✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

✅ PR preview is ready!

Summary

This PR adds bind="query-params" support to st.number_input, enabling two-way sync between the widget's value and URL query parameters. The implementation touches the full stack:

• Protobuf: Adds an optional query_param_key field (tag 25) to NumberInput.proto.
• Python backend: Adds the bind parameter to all overloads and the implementation of number_input, passes it to register_widget, and adds clamping logic in NumberInputSerde.deserialize for out-of-range URL-seeded values.
• Frontend (React): Passes queryParamBinding config to the existing useBasicWidgetState hook.
• Tests: Python unit tests, frontend unit tests, typing tests, and E2E Playwright tests are all added.

Code Quality

The code is well-structured and follows established patterns closely. The implementation mirrors how other widgets (e.g., Checkbox, ColorPicker) implement query param binding through useBasicWidgetState.

Strengths:

• Good documentation in the docstring for the new bind parameter (lines 388–395 of number_input.py).
• Thoughtful comments explaining the distinction between serde-level clamping and the existing bounds-reset logic (lines 679–682).
• Clean use of cast with # type: ignore[redundant-cast] for type checker compatibility (lines 659–660).
• The NumberInputSerde dataclass extension with min_value and max_value is a clean way to incorporate clamping.

Minor observations:

1. In NumberInputSerde.deserialize (line 92 of number_input.py), the clamping val = max(self.min_value, min(self.max_value, val)) always runs when val is not None. For the case where no explicit min/max is provided by the user, the defaults are JSNumber.MIN_SAFE_INTEGER / JSNumber.MAX_SAFE_INTEGER (for ints) or JSNumber.MIN_NEGATIVE_VALUE / JSNumber.MAX_VALUE (for floats). This means clamping is always a no-op for in-range values, which is correct. The clamping is unconditional regardless of whether bind is used, but since it's a no-op for normal values, this is harmless and actually adds a safety net.

2. The frontend change is minimal and idiomatic — just 7 lines adding the queryParamBinding property to the useBasicWidgetState options object (lines 147–153 of NumberInput.tsx). This follows the exact same pattern as Checkbox.tsx.

Test Coverage

Test coverage is thorough and well-organized:

Python unit tests (number_input_test.py):

• Tests bind="query-params" sets query_param_key in the proto.
• Tests that bind="query-params" without a key raises an exception.
• Tests that no bind doesn't set the key.
• Tests invalid bind values raise StreamlitInvalidBindValueError.
• Tests with int, float, and min/max value combinations.
• Parameterized tests for serde clamping behavior (above max, below min, in range, None).

Frontend unit tests (NumberInput.test.tsx):

• Tests register/unregister lifecycle for query param binding.
• Tests that binding is not registered when queryParamKey is absent.
• Tests with float default values.

Typing tests (number_input_types.py):

• Verifies return types are preserved when bind is used with various type combinations.

E2E tests (st_number_input_test.py):

• Seeding int from URL.
• Seeding float from URL.
• URL updates when widget value changes.
• Default override and param removal when value returns to default.
• Clamping to min/max for out-of-range URL values.
• Invalid (non-numeric) URL values are handled gracefully.

The E2E tests follow best practices well: using expect for auto-wait assertions, key-based locators (get_element_by_key), page/app_port fixtures for URL-specific tests vs app fixture for interaction tests, and descriptive test names.

Backwards Compatibility

This change is fully backwards compatible:

• The bind parameter defaults to None, so existing calls to st.number_input are unaffected.
• The protobuf field query_param_key (tag 25) is optional string, meaning older frontends will simply ignore it, and newer frontends handle its absence gracefully (the conditional element.queryParamKey ? ... : undefined).
• The serde clamping is always a no-op for values already within bounds, so there's no behavioral change for existing widgets without bind.
• All existing overload signatures are preserved; bind is added as a keyword-only argument.

Security & Risk

• No security concerns identified. The query param binding mechanism reuses the existing, well-tested register_widget infrastructure with bind and clearable parameters. Invalid URL values (non-numeric strings) are handled gracefully — the widget falls back to its default and clears the invalid param from the URL.
• Low regression risk. The only change to existing code paths is the addition of min_value/max_value fields to NumberInputSerde and unconditional clamping in deserialize. Since clamping against the JS number bounds is a no-op for normal values, this is safe.

Accessibility

No accessibility concerns. The frontend change is purely in the data/state layer (passing queryParamBinding to the hook). No DOM structure, ARIA attributes, or keyboard interaction patterns are modified.

Recommendations

1. Consider adding a negative assertion to E2E tests: For test_number_input_query_param_seeding_int, consider also asserting that the URL does not contain unexpected extra query parameters (e.g., expect(page).not_to_have_url(re.compile(r"bound_float="))) to guard against cross-widget pollution. This would align with the E2E best practice of "at least one 'must NOT happen' check per scenario." However, this is a minor stylistic point and not a blocker.

2. Consider testing value=None with query param seeding: The E2E app defines bound_int with value=None, and test_number_input_query_param_invalid_value tests the invalid case. It might be valuable to also verify that when bound_int is seeded with a valid integer via URL, the widget correctly transitions from None default to the seeded value and the type is int. This is partially covered by test_number_input_query_param_seeding_int but an explicit check that the returned Python type is int (not float) would be useful since value=None defaults to float type — actually, looking more carefully, bound_int uses value=None with no other type hints, so it defaults to float. The test asserts "42" in the markdown output, which would work for both 42 and 42.0. This is fine since the E2E test is checking user-visible behavior.

Verdict

APPROVED: Clean, well-tested implementation that follows established patterns for query param binding, is fully backwards compatible, and includes comprehensive test coverage across all layers.

This is an automated AI review by opus-4.6-thinking.