Bump version upper bound of networkx to 2.7 #1677
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5 tasks
|
@rsmith49 I believe this PR is ready for review. The CI pipeline is failing but given also other PRs and failing pipeline runs it seems that there some pipeline issues. Please, see the description for the list of tests I ran. I appreciate any suggestions for further testing or changes. Thanks! |
|
@marekmodry thank you for getting this PR up! Like I commented on the original issue, we are currently looking into the problems with CI failures. I will update you when that has been resolved |
rsmith49
approved these changes
Nov 18, 2021
|
Awesome! We’re hiring a Weakly Supervised Learning Engineer and will make more contributions in the next quarter :) |
|
Thanks @rsmith49 and @bhancock8 ! |
akode
pushed a commit
to akode/snorkel
that referenced
this pull request
Jun 10, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of proposed changes
This PR bumps up the version upper boundary of networkx from
<2.6to<2.7.The main reason for bumping the version is the existence of high severity security vulnerability to Deserialization of Untrusted Data in networkx package (present in networkx <= 2.5.x and fixed in v2.6).
Note:
networkx 2.5.x supports Python >= 3.6, while networkx 2.6.x supports Python >= 3.7. Therefore, when no other constraints are given, networkx 2.5.x is installed when on py36, while networkx 2.6.x is installed when on py3.7.
Historical context:
Originally, snorkel allowed networkx
<3.0until snorkelv0.9.2(networkx bounds changed to<2.4by #1492 for backward compatibility reasons). Subsequently, PR #1645 introduced changes improving the compatibility and extended the networkx's version upper bound to<2.6(this happened before networkx 2.6 was released).Related issue(s)
Fixes #1673
Test plan
My testing locally and its results:
tox -e py36on Python 3.6 withnetworkx==2.5.1installed - PASSEDtox -e py37on Python 3.7 withnetworkx==2.5.1installed - PASSEDtox -e py37on Python 3.7 withnetworkx==2.6.3installed - PASSEDtox -e typePASSED (after the recent PR, that pins mypy version to 720 again)tox -e sparkPASSEDtox -e complexPASSEDChecklist
Need help on these? Just ask!
tox -e complexand/ortox -e sparkif appropriate.