tensorflow / tensorflow/tensorboard
Vendored Bleach package is EOL and out of date
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 7.2k
- Forks
- 1.7k
- Avg merge
- 4d 22h
- Merged PRs (30d)
- 1
Description
Environment information (required)
All released artifacts contain this issue, not specific to a platform or environment.
Issue description
This library relies on bleach as part of its transitive dependencies for HTML sanitizing. bleach is EOL, has been deprecated for the past three years, and is no longer being maintained: https://github.com/mozilla/bleach has the archived status, and some details are included in issue https://github.com/mozilla/bleach/issues/698.
The last release is 6.4.0, updating to that will address some security issues, but there are more recent unpatched issues that also exist with 6.4.0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by locating the dependency declaration and any vendored Bleach code, then inspect how released artifacts include it. Done means the EOL dependency is addressed and the reported security issues are covered without breaking HTML sanitizing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100