CVE-2024-45811

Advisory

Marimo 0.8.16 updates its NPM dependency 'vite' to 5.4.6 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed

Highlights

🎥 **Conditionally show a cell's code in its output.** Use [`mo.show_code()`](https://docs.marimo.io/api/outputs.html#display-cell-code-in-marimo-s-app-views) to include the cell's code in the output area, so that the code is visible even in the app view, when running with `marimo run`, and in HTML exports.

🌺**Improved Ibis support.** Performance improvements for our integration with Ibis, including native Ibis support in `mo.ui.table` and `mo.ui.dataframe`.

⌨ **Improved settings menu.** marimo is packed with configurable features, so many that we outgrew our simple user configuration menu. We've replaced it with a more easily navigable modal, making it easier for you to discover and configure our many settings.


All changes

* feat: Account for state and variable type in save by dmadisetti in https://github.com/marimo-team/marimo/pull/1993
* fix: ui.file_browser() abs paths by akshayka in https://github.com/marimo-team/marimo/pull/2314
* chore: use paths-filter github action by mscolnick in https://github.com/marimo-team/marimo/pull/2321
* tests: check schema drift from openapi schema by mscolnick in https://github.com/marimo-team/marimo/pull/2322
* improvement: Add "Hide outputs" to sql cells by mscolnick in https://github.com/marimo-team/marimo/pull/2326
* fix: update gcp references by emmanuel-ferdman in https://github.com/marimo-team/marimo/pull/2328
* chore: refactor table to clean it up by mscolnick in https://github.com/marimo-team/marimo/pull/2319
* fix: vega charts with special characters by mscolnick in https://github.com/marimo-team/marimo/pull/2323
* fix: MimeRendererPlugin validation schema by mscolnick in https://github.com/marimo-team/marimo/pull/2324
* improvement: prevent uncessary rerenders in plugins by mscolnick in https://github.com/marimo-team/marimo/pull/2329
* improvement: better loading indicator while pyodide is bootstrapping by mscolnick in https://github.com/marimo-team/marimo/pull/2330
* [pre-commit.ci] pre-commit autoupdate by pre-commit-ci in https://github.com/marimo-team/marimo/pull/2331
* fix: memory leak with temporary variables by akshayka in https://github.com/marimo-team/marimo/pull/2334
* improvement: Debounce mo.ui.text and text_area by wasimsandhu in https://github.com/marimo-team/marimo/pull/2333
* fix: island styling fixes for portalled components by mscolnick in https://github.com/marimo-team/marimo/pull/2335
* chore(deps): update dependency vite to v5.4.6 [security] by renovate in https://github.com/marimo-team/marimo/pull/2336
* improvement: handle more output mime types from islands by mscolnick in https://github.com/marimo-team/marimo/pull/2339
* fix: ignore project when running in a sandbox by akshayka in https://github.com/marimo-team/marimo/pull/2340
* `Arviz` plotting library fix by Haleshot in https://github.com/marimo-team/marimo/pull/2311
* feat: support ibis native in mo.ui.table() by mscolnick in https://github.com/marimo-team/marimo/pull/2312
* fix: table checkbox width and pinning styles by mscolnick in https://github.com/marimo-team/marimo/pull/2345
* feat: mo.show_code(output) by akshayka in https://github.com/marimo-team/marimo/pull/2342
* improvement: user settings modal by mscolnick in https://github.com/marimo-team/marimo/pull/2348
* 0.8.16 by akshayka in https://github.com/marimo-team/marimo/pull/2349


**Full Changelog**: https://github.com/marimo-team/marimo/compare/0.8.15...0.8.16

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45811