[Bug] Safety not passing (ipywidgets <8)
- Dominant language
- TypeScript
- Stars
- 12k
- Forks
- 2k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 66
Description
[**Describe the bug**
#1969 reported a `safety check` not passing due to use of ipywidgets <8.0.
I'm not entirely sure why the issue was closed as the vulnerability info is pulled from a vuln database at https://github.com/pyupio/safety-db. The database still shows that versions of ipywidgets < 8.0 are vulnerable; no patches have been released for major release 7.
See https://github.com/pyupio/safety-db/blob/master/data/insecure.json and https://raw.githubusercontent.com/pyupio/safety-db/master/data/insecure_full.json
The solution is to bring in version 8 of ipywidgets.
**To Reproduce**
1. Activate python environment
1. `pip install safety`
1. `cd kepler.gl/bindings/kepler.gl-jupyter/`
1. `safety check --full-report -r requirements.txt`
The report shows:
```
+===================================================================================================================================+
VULNERABILITIES FOUND
+===================================================================================================================================+
-> Vulnerability found in ipywidgets version 7.4.2
Vulnerability ID: 50664
Affected spec: <8.0.0
ADVISORY: Ipywidgets 8.0.0 sanitizes descriptions by default.https://github.com/jupyter-widgets/ipywidgets/pull/2785
PVE-2022-50664
For more information, please visit https://pyup.io/v/50664/f17
-> Vulnerability found in ipywidgets version 7.4.2
Vulnerability ID: 50463
Affected spec: <8.0.0rc2
ADVISORY: Ipywidgets 8.0.0rc2 makes descriptions plaintext by default for security.https://github.com/jupyter-
widgets/ipywidgets/pull/2785
PVE-2022-50463
For more information, please visit https://pyup.io/v/50463/f17
Scan was completed. 2 vulnerabilities were found.
```
**Expected behavior**
A safety check shows no package vulnerabilities.
**Environment**
Python 3.9.16, safety 2.3.5, kepler.gl repo commit fb829922c3d51a5944cb3631fe8a5f6b2f5b5ad0.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in kepler.gl/bindings/kepler.gl-jupyter/ and inspect requirements.txt. Reproduce the report with `safety check --full-report -r requirements.txt`, then update the ipywidgets dependency to version 8 and rerun the check. Done means the safety report shows no package vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- jupyter, python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100