Merge branch 'Chainlit:main' into main

.github/CONTRIBUTING.md

@@ -6,7 +6,7 @@ To contribute to Chainlit, you first need to setup the project on your local mac
 
 <!--
 Generated using https://ecotrust-canada.github.io/markdown-toc/.
-I've copy/pasted the whole document there, without the previous two headings.
+I've copy/pasted the whole document there, and then formatted it with prettier.
 -->
 
 - [Contribute to Chainlit](#contribute-to-chainlit)
@@ -37,11 +37,11 @@ I've copy/pasted the whole document there, without the previous two headings.
 
 With this setup you can easily code in your fork and fetch updates from the main repository.
 
-1. Go to https://github.com/Chainlit/chainlit/fork to fork the chainlit code into your own repository.
+1. Go to [https://github.com/Chainlit/chainlit/fork](https://github.com/Chainlit/chainlit/fork) to fork the chainlit code into your own repository.
 2. Clone your fork locally
 
 ```sh
-$ git clone https://github.com/YOUR_USERNAME/YOUR_FORK.git
+git clone https://github.com/YOUR_USERNAME/YOUR_FORK.git
 ```
 
 3. Go into your fork and list the current configured remote repository.
@@ -55,7 +55,7 @@ $ git remote -v
 4. Specify the new remote upstream repository that will be synced with the fork.
 
 ```sh
-$ git remote add upstream https://github.com/Chainlit/chainlit.git
+git remote add upstream https://github.com/Chainlit/chainlit.git
 ```
 
 5. Verify the new upstream repository you've specified for your fork.
@@ -103,7 +103,7 @@ If you've made it this far, you can now replace `chainlit/hello.py` by your own
 
 ## Start the UI from source
 
-First, you will have to start the server either [from source](#start-the-chainlit-server-from-source) or with `chainlit run... `. Since we are starting the UI from source, you can start the server with the `-h` (headless) option.
+First, you will have to start the server either [from source](#start-the-chainlit-server-from-source) or with `chainlit run...`. Since we are starting the UI from source, you can start the server with the `-h` (headless) option.
 
 Then, start the UI.
 

.github/actions/pnpm-node-install/action.yaml

@@ -1,18 +1,18 @@
-name: 'Install Node, pnpm and dependencies.'
-description: 'Install Node, pnpm and dependencies using cache.'
+name: Install Node, pnpm and dependencies.
+description: Install Node, pnpm and dependencies using cache.
 
 inputs:
   node-version:
-    description: 'Node.js version'
+    description: Node.js version
     required: true
   pnpm-version:
-    description: 'pnpm version'
+    description: pnpm version
     required: true
   pnpm-install-args:
-    description: 'Extra arguments for pnpm install, e.g. --no-frozen-lockfile.'
+    description: Extra arguments for pnpm install, e.g. --no-frozen-lockfile.
 
 runs:
-  using: 'composite'
+  using: composite
   steps:
     - uses: pnpm/action-setup@v4
       with:
@@ -21,7 +21,7 @@ runs:
       uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
-        cache: 'pnpm'
+        cache: pnpm
     - name: Install JS dependencies
       run: pnpm install ${{ inputs.pnpm-install-args }}
       shell: bash

.github/actions/poetry-python-install/action.yaml

@@ -1,23 +1,23 @@
-name: 'Install Python, poetry and dependencies.'
-description: 'Install Python, Poetry and poetry dependencies using cache'
+name: Install Python, poetry and dependencies.
+description: Install Python, Poetry and poetry dependencies using cache
 
 inputs:
   python-version:
-    description: 'Python version'
+    description: Python version
     required: true
   poetry-version:
-    description: 'Poetry version'
+    description: Poetry version
     required: true
   poetry-working-directory:
-    description: 'Working directory for poetry command.'
+    description: Working directory for poetry command.
     required: false
-    default: '.'
+    default: .
   poetry-install-args:
-    description: 'Extra arguments for poetry install, e.g. --with tests.'
+    description: Extra arguments for poetry install, e.g. --with tests.
     required: false
 
 runs:
-  using: 'composite'
+  using: composite
   steps:
     - name: Cache poetry install
       uses: actions/cache@v4

.github/workflows/ci.yaml

@@ -8,6 +8,8 @@ on:
   push:
     branches: [main, dev]
 
+permissions: read-all
+
 jobs:
   pytest:
     uses: ./.github/workflows/pytest.yaml
@@ -23,5 +25,5 @@ jobs:
     name: Run CI
     needs: [mypy, pytest, e2e-tests]
     steps:
-      - name: 'Done'
+      - name: Done
         run: echo "Done"

.github/workflows/e2e-tests.yaml

@@ -2,6 +2,8 @@ name: E2ETests
 
 on: [workflow_call]
 
+permissions: read-all
+
 jobs:
   ci:
     runs-on: ${{ matrix.os }}

.github/workflows/mypy.yaml

@@ -2,6 +2,8 @@ name: Mypy
 
 on: [workflow_call]
 
+permissions: read-all
+
 jobs:
   mypy:
     runs-on: ubuntu-latest

.github/workflows/publish.yaml

@@ -5,6 +5,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yaml

.github/workflows/pytest.yaml

@@ -2,6 +2,8 @@ name: Pytest
 
 on: [workflow_call]
 
+permissions: read-all
+
 jobs:
   pytest:
     runs-on: ubuntu-latest
@@ -23,6 +25,14 @@ jobs:
       - name: Install fastapi ${{ matrix.fastapi-version }}
         run: poetry add fastapi@^${{ matrix.fastapi-version}}
         working-directory: ${{ env.BACKEND_DIR }}
+      - uses: ./.github/actions/pnpm-node-install
+        name: Install Node, pnpm and dependencies.
+        with:
+          node-version: 22.7.0
+          pnpm-version: 9.7.0
+          pnpm-install-args: --no-frozen-lockfile
+      - name: Build UI
+        run: pnpm run buildUi
       - name: Run Pytest
         run: poetry run pytest --cov=chainlit/
         working-directory: ${{ env.BACKEND_DIR }}

CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to Chainlit will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [1.2.0] - 2024-09-16
+
+### Security
+
+- Fixed critical vulnerabilities allowing arbitrary file read access (#1326)
+- Improved path traversal protection in various endpoints (#1326)
+
+### Added
+
+- Hebrew translation JSON (#1322)
+- Translation files for Indian languages (#1321)
+- Support for displaying function calls as tools in Chain of Thought for LlamaIndexCallbackHandler (#1285)
+- Improved feedback UI with refined type handling (#1325)
+
+### Changed
+
+- Upgraded cryptography from 43.0.0 to 43.0.1 in backend dependencies (#1298)
+- Improved GitHub Actions workflow (#1301)
+- Enhanced data layer cleanup for better performance (#1288)
+- Factored out callbacks with extensive test coverage (#1292)
+- Adopted strict adherence to Semantic Versioning (SemVer)
+
+### Fixed
+
+- Websocket connection issues when submounting Chainlit (#1337)
+- Show_input functionality on chat resume for SQLAlchemy (#1221)
+- Negative feedback class incorrectness (#1332)
+- Interaction issues with Chat Profile Description Popover (#1276)
+- Centered steps within assistant messages (#1324)
+- Minor spelling errors (#1341)
+
+### Development
+
+- Added documentation for release engineering process (#1293)
+- Implemented testing for FastAPI version matrix (#1306)
+- Removed wait statements from E2E tests for improved performance (#1270)
+- Bumped dataclasses to latest version (#1291)
+- Ensured environment loading before other imports (#1328)
+
 ## [1.1.404] - 2024-09-04
 
 ### Security

README.md

@@ -19,20 +19,21 @@ Chainlit is an open-source async Python framework which allows developers to bui
 Full documentation is available [here](https://docs.chainlit.io). You can ask Chainlit related questions to [Chainlit Help](https://help.chainlit.io/), an app built using Chainlit!
 
 > [!NOTE]  
-> Contact us [here](https://forms.gle/BX3UNBLmTF75KgZVA) for **Enterprise Support**.
 > Check out [Literal AI](https://literalai.com), our product to monitor and evaluate LLM applications! It works with any Python or TypeScript applications and [seamlessly](https://docs.chainlit.io/data-persistence/overview) with Chainlit by adding a `LITERAL_API_KEY` in your project.
+> 
+> Chainlit is developed and maintained by the Literal AI team, which is currently focused on expanding the capabilities of Literal AI. While we continue to support and maintain Chainlit, we are also committed to enabling the community to contribute, particularly in areas like integrations and data layers.
 
 <p align="center">
-    <img src="https://github.com/Chainlit/chainlit/assets/13104895/0c2cc7a9-766c-41d3-aae2-117a2d0eb8ed" width="80%" />
+    <img src="https://github.com/Chainlit/chainlit/assets/13104895/0c2cc7a9-766c-41d3-aae2-117a2d0eb8ed" alt="Chainlit user interface" width="80%"></img>
 </p>
 
 ## Installation
 
 Open a terminal and run:
 
-```bash
-$ pip install chainlit
-$ chainlit hello
+```sh
+pip install chainlit
+chainlit hello
 ```
 
 If this opens the `hello app` in your browser, you're all set!
@@ -77,8 +78,8 @@ async def main(message: cl.Message):
 
 Now run it!
 
-```
-$ chainlit run demo.py -w
+```sh
+chainlit run demo.py -w
 ```
 
 <img src="/images/quick-start.png" alt="Quick Start"></img>
@@ -88,7 +89,7 @@ $ chainlit run demo.py -w
 Full documentation is available [here](https://docs.chainlit.io). Key features:
 
 - [💬 Multi Modal chats](https://docs.chainlit.io/advanced-features/multi-modal)
-- [💭 Chain of Thought visualisation](https://docs.chainlit.io/concepts/step)
+- [💭 Chain of Thought visualization](https://docs.chainlit.io/concepts/step)
 - [💾 Data persistence + human feedback](https://docs.chainlit.io/data-persistence/overview)
 - [🐛 Debug Mode](https://docs.chainlit.io/data-persistence/enterprise#debug-mode)
 - [👤 Authentication](https://docs.chainlit.io/authentication/overview)

RELENG.md

@@ -8,19 +8,23 @@ This document outlines the steps for maintainers to create a new release of the
 
 ## Steps
 
-1. **Update the changelog**:
-
-   - Create a pull request to update the CHANGELOG.md file with the changes for the new release.
-   - Mark any breaking changes clearly.
-   - Get the changelog update PR reviewed and merged.
-
-2. **Determine the new version number**:
+1. **Determine the new version number**:
 
    - We use semantic versioning (major.minor.patch).
    - Increment the major version for breaking changes, minor version for new features, patch version for bug fixes only.
    - If unsure, discuss with the maintainers to determine if it should be a major/minor version bump or new patch version.
 
-3. **Create a new release**:
+2. **Bump the package version**:
+
+   - Update `version` in `[tool.poetry]` of `backend/pyproject.toml`.
+
+3. **Update the changelog**:
+
+   - Create a pull request to update the CHANGELOG.md file with the changes for the new release.
+   - Mark any breaking changes clearly.
+   - Get the changelog update PR reviewed and merged.
+
+4. **Create a new release**:
 
    - In the GitHub repo, go to the "Releases" page and click "Draft a new release".
    - Input the new version number as the tag (e.g. 4.0.4).
@@ -29,7 +33,7 @@ This document outlines the steps for maintainers to create a new release of the
    - If this is a full release after an RC, remove any "-rc" suffix from the version number.
    - Publish the release.
 
-4. **Update any associated documentation and examples**:
+5. **Update any associated documentation and examples**:
    - If needed, create PRs to update the version referenced in the docs and example code to match the newly released version.
    - Especially important for documented breaking changes.
 

backend/chainlit/__init__.py

@@ -1,5 +1,17 @@
-import asyncio
 import os
+
+from dotenv import load_dotenv
+
+# ruff: noqa: E402
+# Keep this here to ensure imports have environment available.
+env_found = load_dotenv(dotenv_path=os.path.join(os.getcwd(), ".env"))
+
+from chainlit.logger import logger
+
+if env_found:
+    logger.info("Loaded .env file")
+
+import asyncio
 from typing import TYPE_CHECKING, Any, Dict
 
 import chainlit.input_widget as input_widget
@@ -22,7 +34,6 @@
     Text,
     Video,
 )
-from chainlit.logger import logger
 from chainlit.message import (
     AskActionMessage,
     AskFileMessage,
@@ -37,7 +48,6 @@
 from chainlit.user_session import user_session
 from chainlit.utils import make_module_getattr
 from chainlit.version import __version__
-from dotenv import load_dotenv
 from literalai import ChatGeneration, CompletionGeneration, GenerationMessage
 from pydantic.dataclasses import dataclass
 
@@ -71,12 +81,6 @@
     from chainlit.openai import instrument_openai
 
 
-env_found = load_dotenv(dotenv_path=os.path.join(os.getcwd(), ".env"))
-
-if env_found:
-    logger.info("Loaded .env file")
-
-
 def sleep(duration: int):
     """
     Sleep for a given duration.

backend/chainlit/_utils.py

@@ -0,0 +1,8 @@
+"""Util functions which are explicitly not part of the public API."""
+
+from pathlib import Path
+
+
+def is_path_inside(child_path: Path, parent_path: Path) -> bool:
+    """Check if the child path is inside the parent path."""
+    return parent_path.resolve() in child_path.resolve().parents