Bump bokeh from 2.4.3 to 3.8.2 in /python #59952
Conversation
Bumps [bokeh](https://github.com/bokeh/bokeh) from 2.4.3 to 3.8.2. - [Changelog](https://github.com/bokeh/bokeh/blob/3.8.2/docs/CHANGELOG) - [Commits](bokeh/bokeh@2.4.3...3.8.2) --- updated-dependencies: - dependency-name: bokeh dependency-version: 3.8.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| bleach==6.1.0 | ||
| # via nbconvert | ||
| bokeh==2.4.3 ; python_version < "3.12" | ||
| bokeh==3.8.2 ; python_version < "3.12" |
There was a problem hiding this comment.
Source and compiled requirements files are inconsistent
Medium Severity
The PR updates bokeh to 3.8.2 in requirements_compiled.txt but leaves bokeh==2.4.3 in the source file python/requirements/ml/data-requirements.txt. This inconsistency means that regenerating the compiled requirements or installing from the source file directly would result in the old, vulnerable version being installed. The security fix for incomplete WebSocket origin validation (#14768) would be ineffective when using the source requirements file.
🔬 Verification Test
Test code:
# Check source requirements file
grep "bokeh" python/requirements/ml/data-requirements.txt
# Check compiled requirements file
grep "bokeh==" python/requirements_compiled.txtCommand run:
grep "bokeh" python/requirements/ml/data-requirements.txt && grep "bokeh==" python/requirements_compiled.txt
Output:
bokeh==2.4.3; python_version < '3.12'
bokeh==3.8.2 ; python_version < "3.12"
Why this proves the bug: The output shows that the source file data-requirements.txt specifies version 2.4.3 while the compiled file specifies version 3.8.2, confirming the version mismatch between source and compiled requirements.
ray-gardener
bot
added
tune
|
This pull request has been automatically marked as stale because it has not had You can always ask for help on our discussion forum or Ray's public slack channel. If you'd like to keep this open, just leave any comment, and the stale label will be removed. |
github-actions
bot
added
the
stale
Bumps bokeh from 2.4.3 to 3.8.2.
Changelog
Sourced from bokeh's changelog.
... (truncated)
Commits
e5ce879Deployment updates for release 3.8.22b3ee10Don't validate npm credentials due to OICD limitations in npm (#14769)756e3aeMigrate from NPM tokens to trusted providers for publishing in CI (#14766)2f225a1Update dependencies in build environment (#14758)69d197cupdate switcher.jsond915c8bupdate to latest ruff (#14661)5f9f7b6update release notescedd113handle wildcard host with port correctlya961ab7small CI fixes for advisory fork merged62939aMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.