CVE-2024-37890

Advisory

Marimo 0.6.20 updates its ws dependency from version 8.17.0 to 8.17.1 to address security concerns, including CVE-2024-37890.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed

Highlights

**🔢 No-code Polars transformations!** Polars is now supported in [`mo.ui.dataframe`](https://docs.marimo.io/guides/dataframes.html#transforming-dataframes): transform Polars dataframes without writing code!

**🔍 Searchable tables!** We now have global search over dataframes and other tabular data, built into [`mo.ui.table`](https://docs.marimo.io/api/inputs/table.html)!

**🔔 Notebook run notifications.** At marimo, the small details are important to us: your notebook favicon will now change based on whether your notebook is running or idle. We also have opt-in browser notifications on your notebook status -- so you can navigate away to another tab, and marimo will tell you when your notebook is done running (and if it errored).

**Experimental strict execution.** Reproducibility is important to us; we now have an [experimental "strict" runtime](https://github.com/marimo-team/marimo/pull/1580) that tries hard to prevent mutations and other non-deterministic behavior. Enable it with

toml
[experimental]
execution_type = "strict"


**Bug fixes and improvements.**

All changes


* fix: marimo home directory shouldn't be in sys.path by akshayka in https://github.com/marimo-team/marimo/pull/1618
* feat: polars support in `mo.ui.dataframe` transformations by mscolnick in https://github.com/marimo-team/marimo/pull/1612
* fix: Save cell execution times for session resume by wasimsandhu in https://github.com/marimo-team/marimo/pull/1619
* fix: Persist stale cells on session resume by wasimsandhu in https://github.com/marimo-team/marimo/pull/1625
* fix: Set stale status to false on cell transition to idle by wasimsandhu in https://github.com/marimo-team/marimo/pull/1626
* chore: cleanup singleton logic to cache on the window by mscolnick in https://github.com/marimo-team/marimo/pull/1627
* Strict Execution by dmadisetti in https://github.com/marimo-team/marimo/pull/1580
* improvement: add more types to the openapi schema by mscolnick in https://github.com/marimo-team/marimo/pull/1621
* vscode: theming for vscode, return code on save by mscolnick in https://github.com/marimo-team/marimo/pull/1628
* fix: plotly formatting error by mscolnick in https://github.com/marimo-team/marimo/pull/1633
* fix: uninstantiated logic by akshayka in https://github.com/marimo-team/marimo/pull/1632
* Update Documentation for mo.tabs to mo.ui.tabs to Remove Deprecation … by Haleshot in https://github.com/marimo-team/marimo/pull/1637
* chore: fix typo by ericjanto in https://github.com/marimo-team/marimo/pull/1638
* improvement: less scroll shift by akshayka in https://github.com/marimo-team/marimo/pull/1635
* feat: global table search by mscolnick in https://github.com/marimo-team/marimo/pull/1641
* fix: clear global search in the backend for dataframes by mscolnick in https://github.com/marimo-team/marimo/pull/1642
* fix: clear global search in the backend for dataframes by mscolnick in https://github.com/marimo-team/marimo/pull/1643
* feat: Feedback on notebook run completion by wasimsandhu in https://github.com/marimo-team/marimo/pull/1634
* fix: use basename for document title (1630) by ericjanto in https://github.com/marimo-team/marimo/pull/1647
* chore(deps): update dependency ws to v8.17.1 [security] by renovate in https://github.com/marimo-team/marimo/pull/1644
* 0.6.20 by akshayka in https://github.com/marimo-team/marimo/pull/1649


**Full Changelog**: https://github.com/marimo-team/marimo/compare/0.6.19...0.6.20

Resources

• https://github.com/marimo-team/marimo/pull/1644/commits/5da855b49fcfbad8df559fa21155177f5c5ab027
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37890