solara-ui 1.57.1__tar.gz → 1.57.2__tar.gz

{solara_ui-1.57.1 → solara_ui-1.57.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: solara-ui
-Version: 1.57.1
+Version: 1.57.2
 Dynamic: Summary
 Project-URL: Home, https://www.github.com/widgetti/solara
 Project-URL: Documentation, https://solara.dev

{solara_ui-1.57.1 → solara_ui-1.57.2}/solara/__init__.py

@@ -1,6 +1,6 @@
 """Build webapps using IPywidgets"""
 
-__version__ = "1.57.1"
+__version__ = "1.57.2"
 github_url = "https://github.com/widgetti/solara"
 git_branch = "master"
 

{solara_ui-1.57.1 → solara_ui-1.57.2}/solara/server/static/solara_bootstrap.py

@@ -119,7 +119,7 @@ async def main():
     ]
     for dep in requirements:
         await micropip.install(dep, keep_going=True)
-    await micropip.install("/wheels/solara-1.57.1-py2.py3-none-any.whl", keep_going=True)
+    await micropip.install("/wheels/solara-1.57.2-py2.py3-none-any.whl", keep_going=True)
     import solara
 
     el = solara.Warning("lala")

{solara_ui-1.57.1 → solara_ui-1.57.2}/solara/server/utils.py

@@ -27,7 +27,11 @@ def path_is_child_of(path: Path, parent: Path) -> bool:
         # on windows, we sometimes get different casing (only seen on CI)
         path_string = path_string.lower()
         parent_string = parent_string.lower()
-    return path_string.startswith(parent_string)
+    # Ensure we check for a proper path boundary, not just string prefix.
+    # Without the separator, "/parent_sibling" would match "/parent"
+    if not parent_string.endswith(os.sep):
+        parent_string = parent_string + os.sep
+    return path_string.startswith(parent_string) or path_string == parent_string.rstrip(os.sep)
 
 
 @contextlib.contextmanager

{solara_ui-1.57.1 → solara_ui-1.57.2}/solara/toestand.py

@@ -4,6 +4,7 @@ import logging
 import os
 import sys
 import threading
+import weakref
 from types import FrameType
 import warnings
 import copy
@@ -929,37 +930,83 @@ class AutoSubscribeContextManagerBase:
         thread_local.reactive_watch = self.previous_reactive_watch
         self.unsubscribe_previous()
         self.subscribed_previous_run = self.subscribed.copy()
+        # Clear saved references to avoid preventing garbage collection.
+        # Without this, a Computed's AutoSubscribeContextManager retains
+        # previous_reactive_watch (a bound method from the component's
+        # AutoSubscribeContextManagerReacton), which transitively keeps
+        # the _RenderContext alive through closure cells.
+        self.previous_reactive_watch = None
+        self.reactive_used_before = None
 
 
 class Context:
     def __init__(self, render_context, kernel_context):
         # combine the render context *and* the kernel context into one context
-        self.render_context = render_context
-        self.kernel_context = kernel_context
+        # Use weakrefs for both render_context and kernel_context to avoid
+        # preventing garbage collection when contexts are closed.
+        # Subscriptions (e.g. from Computed/AutoSubscribeContextManager)
+        # capture Context objects in listeners dicts. Without weakrefs, these
+        # keep the contexts alive even after close(), causing memory leaks.
+        if render_context is not None:
+            self._render_context_ref: Optional[weakref.ref] = weakref.ref(render_context)
+            self._render_context_id: Optional[int] = id(render_context)
+        else:
+            self._render_context_ref = None
+            self._render_context_id = None
+        # Use weakref for kernel_context when possible. nullcontext (used when
+        # there is no kernel) doesn't support weakrefs, so fall back to strong ref.
+        try:
+            self._kernel_context_ref: Optional[weakref.ref] = weakref.ref(kernel_context)
+            self._kernel_context_id: Optional[int] = id(kernel_context)
+            self._kernel_context_strong: Any = None
+        except TypeError:
+            self._kernel_context_ref = None
+            self._kernel_context_id = id(kernel_context) if kernel_context is not None else None
+            self._kernel_context_strong = kernel_context
+
+    @property
+    def render_context(self):
+        if self._render_context_ref is not None:
+            return self._render_context_ref()
+        return None
+
+    @property
+    def kernel_context(self):
+        if self._kernel_context_ref is not None:
+            return self._kernel_context_ref()
+        return self._kernel_context_strong
 
     def __enter__(self):
-        if self.render_context is not None:
-            self.render_context.__enter__()
-        self.kernel_context.__enter__()
+        rc = self.render_context
+        if rc is not None:
+            rc.__enter__()
+        kc = self.kernel_context
+        if kc is not None:
+            kc.__enter__()
 
     def __exit__(self, exc_type, exc_val, exc_tb):
-        if self.render_context is not None:
+        rc = self.render_context
+        if rc is not None:
             # this will trigger a render
-            res1 = self.render_context.__exit__(exc_type, exc_val, exc_tb)
+            res1 = rc.__exit__(exc_type, exc_val, exc_tb)
         else:
             res1 = None
 
         # pop the current context from the stack
-        res2 = self.kernel_context.__exit__(exc_type, exc_val, exc_tb)
+        kc = self.kernel_context
+        if kc is not None:
+            res2 = kc.__exit__(exc_type, exc_val, exc_tb)
+        else:
+            res2 = None
         return res1 or res2
 
     def __eq__(self, value: object) -> bool:
         if not isinstance(value, Context):
             return False
-        return self.render_context == value.render_context and self.kernel_context == value.kernel_context
+        return self._render_context_id == value._render_context_id and self._kernel_context_id == value._kernel_context_id
 
     def __hash__(self) -> int:
-        return hash(id(self.render_context)) ^ hash(id(self.kernel_context))
+        return hash(self._render_context_id) ^ hash(self._kernel_context_id)
 
     def __repr__(self) -> str:
         return f"Context(render_context={self.render_context}, kernel_context={self.kernel_context})"

{solara_ui-1.57.1 → solara_ui-1.57.2}/solara/website/pages/changelog/changelog.md

@@ -1,5 +1,9 @@
 # Solara Changelog
 
+## Version 1.57.1
+
+   * Bug Fix: Support Altair 6+ Vega-Lite MIME types in `FigureAltair`. [724c01c8](https://github.com/widgetti/solara/commit/724c01c8)
+
 ## Version 1.57.0
 
    * Feature: Add `watch` option to `FileBrowser` for automatic file change detection. [a0c75202](https://github.com/widgetti/solara/commit/a0c75202)

{solara_ui-1.57.1 → solara_ui-1.57.2}/tests/integration/server_test.py

@@ -231,6 +231,14 @@ def test_cdn_secure(solara_server, solara_app, extra_include_path):
         response = requests.get(url)
         assert response.status_code == 404
 
+        # test sibling directory with similar prefix
+        sibling_dir = settings.assets.proxy_cache_dir.parent / (settings.assets.proxy_cache_dir.name + "_sibling")
+        sibling_dir.mkdir(exist_ok=True)
+        (sibling_dir / "secret").write_text("not allowed")
+        url = cdn_url + "/..%2f" + sibling_dir.name + "%2fsecret"
+        response = requests.get(url)
+        assert response.status_code == 404
+
 
 def test_nbextension_secure(solara_server, solara_app, extra_include_path):
     nbextensions_url = solara_server.base_url + "/jupyter/nbextensions"

{solara_ui-1.57.1 → solara_ui-1.57.2}/tests/unit/cdn_helper_test.py

@@ -90,6 +90,33 @@ def test_get_data_secure(tmp_path_factory: TempPathFactory):
     with pytest.raises(PermissionError):
         get_data(base_cache_dir, "project/../../secret")
 
+    # test that we cannot access sibling directories with similar prefixes
+    sibling_dir = root_dir / "cdn_sibling"
+    sibling_dir.mkdir()
+    (sibling_dir / "secret").write_bytes(b"not allowed")
+    with pytest.raises(PermissionError):
+        get_data(base_cache_dir, "../cdn_sibling/secret")
+
+
+def test_path_is_child_of_symlink(tmp_path: Path):
+    # symlinks should be allowed, this is needed for editable installs
+    from solara.server.utils import path_is_child_of
+
+    allowed = tmp_path / "allowed"
+    allowed.mkdir()
+
+    actual = tmp_path / "actual_package"
+    actual.mkdir()
+    (actual / "file.py").write_text("content")
+
+    # Create symlink inside allowed pointing outside
+    symlink = allowed / "symlink"
+    symlink.symlink_to("../actual_package")
+
+    # The path accessed via allowed/symlink/file.py should be allowed
+    test_path = allowed / "symlink" / "file.py"
+    assert path_is_child_of(test_path, allowed)
+
 
 def test_redirect(tmp_path_factory):
     base_cache_dir = tmp_path_factory.mktemp("cdn")