assert response.status_code == 404
+
 
 def test_nbextension_secure(solara_server, solara_app, extra_include_path):
     nbextensions_url = solara_server.base_url + "/jupyter/nbextensions"

{solara_ui-1.57.0 → solara_ui-1.57.2}/tests/unit/cdn_helper_test.py

@@ -90,6 +90,33 @@ def test_get_data_secure(tmp_path_factory: TempPathFactory):
     with pytest.raises(PermissionError):
         get_data(base_cache_dir, "project/../../secret")
 
+    # test that we cannot access sibling directories with similar prefixes
+    sibling_dir = root_dir / "cdn_sibling"
+    sibling_dir.mkdir()
+    (sibling_dir / "secret").write_bytes(b"not allowed")
+    with pytest.raises(PermissionError):
+        get_data(base_cache_dir, "../cdn_sibling/secret")
+
+
+def test_path_is_child_of_symlink(tmp_path: Path):
+    # symlinks should be allowed, this is needed for editable installs
+    from solara.server.utils import path_is_child_of
+
+    allowed = tmp_path / "allowed"
+    allowed.mkdir()
+
+    actual = tmp_path / "actual_package"
+    actual.mkdir()
+    (actual / "file.py").write_text("content")
+
+    # Create symlink inside allowed pointing outside
+    symlink = allowed / "symlink"
+    symlink.symlink_to("../actual_package")
+
+    # The path accessed via allowed/symlink/file.py should be allowed
+    test_path = allowed / "symlink" / "file.py"
+    assert path_is_child_of(test_path, allowed)
+
 
 def test_redirect(tmp_path_factory):
     base_cache_dir = tmp_path_factory.mktemp("cdn")

solara_ui-1.57.2/tests/unit/figure_altair_test.py

@@ -0,0 +1,75 @@
+import unittest.mock
+
+import pytest
+
+import solara
+import solara.widgets
+
+
+class MockChart:
+    """Mock Altair chart that returns a configurable mimebundle."""
+
+    def __init__(self, bundle):
+        self._bundle = bundle
+
+    def _repr_mimebundle_(self):
+        return (self._bundle, {})
+
+
+@pytest.fixture
+def mock_altair_renderers():
+    """Mock altair.renderers.enable to be a no-op context manager."""
+    import contextlib
+
+    import altair as alt
+
+    @contextlib.contextmanager
+    def mock_enable(renderer):
+        yield
+
+    with unittest.mock.patch.object(alt.renderers, "enable", mock_enable):
+        yield
+
+
+def test_figure_altair_v4(mock_altair_renderers):
+    spec = {"$schema": "https://vega.github.io/schema/vega-lite/v4.json", "data": {"values": []}}
+    chart = MockChart({"application/vnd.vegalite.v4+json": spec})
+
+    el = solara.FigureAltair(chart)
+    _, rc = solara.render(el, handle_error=False)
+    widget = rc.find(solara.widgets.VegaLite).widget
+    assert widget.spec == spec
+    rc.close()
+
+
+def test_figure_altair_v5(mock_altair_renderers):
+    spec = {"$schema": "https://vega.github.io/schema/vega-lite/v5.json", "data": {"values": []}}
+    chart = MockChart({"application/vnd.vegalite.v5+json": spec})
+
+    el = solara.FigureAltair(chart)
+    _, rc = solara.render(el, handle_error=False)
+    widget = rc.find(solara.widgets.VegaLite).widget
+    assert widget.spec == spec
+    rc.close()
+
+
+def test_figure_altair_v6(mock_altair_renderers):
+    """Test that Altair 6+ with v6 MIME type works (uses .json suffix instead of +json)."""
+    spec = {"$schema": "https://vega.github.io/schema/vega-lite/v6.json", "data": {"values": []}}
+    # Altair 6 uses ".json" suffix instead of "+json"
+    chart = MockChart({"application/vnd.vegalite.v6.json": spec})
+
+    el = solara.FigureAltair(chart)
+    _, rc = solara.render(el, handle_error=False)
+    widget = rc.find(solara.widgets.VegaLite).widget
+    assert widget.spec == spec
+    rc.close()
+
+
+def test_figure_altair_no_vegalite_mime(mock_altair_renderers):
+    """Test that a KeyError is raised when no Vega-Lite MIME type is found."""
+    chart = MockChart({"text/plain": "some text"})
+
+    el = solara.FigureAltair(chart)
+    with pytest.raises(KeyError, match="No Vega-Lite MIME type found"):
+        solara.render(el, handle_error=False)