-
Notifications
You must be signed in to change notification settings - Fork 13
v1.6.0 update #395
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
v1.6.0 update #395
Changes from all commits
Commits
Show all changes
13 commits
Select commit
Hold shift + click to select a range
0987518
Script parts of post and pre release steps
FlorentinD 2ce7846
Apply 1.5 post release changes
FlorentinD 9338b07
Format code
FlorentinD 5882bb3
Fix typing issues in release scripts
FlorentinD e31a311
Support GDS 2.0 API
FlorentinD 8d36e19
Expose selection mode in widget
FlorentinD bc16da9
Reduce comments
FlorentinD 8c36c09
Merge pull request #393 from neo4j/gds-206-expose-selection-mode-in-g…
FlorentinD a63a69b
Merge pull request #392 from neo4j/support-gds-2.0
FlorentinD b063645
Expose the selected nodes and relationships
FlorentinD d3df88e
Formate code
FlorentinD bb6b82f
Merge pull request #394 from neo4j/gds-198-expose-selected-nodesrelat…
FlorentinD 1bbbdec
Fix gds tests
FlorentinD File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,14 @@ | ||
| # Changes in 1.5.0 | ||
| # Changes | ||
|
|
||
| ## Breaking changes | ||
|
|
||
| ## New features | ||
|
|
||
| * Add `GraphWidget` methods to change render options in place without re-rendering: `set_layout`, `set_zoom`, `set_pan`, `set_renderer`, and `set_show_layout_button` | ||
| * Add `GraphWidget` methods to change styling in place without re-rendering such as `color_relationships` | ||
| * Added the ability to set the selection mode (gesture) of the `GraphWidget` from Python, via the `selection_mode` render option or the `GraphWidget.set_selection_mode` method. | ||
| * Added the `GraphWidget.selected` trait to read back the IDs of the nodes and relationships selected in the widget UI. Use the `GraphWidget.on_selection_change` method (or `widget.observe`) to react to selection changes. | ||
|
|
||
| ## Bug fixes | ||
|
|
||
| * Warn when relationships reference node ids that are not in the graph. It is configurable via the `on_dangling` parameter (`"warn"` (default), `"error"`, or `"none"`) on `render`, `render_widget`, and `GraphWidget.add_data` | ||
|
|
||
| ## Improvements | ||
|
|
||
| * Support Python 3.14 | ||
| * Support Aura Graph Analytics | ||
| * Support `gds.v2` endpoints | ||
| * Use typed options field in `GraphWidget` | ||
|
|
||
| ## Other changes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,3 +20,6 @@ | |
|
|
||
| .. autoenum:: neo4j_viz.Renderer | ||
| :members: | ||
|
|
||
| .. autoenum:: neo4j_viz.SelectionMode | ||
| :members: | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,6 @@ | ||
| .. autoclass:: neo4j_viz.GraphWidget | ||
| :members: | ||
|
|
||
| .. autoclass:: neo4j_viz.GraphSelection | ||
| :members: | ||
| :exclude-members: model_config |
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| from __future__ import annotations | ||
|
|
||
| import importlib | ||
| import re | ||
| from typing import Any | ||
|
|
||
| from graphdatascience.version import __version__ as _gds_version | ||
|
|
||
|
|
||
| def _parse_major(version: str) -> int: | ||
| match = re.match(r"\s*(\d+)", version) | ||
| return int(match.group(1)) if match else 0 | ||
|
|
||
|
|
||
| IS_GDS_2: bool = _parse_major(_gds_version) >= 2 | ||
|
|
||
| if IS_GDS_2: | ||
| GdsGraph: Any = importlib.import_module("graphdatascience.graph").Graph | ||
| _GRAPH_TYPES: tuple[type, ...] = (GdsGraph,) | ||
| else: | ||
| GdsGraph = importlib.import_module("graphdatascience.graph.v2").GraphV2 | ||
| _GRAPH_TYPES = (GdsGraph, importlib.import_module("graphdatascience").Graph) | ||
|
|
||
|
|
||
| def _check_graph_type(G: Any) -> None: | ||
| """Raise ``TypeError`` unless ``G`` is a graph object accepted by the installed client.""" | ||
| if not isinstance(G, _GRAPH_TYPES): | ||
| accepted = " or ".join(t.__name__ for t in _GRAPH_TYPES) | ||
| raise TypeError(f"`G` must be a GDS graph object ({accepted}), but got {type(G).__name__}") | ||
|
|
||
|
|
||
| def _catalog(gds: Any) -> Any: | ||
| """Return the graph catalog endpoints for either client version.""" | ||
| return gds.graph if IS_GDS_2 else gds.v2.graph | ||
|
|
||
|
|
||
| def _degree_centrality(gds: Any) -> Any: | ||
| """Return the degree centrality endpoints for either client version.""" | ||
| return gds.degree_centrality if IS_GDS_2 else gds.v2.degree_centrality |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
extractions/setup-just@v2uses a movable third-party tag, so a retagged or compromised action could run attacker-controlled code in CI and access Aura credentials.More details about this
Install justpullsextractions/setup-just@v2, which is a moving tag from a third-party GitHub repository rather than a specific commit. If theextractions/setup-justrepo is compromised or itsv2tag is retargeted, this workflow will run the attacker’s code on the runner beforejust py-ci-test-gdsstarts, with access to the job environment includingAURA_API_CLIENT_ID,${{ secrets.AURA_API_CLIENT_SECRET }}, andAURA_API_PROJECT_ID.A plausible attack looks like this:
extractions/setup-justrepository or its release/tag management.v2tag to a new commit that adds a malicious step inside the action.uses: extractions/setup-just@v2, GitHub Actions fetches that new code automatically because the reference is not immutable.AURA_API_CLIENT_SECRET, for example by sending them to an attacker-controlled server.Because the reference is
@v2instead of a full 40-character commit SHA, anyone who can change whatv2points to can change what code your CI executes.To resolve this comment:
✨ Commit fix suggestion
Replace the tag-based action reference with a full 40-character commit SHA in the
usesline.Change
uses: extractions/setup-just@v2touses: extractions/setup-just@<full-commit-sha> # v2.Resolve the SHA from the current
v2release in theextractions/setup-justrepository, and use that exact commit hash instead of the tag.This keeps the workflow on the intended version while making the action immutable.
Keep the version comment after the SHA so future updates are easier to review.
Use the same format as
uses: extractions/setup-just@<full-commit-sha> # v2.Alternatively, if you need to stay aligned with a newer upstream release instead of the current
v2target, pin to the full commit SHA for that newer release and update the trailing comment to match, for example# v3.💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
To get more information about secure coding and some most popular vulnerabilities, check our secure coding guidelines
You can view more details about this finding in the Semgrep AppSec Platform.