streamlit-nightly 1.53.2.dev20260202__py3-none-any.whl → 1.54.1.dev20260204__py3-none-any.whl

streamlit/commands/logo.py

@@ -108,13 +108,13 @@ def logo(
 
     Parameters
     ----------
-    image: Anything supported by st.image (except list), emoji, or icon
+    image: Anything supported by st.image (except list) or str
         The image to display in the upper-left corner of your app and its
         sidebar. If ``icon_image`` is also provided, then Streamlit will only
         display ``image`` in the sidebar.
 
-        In addition to any of the types supported by |st.image|_ (except list),
-        the following strings are valid:
+        ``image`` can be any of the types supported by |st.image|_ except
+        a list. Additionally, the following strings are valid:
 
         - A single-character emoji. For example, you can set ``image="🏠"``
           or ``image="🚀"``. Emoji short codes are not supported.
@@ -146,19 +146,15 @@ def logo(
         The external URL to open when a user clicks on the logo. The URL must
         start with "\http://" or "\https://". If ``link`` is ``None`` (default),
         the logo will not include a hyperlink.
-    icon_image: Anything supported by st.image (except list), emoji, icon, or None
+    icon_image: Anything supported by st.image (except list), str, or None
         An optional, typically smaller image to replace ``image`` in the
-        upper-left corner when the sidebar is closed. If ``icon_image`` is
+        upper-left corner when the sidebar is closed. This can be any of the
+        types allowed for the ``image`` parameter. If ``icon_image`` is
         ``None`` (default), Streamlit will always display ``image`` in the
         upper-left corner, regardless of whether the sidebar is open or closed.
         Otherwise, Streamlit will render ``icon_image`` in the upper-left
         corner of the app when the sidebar is closed.
 
-        In addition to any of the types supported by ``st.image`` (except list),
-        this also accepts single-character emojis (e.g., ``"🏠"``) and Material
-        icons (e.g., ``":material/home:"``). See the ``image`` parameter for
-        more details on these formats.
-
         Streamlit scales the image to a max height set by ``size`` and a max
         width to fit within the sidebar. If the sidebar is closed, the max
         width is retained from when it was last open.

streamlit/components/v2/component_path_utils.py

@@ -22,12 +22,12 @@ outside of a declared package root.
 
 from __future__ import annotations
 
-import os
 from pathlib import Path
 from typing import Final
 
 from streamlit.errors import StreamlitComponentRegistryError
 from streamlit.logger import get_logger
+from streamlit.path_security import is_unsafe_path_pattern
 
 _LOGGER: Final = get_logger(__name__)
 
@@ -132,7 +132,12 @@ class ComponentPathUtils:
 
     @staticmethod
     def _assert_relative_no_traversal(path: str, *, label: str) -> None:
-        """Raise if ``path`` is absolute or contains ``..`` segments.
+        """Raise if ``path`` is absolute, contains traversal, or has unsafe patterns.
+
+        This method uses the shared ``is_unsafe_path_pattern`` function to ensure
+        consistent security checks across the codebase. The shared function also
+        checks for additional patterns like null bytes, forward-slash UNC paths,
+        and drive-relative paths (e.g., ``C:foo``).
 
         Parameters
         ----------
@@ -141,34 +146,17 @@ class ComponentPathUtils:
         label : str
             Human-readable label used in error messages (e.g., "component paths").
         """
-        # Absolute path checks (POSIX, Windows drive-letter, UNC)
-        is_windows_drive_abs = (
-            len(path) >= 3
-            and path[0].isalpha()
-            and path[1] == ":"
-            and path[2] in {"/", "\\"}
-        )
-        is_unc_abs = path.startswith("\\\\")
-
-        # Consider rooted backslash paths "\\dir" as absolute on Windows-like inputs
-        is_rooted_backslash = path.startswith("\\") and not is_unc_abs
-
-        if (
-            os.path.isabs(path)
-            or is_windows_drive_abs
-            or is_unc_abs
-            or is_rooted_backslash
-        ):
-            raise StreamlitComponentRegistryError(
-                f"Absolute paths are not allowed in {label}: {path}"
-            )
-
-        # Segment-based traversal detection to avoid false positives (e.g. "file..js")
-        normalized = path.replace("\\", "/")
-        segments = [seg for seg in normalized.split("/") if seg != ""]
-        if any(seg == ".." for seg in segments):
+        if is_unsafe_path_pattern(path):
+            # Determine appropriate error message based on pattern.
+            # Use segment-based check to avoid false positives like "file..js"
+            normalized = path.replace("\\", "/")
+            segments = [seg for seg in normalized.split("/") if seg]
+            if ".." in segments:
+                raise StreamlitComponentRegistryError(
+                    f"Path traversal attempts are not allowed in {label}: {path}"
+                )
             raise StreamlitComponentRegistryError(
-                f"Path traversal attempts are not allowed in {label}: {path}"
+                f"Unsafe paths are not allowed in {label}: {path}"
             )
 
     @staticmethod

streamlit/config.py

@@ -621,8 +621,10 @@ _create_option(
     "client.showErrorLinks",
     description="""
         Controls whether to show external help links (Google, ChatGPT) in
-        error displays. Can be "auto" (shows on localhost only), true (always
-        show), or false (never show).
+        error displays. The following values are valid:
+        - "auto" (default): Links are shown only on localhost.
+        - True: Links are shown on all domains.
+        - False: Links are never shown.
     """,
     default_val="auto",
     type_=str,

streamlit/elements/arrow.py

@@ -52,8 +52,9 @@ from streamlit.elements.lib.pandas_styler_utils import marshall_styler
 from streamlit.elements.lib.policies import check_widget_policies
 from streamlit.elements.lib.utils import Key, compute_and_register_element_id, to_key
 from streamlit.errors import StreamlitAPIException, StreamlitValueError
-from streamlit.proto.Arrow_pb2 import Arrow as ArrowProto
+from streamlit.proto.Dataframe_pb2 import Dataframe as DataframeProto
 from streamlit.proto.ForwardMsg_pb2 import ForwardMsg
+from streamlit.proto.Table_pb2 import Table as TableProto
 from streamlit.runtime.metrics_util import gather_metrics
 from streamlit.runtime.scriptrunner_utils.script_run_context import (
     enqueue_message,
@@ -71,6 +72,7 @@ if TYPE_CHECKING:
     from streamlit.dataframe_util import Data
     from streamlit.delta_generator import DeltaGenerator
     from streamlit.elements.lib.built_in_chart_utils import AddRowsMetadata
+    from streamlit.proto.ArrowData_pb2 import ArrowData as ArrowDataProto
 
 
 SelectionMode: TypeAlias = Literal[
@@ -223,7 +225,7 @@ class DataframeSelectionSerde:
 
 def parse_selection_mode(
     selection_mode: SelectionMode | Iterable[SelectionMode],
-) -> set[ArrowProto.SelectionMode.ValueType]:
+) -> set[DataframeProto.SelectionMode.ValueType]:
     """Parse and check the user provided selection modes."""
     if isinstance(selection_mode, str):
         # Only a single selection mode was passed
@@ -256,28 +258,28 @@ def parse_selection_mode(
     parsed_selection_modes = []
     for mode in selection_mode_set:
         if mode == "single-row":
-            parsed_selection_modes.append(ArrowProto.SelectionMode.SINGLE_ROW)
+            parsed_selection_modes.append(DataframeProto.SelectionMode.SINGLE_ROW)
         elif mode == "multi-row":
-            parsed_selection_modes.append(ArrowProto.SelectionMode.MULTI_ROW)
+            parsed_selection_modes.append(DataframeProto.SelectionMode.MULTI_ROW)
         elif mode == "single-column":
-            parsed_selection_modes.append(ArrowProto.SelectionMode.SINGLE_COLUMN)
+            parsed_selection_modes.append(DataframeProto.SelectionMode.SINGLE_COLUMN)
         elif mode == "multi-column":
-            parsed_selection_modes.append(ArrowProto.SelectionMode.MULTI_COLUMN)
+            parsed_selection_modes.append(DataframeProto.SelectionMode.MULTI_COLUMN)
         elif mode == "single-cell":
-            parsed_selection_modes.append(ArrowProto.SelectionMode.SINGLE_CELL)
+            parsed_selection_modes.append(DataframeProto.SelectionMode.SINGLE_CELL)
         elif mode == "multi-cell":
-            parsed_selection_modes.append(ArrowProto.SelectionMode.MULTI_CELL)
+            parsed_selection_modes.append(DataframeProto.SelectionMode.MULTI_CELL)
     return set(parsed_selection_modes)
 
 
 def parse_border_mode(
     border: bool | Literal["horizontal"],
-) -> ArrowProto.BorderMode.ValueType:
+) -> TableProto.BorderMode.ValueType:
     """Parse and check the user provided border mode."""
     if isinstance(border, bool):
-        return ArrowProto.BorderMode.ALL if border else ArrowProto.BorderMode.NONE
+        return TableProto.BorderMode.ALL if border else TableProto.BorderMode.NONE
     if border == "horizontal":
-        return ArrowProto.BorderMode.HORIZONTAL
+        return TableProto.BorderMode.HORIZONTAL
     raise StreamlitValueError("border", ["True", "False", "'horizontal'"])
 
 
@@ -695,7 +697,7 @@ class ArrowMixin:
         # Convert the user provided column config into the frontend compatible format:
         column_config_mapping = process_config_mapping(column_config)
 
-        proto = ArrowProto()
+        proto = DataframeProto()
 
         if row_height:
             proto.row_height = row_height
@@ -706,12 +708,14 @@ class ArrowMixin:
         if placeholder is not None:
             proto.placeholder = placeholder
 
-        proto.editing_mode = ArrowProto.EditingMode.READ_ONLY
+        proto.editing_mode = DataframeProto.EditingMode.READ_ONLY
 
         has_range_index: bool = False
         if isinstance(data, pa.Table):
             # For pyarrow tables, we can just serialize the table directly
-            proto.data = dataframe_util.convert_arrow_table_to_arrow_bytes(data)
+            proto.arrow_data.data = dataframe_util.convert_arrow_table_to_arrow_bytes(
+                data
+            )
         else:
             # For all other data formats, we need to convert them to a pandas.DataFrame
             # thereby, we also apply some data specific configs
@@ -725,7 +729,7 @@ class ArrowMixin:
                 # when the position of the element is changed.
                 delta_path = self.dg._get_delta_path_str()
                 default_uuid = str(hash(delta_path))
-                marshall_styler(proto, data, default_uuid)
+                marshall_styler(proto.arrow_data, data, default_uuid)
 
             # Convert the input data into a pandas.DataFrame
             data_df = dataframe_util.convert_anything_to_pandas_df(
@@ -734,7 +738,9 @@ class ArrowMixin:
             has_range_index = dataframe_util.has_range_index(data_df)
             apply_data_specific_configs(column_config_mapping, data_format)
             # Serialize the data to bytes:
-            proto.data = dataframe_util.convert_pandas_df_to_arrow_bytes(data_df)
+            proto.arrow_data.data = dataframe_util.convert_pandas_df_to_arrow_bytes(
+                data_df
+            )
 
         if hide_index is not None:
             update_column_config(
@@ -782,7 +788,7 @@ class ArrowMixin:
                 # selection state in this case.
                 key_as_main_identity={"selection_mode", "is_selection_activated"},
                 dg=self.dg,
-                data=proto.data,
+                data=proto.arrow_data.data,
                 width=width,
                 height=height,
                 use_container_width=use_container_width,
@@ -803,9 +809,9 @@ class ArrowMixin:
                 ctx=ctx,
                 value_type="string_value",
             )
-            self.dg._enqueue("arrow_data_frame", proto, layout_config=layout_config)
+            self.dg._enqueue("dataframe", proto, layout_config=layout_config)
             return widget_state.value
-        return self.dg._enqueue("arrow_data_frame", proto, layout_config=layout_config)
+        return self.dg._enqueue("dataframe", proto, layout_config=layout_config)
 
     @gather_metrics("table")
     def table(
@@ -911,10 +917,10 @@ class ArrowMixin:
             height="content",
         )
 
-        proto = ArrowProto()
-        marshall(proto, data, default_uuid)
+        proto = TableProto()
+        marshall_table(proto.arrow_data, data, default_uuid)
         proto.border_mode = border_mode
-        return self.dg._enqueue("arrow_table", proto, layout_config=layout_config)
+        return self.dg._enqueue("table", proto, layout_config=layout_config)
 
     @gather_metrics("add_rows")
     def add_rows(self, data: Data = None, **kwargs: Any) -> DeltaGenerator | None:
@@ -1148,13 +1154,15 @@ def _arrow_add_rows(
     return dg
 
 
-def marshall(proto: ArrowProto, data: Data, default_uuid: str | None = None) -> None:
-    """Marshall pandas.DataFrame into an Arrow proto.
+def marshall(
+    proto: ArrowDataProto, data: Data, default_uuid: str | None = None
+) -> None:
+    """Marshall pandas.DataFrame into an ArrowData proto.
 
     Parameters
     ----------
-    proto : proto.Arrow
-        Output. The protobuf for Streamlit Arrow proto.
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
 
     data : pandas.DataFrame, pandas.Styler, pyarrow.Table, numpy.ndarray, pyspark.sql.DataFrame, snowflake.snowpark.DataFrame, Iterable, dict, or None
         Something that is or can be converted to a dataframe.
@@ -1176,3 +1184,35 @@ def marshall(proto: ArrowProto, data: Data, default_uuid: str | None = None) ->
         marshall_styler(proto, data, default_uuid)
 
     proto.data = dataframe_util.convert_anything_to_arrow_bytes(data)
+
+
+def marshall_table(
+    proto: ArrowDataProto, data: Data, default_uuid: str | None = None
+) -> None:
+    """Marshall data into an ArrowData proto for Table element.
+
+    Parameters
+    ----------
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
+
+    data : pandas.DataFrame, pandas.Styler, pyarrow.Table, numpy.ndarray, pyspark.sql.DataFrame, snowflake.snowpark.DataFrame, Iterable, dict, or None
+        Something that is or can be converted to a dataframe.
+
+    default_uuid : str | None
+        If pandas.Styler UUID is not provided, this value will be used.
+        This attribute is optional and only used for pandas.Styler, other elements
+        can ignore it.
+
+    """  # noqa: E501
+
+    if dataframe_util.is_pandas_styler(data):
+        # default_uuid is a string only if the data is a `Styler`,
+        # and `None` otherwise.
+        if not isinstance(default_uuid, str):
+            raise StreamlitAPIException(
+                "Default UUID must be a string for Styler data."
+            )
+        marshall_styler(proto, data, default_uuid)
+
+    proto.data = dataframe_util.convert_anything_to_arrow_bytes(data)

streamlit/elements/lib/built_in_chart_utils.py

@@ -671,7 +671,7 @@ def _drop_unused_columns(df: pd.DataFrame, *column_names: str | None) -> pd.Data
         seen.add(x)
         keep.append(x)
 
-    return df[keep]
+    return df[keep]  # type: ignore[no-any-return, unused-ignore]
 
 
 def _maybe_convert_color_column_in_place(

streamlit/elements/lib/column_config_utils.py

@@ -29,7 +29,7 @@ if TYPE_CHECKING:
     import pyarrow as pa
     from pandas import DataFrame, Index, Series
 
-    from streamlit.proto.Arrow_pb2 import Arrow as ArrowProto
+    from streamlit.proto.Dataframe_pb2 import Dataframe as DataframeProto
 
 
 # The index identifier can be used to apply configuration options
@@ -539,13 +539,13 @@ def _convert_column_config_to_json(column_config_mapping: ColumnConfigMapping) -
 
 
 def marshall_column_config(
-    proto: ArrowProto, column_config_mapping: ColumnConfigMapping
+    proto: DataframeProto, column_config_mapping: ColumnConfigMapping
 ) -> None:
-    """Marshall the column config into the Arrow proto.
+    """Marshall the column config into the Dataframe proto.
 
     Parameters
     ----------
-    proto : ArrowProto
+    proto : DataframeProto
         The proto to marshall into.
 
     column_config_mapping : ColumnConfigMapping

streamlit/elements/lib/options_selector_utils.py

@@ -277,6 +277,10 @@ def create_mappings(
     for index, option in enumerate(options):
         formatted_option = format_func(option)
         formatted_options.append(formatted_option)
+        # If formatted labels are duplicated, the last one wins. We keep this
+        # behavior to mirror radio/selectbox/multiselect, but it makes selection
+        # ambiguous for string-based widgets.
+        # TODO: Consider raising a StreamlitAPIException on duplicate labels.
         formatted_option_to_option_mapping[formatted_option] = index
 
     return (

streamlit/elements/lib/pandas_styler_utils.py

@@ -25,18 +25,18 @@ if TYPE_CHECKING:
     from pandas import DataFrame
     from pandas.io.formats.style import Styler
 
-    from streamlit.proto.Arrow_pb2 import Arrow as ArrowProto
+    from streamlit.proto.ArrowData_pb2 import ArrowData as ArrowDataProto
 
 from enum import Enum
 
 
-def marshall_styler(proto: ArrowProto, styler: Styler, default_uuid: str) -> None:
-    """Marshall pandas.Styler into an Arrow proto.
+def marshall_styler(proto: ArrowDataProto, styler: Styler, default_uuid: str) -> None:
+    """Marshall pandas.Styler into an ArrowData proto.
 
     Parameters
     ----------
-    proto : proto.Arrow
-        Output. The protobuf for Streamlit Arrow proto.
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
 
     styler : pandas.Styler
         Helps style a DataFrame or Series according to the data with HTML and CSS.
@@ -71,13 +71,13 @@ def marshall_styler(proto: ArrowProto, styler: Styler, default_uuid: str) -> Non
     _marshall_display_values(proto, styler_data_df, pandas_styles)
 
 
-def _marshall_uuid(proto: ArrowProto, styler: Styler, default_uuid: str) -> None:
-    """Marshall pandas.Styler uuid into an Arrow proto.
+def _marshall_uuid(proto: ArrowDataProto, styler: Styler, default_uuid: str) -> None:
+    """Marshall pandas.Styler uuid into an ArrowData proto.
 
     Parameters
     ----------
-    proto : proto.Arrow
-        Output. The protobuf for Streamlit Arrow proto.
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
 
     styler : pandas.Styler
         Helps style a DataFrame or Series according to the data with HTML and CSS.
@@ -92,13 +92,13 @@ def _marshall_uuid(proto: ArrowProto, styler: Styler, default_uuid: str) -> None
     proto.styler.uuid = str(styler.uuid)  # type: ignore[attr-defined]
 
 
-def _marshall_caption(proto: ArrowProto, styler: Styler) -> None:
-    """Marshall pandas.Styler caption into an Arrow proto.
+def _marshall_caption(proto: ArrowDataProto, styler: Styler) -> None:
+    """Marshall pandas.Styler caption into an ArrowData proto.
 
     Parameters
     ----------
-    proto : proto.Arrow
-        Output. The protobuf for Streamlit Arrow proto.
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
 
     styler : pandas.Styler
         Helps style a DataFrame or Series according to the data with HTML and CSS.
@@ -109,14 +109,14 @@ def _marshall_caption(proto: ArrowProto, styler: Styler) -> None:
 
 
 def _marshall_styles(
-    proto: ArrowProto, styler: Styler, styles: Mapping[str, Any]
+    proto: ArrowDataProto, styler: Styler, styles: Mapping[str, Any]
 ) -> None:
-    """Marshall pandas.Styler styles into an Arrow proto.
+    """Marshall pandas.Styler styles into an ArrowData proto.
 
     Parameters
     ----------
-    proto : proto.Arrow
-        Output. The protobuf for Streamlit Arrow proto.
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
 
     styler : pandas.Styler
         Helps style a DataFrame or Series according to the data with HTML and CSS.
@@ -228,14 +228,14 @@ def _pandas_style_to_css(
 
 
 def _marshall_display_values(
-    proto: ArrowProto, df: DataFrame, styles: Mapping[str, Any]
+    proto: ArrowDataProto, df: DataFrame, styles: Mapping[str, Any]
 ) -> None:
-    """Marshall pandas.Styler display values into an Arrow proto.
+    """Marshall pandas.Styler display values into an ArrowData proto.
 
     Parameters
     ----------
-    proto : proto.Arrow
-        Output. The protobuf for Streamlit Arrow proto.
+    proto : proto.ArrowData
+        Output. The protobuf for Streamlit ArrowData proto.
 
     df : pandas.DataFrame
         A dataframe with original values.
@@ -299,4 +299,4 @@ def _use_display_values(df: DataFrame, styles: Mapping[str, Any]) -> DataFrame:
         # Batch-assign updates for this column using iloc for performance.
         new_df.iloc[row_indices, col_idx] = values
 
-    return new_df
+    return new_df  # type: ignore[no-any-return, unused-ignore]