1.8 release - #435
Merged
Merged
Conversation
FlorentinD
commented
Aug 18, 2026
FlorentinD
commented
Collaborator
- Apply post release steps
- Use render_widget for from_snowflake
- Add pictures to the notebook
- Some cleanups
- Pin GHA to sha instead of version
- Bump python dependencies
- Fix style
- Bump the python-patch-and-minor group in /python-wrapper with 2 updates
- Fix js injection issue in VG.render method
- Fix correctness defects from security audit (GDS-321)
- chore(js-applet): bump patch/minor deps (Phase A)
- chore(js-applet): bump typescript to 7.0.2 (Phase B1)
- chore(js-applet): bump vite toolchain to v8 (Phase B2)
- chore(js-applet): bump jsdom/concurrently/@types/node (Phase B3)
- chore(js-applet): bump @neo4j-ndl/react-graph to 2.1.3 (Phase B4)
- Adjust scripts to use uv
- Format code (incl js code via oxlint)
- Apply read permissions guard
- Wait 3 days for new releases
- Fix clicking issue observed on streamlit
- Add js-sytle target
- Shorten change log entry
- Support latest gds alpha release
- Allow reacting to double-click events
- Handle duplicates on add_data
- Handle duplicates on add_data
- Support different interaction events
- Fix dependabot cooldown
- Fix gds tests for latest alpha release
- Fix token permissions for GHA
- Update package version
Use render_widget for from_snowflake call
Add pictures to the snowflake notebok
also group dependency updates
Pin GHA to sha instead of version
Consolidated update of python-wrapper dependencies via `uv lock --upgrade`, plus bumps to exact-pinned dev tools: ruff 0.15.17->0.16.3, mypy 2.1.0->2.3.0, pytest 9.0.3->9.1.1, selenium 4.44.0->4.47.0. streamlit (floor pin) and sphinx (capped for py3.10/enum_tools compat) are intentionally left as-is. Also switch the dependabot python-wrapper ecosystem from `pip` to `uv` so it keeps uv.lock in sync going forward, and set open-pull-requests-limit to 10. Supersedes dependabot PRs #421 #420 #415 #408 #405 #402 #401 #400 #390 #386 #385 #381 #380 #378 #377 #362 #356. Co-Authored-By: Claude <noreply@anthropic.com>
Bump python dependencies
Bumps the python-patch-and-minor group in /python-wrapper with 2 updates: [snowflake-snowpark-python](https://github.com/snowflakedb/snowpark-python) and [streamlit](https://github.com/streamlit/streamlit). Updates `snowflake-snowpark-python` from 1.52.0 to 1.54.0 - [Release notes](https://github.com/snowflakedb/snowpark-python/releases) - [Changelog](https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md) - [Commits](snowflakedb/snowpark-python@v1.52.0...v1.54.0) Updates `streamlit` from 1.58.0 to 1.61.1 - [Release notes](https://github.com/streamlit/streamlit/releases) - [Commits](streamlit/streamlit@1.58.0...1.61.1) --- updated-dependencies: - dependency-name: snowflake-snowpark-python dependency-version: 1.54.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-patch-and-minor - dependency-name: streamlit dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-patch-and-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…n-patch-and-minor-9ac4c6c5a0 Bump the python-patch-and-minor group in /python-wrapper with 2 updates
…a-contains-javascript Fix js injection issue in VG.render method
Address five findings from the python-graph-visualization security audit (F-01 XSS and L-04 parser recursion are handled separately / deferred): - L-01: remove_data now deletes relationships left dangling by a node-only removal, instead of leaving them and silently rendering an empty graph. - L-02: remove_data compares ids as strings on both sides, so a numeric id (Node(id=1)) matches its text form (remove_data(nodes="1")). - F-02: resize_nodes/color_nodes raise a clear ValueError naming the missing property instead of crashing with min() iterable argument is empty. - F-03: color_nodes continuous raises a clear ValueError suggesting ColorSpace.DISCRETE for non-numeric values instead of a TypeError. - L-03: max_allowed_nodes is threaded into GraphWidget and enforced by add_data, so the draw-time node limit cannot be bypassed afterwards. # Conflicts: # changelog.md
…by-audit Fix correctness defects from security audit (GDS-321)
Bump @anywidget/react, @neo4j-ndl/{base,react}, @neo4j-nvl/*,
react/react-dom, @types/react(-dom), vite-plugin-singlefile.
Pin vitest to ~4.0.0 (4.1.x needs vite 8; bumped in a later phase).
Update test render calls for new anywidget RenderProps (signal/host).
Rebuild checked-in JS artifacts.
Co-Authored-By: Claude <noreply@anthropic.com>
No type errors under TS 7 (skipLibCheck + already-modern strict config). No artifact changes (esbuild transpilation unaffected by TS version). Co-Authored-By: Claude <noreply@anthropic.com>
vite ^6.3.5 -> ^8.2.1, @vitejs/plugin-react ^4.5.2 -> ^6.0.5, @anywidget/vite ^0.2.2 -> ^0.3.0, vitest ~4.0.0 -> ^4.1.10. vitest 4.1.x requires vite 8 (resolves the yarn-classic 'could not find a copy of vite to link' peer-dep conflict). Replace deprecated rollupOptions.output.inlineDynamicImports:true with codeSplitting:false in vite.config.ts and vite.config.streamlit.ts. Rebuild checked-in JS artifacts. Co-Authored-By: Claude <noreply@anthropic.com>
jsdom ^29.1.1 -> ^30.0.1, concurrently ^9.2.1 -> ^10.0.4, @types/node ^25.2.3 -> ^26.2.0. Keep @tanstack/react-table at ^8.21.3: it is a pinned peer dep of @neo4j-ndl/react@4.18.4 (data-grid imports it); bumping to v9 would violate the peer and break the data-grid. No artifact changes. Note: jsdom 30 requires node ^22.22.2 || ^24.15.0 || >=26; CI's node-version lts/* (22.x latest) satisfies this. Co-Authored-By: Claude <noreply@anthropic.com>
v2 is API-compatible with our usage: the GraphVisualization component, its dot-notation sub-components, and the NeoNode/NeoRel/PortableProperty/ Gesture/GraphSelection types are all unchanged - no source edits needed. All peer deps satisfied (react 19.2.8, @neo4j-nvl 1.2.1, @neo4j-ndl base 4.17.4 / react 4.18.4). Rebuild checked-in JS artifacts (leaner bundle: 4832 vs 5230 modules). Co-Authored-By: Claude <noreply@anthropic.com>
Update JS dependencies
opening a side-panel screwed up click positioning
Fix clicking issue observed on streamlit
…n-entity gds 293 react on double clicking an entity
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Fix gds tests for latest alpha release
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.