streamlit-nightly 1.46.2.dev20250714__py3-none-any.whl → 1.47.1.dev20250716__py3-none-any.whl

streamlit/connections/snowflake_connection.py

@@ -68,10 +68,10 @@ class SnowflakeConnection(BaseConnection["InternalSnowflakeConnection"]):
     .. |snowflake.connector.connect()| replace:: ``snowflake.connector.connect()``
     .. _snowflake.connector.connect(): https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-api#label-snowflake-connector-methods-connect
 
-    .. Tip::
+    .. Important::
         `snowflake-snowpark-python <https://pypi.org/project/snowflake-snowpark-python/>`_
         must be installed in your environment to use this connection. You can
-        install Snowflake extras along with Streamlit:
+        install it as an extra with Streamlit:
 
         >>> pip install streamlit[snowflake]
 

streamlit/elements/graphviz_chart.py

@@ -45,6 +45,13 @@ class GraphvizMixin:
     ) -> DeltaGenerator:
         """Display a graph using the dagre-d3 library.
 
+        .. Important::
+            You must install ``graphviz>=0.19.0`` to use this command. You can
+            install all charting dependencies (except Bokeh) as an extra with
+            Streamlit:
+
+            >>> pip install streamlit[charts]
+
         Parameters
         ----------
         figure_or_dot : graphviz.dot.Graph, graphviz.dot.Digraph, graphviz.sources.Source, str

streamlit/elements/lib/file_uploader_utils.py

@@ -31,6 +31,18 @@ TYPE_PAIRS = [
 ]
 
 
+def _get_main_filename_and_extension(filename: str) -> tuple[str, str]:
+    """Returns the main part of a filename and its extension."""
+    # Handle NTFS Alternate Data Streams (ADS) on Windows, e.g: "file.txt:ads" -> ("file.txt", ".txt")
+    if os.name == "nt" and ":" in filename:
+        main_filename, ads_part = filename.split(":", 1)
+        # We only treat it as an ADS if the part after the colon has an extension.
+        if os.path.splitext(ads_part)[1]:
+            return main_filename, os.path.splitext(main_filename)[1]
+
+    return filename, os.path.splitext(filename)[1]
+
+
 def normalize_upload_file_type(file_type: str | Sequence[str]) -> Sequence[str]:
     if isinstance(file_type, str):
         file_type = [file_type]
@@ -59,8 +71,15 @@ def enforce_filename_restriction(filename: str, allowed_types: Sequence[str]) ->
     enforce file type check by extension on the frontend, but we check it on backend
     before returning file to the user to protect ourselves.
     """
-    normalized_filename = filename.lower()
-    base_name, extension = os.path.splitext(normalized_filename)
+
+    # Ensure that there isn't a null byte in a filename
+    # since this could be a workaround to bypass the file type check.
+    if "\0" in filename:
+        raise StreamlitAPIException("Filename cannot contain null bytes.")
+
+    main_filename, extension = _get_main_filename_and_extension(filename)
+    normalized_filename = main_filename.lower()
+
     normalized_allowed_types = [allowed_type.lower() for allowed_type in allowed_types]
 
     if not any(

streamlit/elements/plotly_chart.py

@@ -328,8 +328,12 @@ class PlotlyMixin:
         you would call Plotly's ``py.plot`` or ``py.iplot``.
 
         .. Important::
-            You must install ``plotly`` to use this command. Your app's
-            performance may be enhanced by installing ``orjson`` as well.
+            You must install ``plotly>=4.0.0`` to use this command. Your app's
+            performance may be enhanced by installing ``orjson`` as well. You
+            can install all charting dependencies (except Bokeh) as an extra
+            with Streamlit:
+
+            >>> pip install streamlit[charts]
 
         Parameters
         ----------

streamlit/elements/pyplot.py

@@ -42,7 +42,11 @@ class PyplotMixin:
         """Display a matplotlib.pyplot figure.
 
         .. Important::
-            You must install ``matplotlib`` to use this command.
+            You must install ``matplotlib>=3.0.0`` to use this command. You can
+            install all charting dependencies (except Bokeh) as an extra with
+            Streamlit:
+
+            >>> pip install streamlit[charts]
 
         Parameters
         ----------

streamlit/elements/widgets/chat.py

@@ -465,6 +465,12 @@ class ChatMixin:
               example, to only accept JPG/JPEG and PNG files, use
               ``["jpg", "jpeg", "png"]``.
 
+            .. note::
+                This is a best-effort check, but doesn't provide a
+                security guarantee against users uploading files of other types
+                or type extensions. The correct handling of uploaded files is
+                part of the app developer's responsibility.
+
         disabled : bool
             Whether the chat input should be disabled. This defaults to
             ``False``.

streamlit/elements/widgets/file_uploader.py

@@ -296,6 +296,12 @@ class FileUploaderMixin:
               example, to only accept JPG/JPEG and PNG files, use
               ``["jpg", "jpeg", "png"]``.
 
+            .. note::
+                This is a best-effort check, but doesn't provide a
+                security guarantee against users uploading files of other types
+                or type extensions. The correct handling of uploaded files is
+                part of the app developer's responsibility.
+
         accept_multiple_files : bool
             Whether to accept more than one file in a submission. If this is
             ``False`` (default), the user can only submit one file at a time.

streamlit/static/index.html

@@ -37,7 +37,7 @@
     <script>
       window.prerenderReady = false
     </script>
-    <script type="module" crossorigin src="./static/js/index.EAQB8Tuq.js"></script>
+    <script type="module" crossorigin src="./static/js/index.D1AeFlAQ.js"></script>
     <link rel="stylesheet" crossorigin href="./static/css/index.CJVRHjQZ.css">
   </head>
   <body>