Security Update for Python/JS and Streamlit Data Apps
New Python/JS (1.8.0) and Streamlit (3.0.2) data app images fix recent security vulnerabilities, and older images are no longer offered for new deployments
We have released new base images for Python/JS and Streamlit data apps. They fix recently published security vulnerabilities. Node.js 20, used by older Python/JS images, has reached end of life and no longer gets security fixes.
What's new
- Python/JS 1.8.0 is the new default: Python 3.13 with Node.js 24 on Debian trixie. An option with Python 3.11 and Node.js 22 is also available if your app needs it.
- Streamlit 3.0.2 is the new default: Python 3.13 with Streamlit 1.64, built on the patched Python/JS 1.8.0 image.
Retired versions
You can no longer select these images for new deployments:
- Python/JS: 1.5.0, 1.6.x and 1.7.x
- Streamlit: 2.0.0, 3.0.0 and 3.0.1
What you need to do
Apps that are already deployed keep running on the version they were deployed with. To get the security fixes:
- Open the data app's configuration.
- Choose Python/JS 1.8.0 or Streamlit 3.0.2 as the version.
- Redeploy the app and check that it works as expected.
If your app uses Node.js 20-specific packages, test it with Node.js 22 or 24 first. If you have questions or need help, please submit a support ticket.
Thank you for helping us keep your data apps secure.