Vendored Bleach package is EOL and out of date
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
No file, test, or entry point is named. Start by locating the dependency declaration and any vendored Bleach code, then inspect how released artifacts include it. Done means the EOL dependency is addressed and the reported security issues are covered without breaking HTML sanitizing.
Written by the indexing model from the issue text.
Description
Environment information (required)
All released artifacts contain this issue, not specific to a platform or environment.
Issue description
This library relies on bleach as part of its transitive dependencies for HTML sanitizing. bleach is EOL, has been deprecated for the past three years, and is no longer being maintained: https://github.com/mozilla/bleach has the archived status, and some details are included in issue https://github.com/mozilla/bleach/issues/698.
The last release is 6.4.0, updating to that will address some security issues, but there are more recent unpatched issues that also exist with 6.4.0.
- Dominant language
- TypeScript
- Stars
- 7.2k
- Forks
- 1.7k
- Avg merge
- 4d 22h
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from tensorflow/tensorboard
-
node_repositories in WORKSPACE missing linux_ppc64le and linux_s390x entries for Node.js 18.20.8 Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
tensorflow/tensorboard#7140 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
tensorflow/tensorboard#7137 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
tensorflow/tensorboard#7119 ·
-
Issue: TensorBoard wheels on PyPI fail with setuptools >81 due to deprecated pkg_resources removal Open
Difficulty 4/5 3-5 days Newbie friendliness 35/100
tensorflow/tensorboard#7107 · 2 comments · 7 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
tensorflow/tensorboard#7100 ·
All issues in tensorflow/tensorboard
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·