[feat] Add ComponentManifest infra#12637
Merged
sfc-gh-bnisco merged 1 commit intodevelopfrom Oct 24, 2025
Merged
Conversation
This was referenced Sep 25, 2025
Contributor
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Contributor
✅ PR preview is ready!
|
Collaborator
Author
sfc-gh-bnisco
added
change:feature
Graphite App
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
from
528e219 to
368d4fe
Compare
Contributor
📉 Python coverage change detectedThe Python unit test coverage has decreased by 0.0722%
💡 Consider adding more unit tests to maintain or improve coverage. Coverage by files
|
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR introduces the Component Catalog v2 (CCv2) infrastructure for discovering and processing Streamlit component manifests defined in pyproject.toml files. The implementation provides a robust system for scanning installed Python packages, extracting component definitions, and managing asset paths with security constraints.
Key Changes:
- Adds component manifest scanning with parallel processing and early filtering to optimize performance
- Implements path utilities with security validation to prevent path traversal attacks
- Creates a manifest handler that processes component definitions and enforces asset root constraints
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
lib/streamlit/components/v2/manifest_scanner.py |
Core scanner that discovers pyproject.toml files across installed packages and extracts component manifests |
lib/streamlit/components/v2/component_path_utils.py |
Security-focused path utilities for validating component asset paths and preventing traversal attacks |
lib/streamlit/components/v2/component_manifest_handler.py |
Processes manifests into component definitions while enforcing asset directory constraints |
lib/streamlit/components/v2/__init__.py |
Package initialization file |
lib/tests/streamlit/components/v2/test_manifest_scanner.py |
Comprehensive test suite covering manifest scanning, path resolution, and edge cases |
Comments suppressed due to low confidence (1)
lib/streamlit/components/v2/component_manifest_handler.py:1
- Same security issue as Comment 2 - string prefix comparison for path validation is vulnerable to path traversal attacks where malicious paths with similar prefixes could bypass validation.
# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
368d4fe to
37d911a
Compare
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
from
37d911a to
e18e755
Compare
Contributor
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Comments suppressed due to low confidence (1)
lib/streamlit/components/v2/manifest_scanner.py:1
- Using bare
except Exceptionclauses without logging the exceptions makes debugging difficult. Consider logging the exceptions at debug level or being more specific about which exceptions to catch.
# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
e18e755 to
82c1b0e
Compare
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-2
branch
from
c0b94ac to
a3ea4ff
Compare
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
from
82c1b0e to
8bdcce6
Compare
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-2
branch
from
a3ea4ff to
7957af2
Compare
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
2 times, most recently
from
e55f66f to
256273d
Compare
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-2
branch
2 times, most recently
from
a68b226 to
aeb5b04
Compare
sfc-gh-lwilby
approved these changes
Oct 3, 2025
This was referenced Oct 3, 2025
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
3 times, most recently
from
60f1393 to
091465f
Compare
This was referenced Oct 10, 2025
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
from
091465f to
77613c7
Compare
sfc-gh-bnisco
force-pushed
the
bnisco/ccv2-stack-4
branch
from
77613c7 to
93f342d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe your changes
manifest_scanner: Discovers installed packages that declare CCv2 metadata in pyproject.toml and parses aComponentManifest.component_path_utils: Centralizes secure path handling and file/glob resolution with parent directory traversal and symlink-escape protection.component_manifest_handler: Processes a parsed manifest, validatesasset_dirlocations, and stores per-component asset roots and metadata.Motivation:
We need a secure and reliable way to discover and validate third-party Streamlit CCv2s declared via package metadata, and to resolve their asset roots safely. This lays the foundation for automatic component registration and asset serving in a future PR.
GitHub Issue Link (if applicable)
Testing Plan
Contribution License Agreement
By submitting this pull request you agree that all contributions to this project are made under the Apache 2.0 license.