Skip to content

Conversation

marekmodry
Copy link
Contributor

@marekmodry marekmodry commented Oct 13, 2021

This PR has been replaced by #1677

Description of proposed changes

This PR bumps up the version upper boundary of networkx from <2.6 to <2.7.

The main reason for bumping the version is the existence of high severity security vulnerability to Deserialization of Untrusted Data in networkx package (fixed in v2.6).

Note:
networkx 2.5.x supports Python >= 3.6, while networkx 2.6.x supports Python >= 3.7. Therefore, when no other constraints are given, networkx 2.5.x is installed when on py36, while networkx 2.6.x is installed when on py3.7.

Historical context:
Originally, snorkel allowed networkx <3.0 until snorkel v0.9.2 (networkx bounds changed to <2.4 by #1492 for backward compatibility reasons). Subsequently, PR #1645 introduced changes improving the compatibility and extended the networkx's version upper bound to <2.6 (this happened before networkx 2.6 was released).

Related issue(s)

Fixes #1673

Test plan

  • tox -e py36 on Python 3.6 with networkx==2.5.1 installed - PASSED
  • tox -e py37 on Python 3.7 with networkx==2.5.1 installed - PASSED
  • tox -e py37 on Python 3.7 with networkx==2.6.3 installed - PASSED

Checklist

Need help on these? Just ask!

  • I have read the CONTRIBUTING document.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • I have run tox -e complex and/or tox -e spark if appropriate.
  • All new and existing tests passed.

@rjurney
Copy link

rjurney commented Oct 14, 2021

@bhancock8 @rsmith49 it would be amazing if we could get this into the next release. All tests pass locally.

@marekmodry marekmodry closed this Oct 14, 2021
@marekmodry
Copy link
Contributor Author

I brought in some commit noise with this PR, so I closed this and replaced by: #1677 (where I rebased the new mypy/CI fix)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

networkx 2.5 has a high priority Snyk vulnerability - upgrade to networkx 2.6
2 participants