[Snyk] Fix for 2 vulnerabilities

[madisonmay]

Snyk has created this PR to fix 2 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements.extra.txt

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Snyk has automatically assigned this pull request, set who gets assigned.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
👩‍💻 Set who automatically gets assigned
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Insecure Temporary File
🦉 Server-side Request Forgery (SSRF)

---

Note

Medium Risk
Moderate risk because streamlit is upgraded across major versions and may introduce breaking dependency/runtime changes; requests pin is low risk but could affect transitive dependency resolution.

Overview
Updates requirements.extra.txt to remediate Snyk-reported vulnerabilities by upgrading streamlit from 0.75.0 to 1.54.0.

Also adds an explicit requests>=2.33.0 constraint (not previously listed) and normalizes the embeddings==0.0.8 entry (ensuring it’s present as a proper line).

^{Written by Cursor Bugbot for commit 31bc21c. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Major version bump breaks removed st.beta_columns API

High Severity

Upgrading streamlit from 0.75.0 to 1.54.0 breaks the application because the codebase uses st.beta_columns (in project/interface/train.py, project/run_mnist_interface.py, project/sentiment_interface.py), which was removed in newer Streamlit versions and replaced with st.columns. This will cause AttributeError: module 'streamlit' has no attribute 'beta_columns' at runtime, crashing the Streamlit app. The @st.cache decorator with allow_output_mutation=True used in project/sentiment_interface.py is also deprecated and may fail. The code needs to be updated to use the current Streamlit API before this version bump can land safely.

 

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 31bc21c5dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Revert Streamlit major bump until beta_ calls are migrated*

Pinning streamlit==1.54.0 introduces a runtime break in the project UIs because the codebase still calls beta-prefixed APIs such as st.beta_columns and st.beta_expander (for example in project/tensor_interface.py and project/run_mnist_interface.py), which are not available in modern Streamlit releases. With this dependency change, those pages raise AttributeError when rendered, so the interactive tooling in project/ no longer works without additional code migration.

Useful? React with 👍 / 👎.