Merge branch 'marimo-team:main' into main

Author: maxkoretskyi

.github/workflows/enforce-label.yml

@@ -0,0 +1,19 @@
+name: 🏷️ Enforce Pull Request Label
+
+# Enforces that at least one label is selected on pull requests
+
+on:
+  pull_request:
+    types: [labeled, unlabeled, opened, reopened, edited, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  enforce-label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: yogevbd/enforce-label-action@2.2.2
+        with:
+          REQUIRED_LABELS_ANY: "enhancement,bug,documentation,internal,preview,dependencies,other"
+          REQUIRED_LABELS_ANY_DESCRIPTION: "🏷️ Select at least one label: ['enhancement','bug','documentation','internal','preview','dependencies','other']"

.github/workflows/labeler.yml

@@ -1,36 +1,19 @@
 name: 🏷️ Pull Request Labeler
 
-# Label pull requests based on config in .github/labeler.yml
-# And enforces that at least one label is selected
+# Auto-label pull requests based on config in .github/labeler.yml
 
 on:
   pull_request_target:
     types: [labeled, unlabeled, opened, reopened, edited, synchronize]
-  pull_request:
-    types: [labeled, unlabeled, opened, reopened, edited, synchronize]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
 
 permissions:
   contents: read
   pull-requests: write
 
 jobs:
   auto-label:
-    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@v5
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-  enforce-label:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: yogevbd/enforce-label-action@2.2.2
-        with:
-          REQUIRED_LABELS_ANY: "enhancement,bug,documentation,internal,preview,dependencies,other"
-          REQUIRED_LABELS_ANY_DESCRIPTION: "🏷️ Select at least one label: ['enhancement','bug','documentation','internal','preview','dependencies','other']"

SECURITY.md

@@ -43,5 +43,6 @@ We would like to acknowledge and thank the following individuals for their respo
  - @acepace
  - @devgi
  - @W-M-T (Ward Theunisse)
+ - @doredry
 
 Your contributions help keep marimo safe for the entire community. We encourage security researchers to report issues and welcome your help in making marimo more secure.

frontend/src/plugins/impl/anywidget/AnyWidgetPlugin.tsx

@@ -4,18 +4,16 @@
 import type { AnyWidget } from "@anywidget/types";
 import { useEffect, useRef } from "react";
 import { z } from "zod";
-import { asRemoteURL } from "@/core/runtime/config";
-import { resolveVirtualFileURL } from "@/core/static/files";
-import { isStaticNotebook } from "@/core/static/static-state";
 import { useAsyncData } from "@/hooks/useAsyncData";
 import type { HTMLElementNotDerivedFromRef } from "@/hooks/useEventListener";
 import { createPlugin } from "@/plugins/core/builder";
 import type { IPluginProps } from "@/plugins/types";
 import { prettyError } from "@/utils/errors";
 import { Logger } from "@/utils/Logger";
 import { ErrorBanner } from "../common/error-banner";
-import { getMarimoInternal, MODEL_MANAGER, type Model } from "./model";
+import { MODEL_MANAGER, type Model } from "./model";
 import type { ModelState, WidgetModelId } from "./types";
+import { BINDING_MANAGER, WIDGET_DEF_REGISTRY } from "./widget-binding";
 
 /**
  * AnyWidget asset data
@@ -48,12 +46,7 @@ export function useAnyWidgetModule(opts: { jsUrl: string; jsHash: string }) {
     error,
     refetch,
   } = useAsyncData(async () => {
-    let url = asRemoteURL(jsUrl).toString();
-    // In static notebooks, resolve virtual files to blob URLs for import()
-    if (isStaticNotebook()) {
-      url = resolveVirtualFileURL(url);
-    }
-    return await import(/* @vite-ignore */ url);
+    return await WIDGET_DEF_REGISTRY.getModule(jsUrl, jsHash);
     // Re-render on jsHash change (which is a hash of the contents of the file)
     // instead of a jsUrl change because URLs may change without the contents
     // actually changing (and we don't want to re-render on every change).
@@ -66,6 +59,7 @@ export function useAnyWidgetModule(opts: { jsUrl: string; jsHash: string }) {
   const hasError = Boolean(error);
   useEffect(() => {
     if (hasError && jsUrl) {
+      WIDGET_DEF_REGISTRY.invalidate(jsHash);
       refetch();
     }
   }, [hasError, jsUrl]);
@@ -180,14 +174,16 @@ const AnyWidgetSlot = (props: IPluginProps<ModelIdRef, Data>) => {
 async function runAnyWidgetModule<T extends AnyWidgetState>(
   widgetDef: AnyWidget<T>,
   model: Model<T>,
+  modelId: WidgetModelId,
   el: HTMLElement,
   signal: AbortSignal,
 ): Promise<void> {
   // Clear the element, in case the widget is re-rendering
   el.innerHTML = "";
 
   try {
-    const render = await getMarimoInternal(model).resolveWidget(widgetDef);
+    const binding = BINDING_MANAGER.getOrCreate(modelId);
+    const render = await binding.bind(widgetDef, model);
     await render(el, signal);
   } catch (error) {
     Logger.error("Error rendering anywidget", error);
@@ -231,7 +227,13 @@ const LoadedSlot = <T extends AnyWidgetState>({
       return;
     }
     const controller = new AbortController();
-    runAnyWidgetModule(widget, model, htmlRef.current, controller.signal);
+    runAnyWidgetModule(
+      widget,
+      model,
+      modelId,
+      htmlRef.current,
+      controller.signal,
+    );
     return () => controller.abort();
     // We re-run the widget when the modelId changes, which means the cell
     // that created the Widget has been re-run.

frontend/src/plugins/impl/anywidget/__tests__/AnyWidgetPlugin.test.tsx

@@ -1,12 +1,13 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 
 import { render, waitFor } from "@testing-library/react";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { TestUtils } from "@/__tests__/test-helpers";
 import type { HTMLElementNotDerivedFromRef } from "@/hooks/useEventListener";
 import { visibleForTesting } from "../AnyWidgetPlugin";
 import { MODEL_MANAGER, Model } from "../model";
 import type { WidgetModelId } from "../types";
+import { BINDING_MANAGER } from "../widget-binding";
 
 const { LoadedSlot } = visibleForTesting;
 
@@ -19,14 +20,6 @@ const mockWidget = {
   render: vi.fn(),
 };
 
-vi.mock("../AnyWidgetPlugin", async () => {
-  const originalModule = await vi.importActual("../AnyWidgetPlugin");
-  return {
-    ...originalModule,
-    runAnyWidgetModule: vi.fn(),
-  };
-});
-
 describe("LoadedSlot", () => {
   const modelId = asModelId("test-model-id");
   let mockModel: Model<{ count: number }>;
@@ -56,6 +49,10 @@ describe("LoadedSlot", () => {
     MODEL_MANAGER.set(modelId, mockModel);
   });
 
+  afterEach(() => {
+    BINDING_MANAGER.destroy(modelId);
+  });
+
   it("should render a div with ref", () => {
     const { container } = render(<LoadedSlot {...mockProps} />);
     expect(container.querySelector("div")).not.toBeNull();

frontend/src/plugins/impl/anywidget/__tests__/model.test.ts

@@ -16,6 +16,7 @@ import {
   visibleForTesting,
 } from "../model";
 import type { WidgetModelId } from "../types";
+import { BINDING_MANAGER } from "../widget-binding";
 
 const { ModelManager } = visibleForTesting;
 
@@ -376,4 +377,20 @@ describe("ModelManager", () => {
     });
     await expect(modelManager.get(testId)).rejects.toThrow();
   });
+
+  it("should destroy binding on close message", async () => {
+    const model = new Model({ count: 0 }, createMockComm());
+    modelManager.set(testId, model);
+
+    // Create a binding for this model
+    BINDING_MANAGER.getOrCreate(testId);
+    expect(BINDING_MANAGER.has(testId)).toBe(true);
+
+    await handleWidgetMessage(modelManager, {
+      model_id: testId,
+      message: { method: "close" },
+    });
+
+    expect(BINDING_MANAGER.has(testId)).toBe(false);
+  });
 });