keplergl / keplergl/kepler.gl

[Bug] Safety not passing (ipywidgets <8)

Open
#2,132 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
12k
Forks
2k
Avg merge
1d 5h
Merged PRs (30d)
66

Description

[**Describe the bug**
#1969 reported a `safety check` not passing due to use of ipywidgets <8.0.

I'm not entirely sure why the issue was closed as the vulnerability info is pulled from a vuln database at https://github.com/pyupio/safety-db. The database still shows that versions of ipywidgets < 8.0 are vulnerable; no patches have been released for major release 7.

See https://github.com/pyupio/safety-db/blob/master/data/insecure.json and https://raw.githubusercontent.com/pyupio/safety-db/master/data/insecure_full.json

The solution is to bring in version 8 of ipywidgets.

**To Reproduce**
1. Activate python environment
1. `pip install safety`
1. `cd kepler.gl/bindings/kepler.gl-jupyter/`
1. `safety check --full-report -r requirements.txt`

The report shows:
```
+===================================================================================================================================+
VULNERABILITIES FOUND
+===================================================================================================================================+

-> Vulnerability found in ipywidgets version 7.4.2
Vulnerability ID: 50664
Affected spec: <8.0.0
ADVISORY: Ipywidgets 8.0.0 sanitizes descriptions by default.https://github.com/jupyter-widgets/ipywidgets/pull/2785
PVE-2022-50664
For more information, please visit https://pyup.io/v/50664/f17

-> Vulnerability found in ipywidgets version 7.4.2
Vulnerability ID: 50463
Affected spec: <8.0.0rc2
ADVISORY: Ipywidgets 8.0.0rc2 makes descriptions plaintext by default for security.https://github.com/jupyter-
widgets/ipywidgets/pull/2785
PVE-2022-50463
For more information, please visit https://pyup.io/v/50463/f17

Scan was completed. 2 vulnerabilities were found.
```

**Expected behavior**
A safety check shows no package vulnerabilities.

**Environment**
Python 3.9.16, safety 2.3.5, kepler.gl repo commit fb829922c3d51a5944cb3631fe8a5f6b2f5b5ad0.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in kepler.gl/bindings/kepler.gl-jupyter/ and inspect requirements.txt. Reproduce the report with `safety check --full-report -r requirements.txt`, then update the ipywidgets dependency to version 8 and rerun the check. Done means the safety report shows no package vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
jupyter, python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.