3.0.1 (#971)

js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nglview-js-widgets",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "nglview-js-widgets",
   "keywords": [
     "ipython",

nglview/_frontend.py

@@ -1 +1 @@
-__frontend_version__ = '3.0.0'
+__frontend_version__ = '3.0.1'

nglview/static/index.js

@@ -10977,7 +10977,7 @@ return jQuery;
 /* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "n", function() { return nonEnumerableProps; });
 /* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "b", function() { return MAX_ARRAY_INDEX; });
 // Current version.
-var VERSION = '1.12.1';
+var VERSION = '1.13.0';
 
 // Establish the root object, `window` (`self`) in the browser, `global`
 // on the server, or `this` in some virtual machines. We use `self`
@@ -11297,7 +11297,7 @@ if (typeof /./ != 'function' && typeof Int8Array != 'object' && typeof nodelist
 /* 12 */
 /***/ (function(module, exports) {
 
-module.exports = {"name":"nglview-js-widgets","version":"3.0.0","description":"nglview-js-widgets","keywords":["ipython","ipywidgets","jupyter","jupyterlab","jupyterlab-extension","molecular graphics","molecular structure","science","widgets"],"homepage":"https://github.com/nglviewer/nglview/js","bugs":{"url":"https://github.com/nglviewer/nglview/issues"},"license":"MIT","author":{"name":"Alexander Rose, Hai Nguyen","email":"alexander.rose@weirdbyte.de, hainm.comp@gmail.com"},"files":["dist","src","lib","style/index.js"],"main":"lib/index.js","repository":{"type":"git","url":"https://github.com/nglviewer/nglview.git"},"scripts":{"prepublish":"jlpm build:prod && webpack && jlpm run copy:labextension","copy:labextension":"cp -r nglview-js-widgets/labextension/* ../nglview/labextension/","build":"jlpm run build:lib && jlpm run build:labextension:dev","build:prod":"jlpm run build:lib && jlpm run build:labextension","build:labextension":"jupyter labextension build .","build:labextension:dev":"jupyter labextension build --development True .","build:lib":"tsc","clean":"jlpm run clean:lib","clean:lib":"rimraf lib tsconfig.tsbuildinfo","clean:labextension":"rimraf myextension/labextension","clean:all":"jlpm run clean:lib && jlpm run clean:labextension","eslint":"eslint . --ext .ts,.tsx --fix","eslint:check":"eslint . --ext .ts,.tsx","install:extension":"jupyter labextension develop --overwrite .","prepare":"jlpm run clean && jlpm run build:prod","watch":"run-p watch:src watch:labextension","watch:src":"tsc -w","watch:labextension":"jupyter labextension watch .","test":"mocha"},"dependencies":{"@jupyter-widgets/base":"^4.0.0","@jupyter-widgets/jupyterlab-manager":"^3.0.0","jquery":"^3.2.1","jquery-ui":"^1.12.1","lodash":"^4.17.4","ngl":"2.0.0-dev.36","underscore":"^1.8.3"},"devDependencies":{"@jupyterlab/builder":"^3.0.0","@types/chai":"^4.1.4","@types/expect.js":"^0.3.29","@types/mocha":"^2.2.48","@types/node":"^12.0.2","@types/requirejs":"^2.1.31","@typescript-eslint/eslint-plugin":"^4.8.1","@typescript-eslint/parser":"^4.8.1","babel-register":"^6.11.6","css-loader":"^0.23.1","eslint":"^7.14.0","file-loader":"^1.1.6","json-loader":"^0.5.4","mkdirp":"^1.0.3","ngl":"2.0.0-dev.36","npm-run-all":"^4.1.5","prettier":"^2.1.1","rimraf":"^3.0.2","style-loader":"^0.13.1","typescript":"~4.1.3","webpack":"^3.5.5"},"sideEffects":["style/*.css","style/index.js"],"styleModule":"style/index.js","jupyterlab":{"extension":"lib/jupyterlab-plugin","outputDir":"nglview-js-widgets/labextension"},"directories":{"test":"test"}}
+module.exports = {"name":"nglview-js-widgets","version":"3.0.1","description":"nglview-js-widgets","keywords":["ipython","ipywidgets","jupyter","jupyterlab","jupyterlab-extension","molecular graphics","molecular structure","science","widgets"],"homepage":"https://github.com/nglviewer/nglview/js","bugs":{"url":"https://github.com/nglviewer/nglview/issues"},"license":"MIT","author":{"name":"Alexander Rose, Hai Nguyen","email":"alexander.rose@weirdbyte.de, hainm.comp@gmail.com"},"files":["dist","src","lib","style/index.js"],"main":"lib/index.js","repository":{"type":"git","url":"https://github.com/nglviewer/nglview.git"},"scripts":{"prepublish":"jlpm build:prod && webpack && jlpm run copy:labextension","copy:labextension":"cp -r nglview-js-widgets/labextension/* ../nglview/staticlab/","build":"jlpm run build:lib && jlpm run build:labextension:dev","build:prod":"jlpm run build:lib && jlpm run build:labextension","build:labextension":"jupyter labextension build .","build:labextension:dev":"jupyter labextension build --development True .","build:lib":"tsc","clean":"jlpm run clean:lib","clean:lib":"rimraf lib tsconfig.tsbuildinfo","clean:labextension":"rimraf myextension/labextension","clean:all":"jlpm run clean:lib && jlpm run clean:labextension","eslint":"eslint . --ext .ts,.tsx --fix","eslint:check":"eslint . --ext .ts,.tsx","install:extension":"jupyter labextension develop --overwrite .","prepare":"jlpm run clean && jlpm run build:prod","watch":"run-p watch:src watch:labextension","watch:src":"tsc -w","watch:labextension":"jupyter labextension watch .","test":"mocha"},"dependencies":{"@jupyter-widgets/base":"^4.0.0","@jupyter-widgets/jupyterlab-manager":"^3.0.0","jquery":"^3.2.1","jquery-ui":"^1.12.1","lodash":"^4.17.4","ngl":"2.0.0-dev.36","underscore":"^1.8.3"},"devDependencies":{"@jupyterlab/builder":"^3.0.0","@types/chai":"^4.1.4","@types/expect.js":"^0.3.29","@types/mocha":"^2.2.48","@types/node":"^12.0.2","@types/requirejs":"^2.1.31","@typescript-eslint/eslint-plugin":"^4.8.1","@typescript-eslint/parser":"^4.8.1","babel-register":"^6.11.6","css-loader":"^0.23.1","eslint":"^7.14.0","file-loader":"^1.1.6","json-loader":"^0.5.4","mkdirp":"^1.0.3","ngl":"2.0.0-dev.36","npm-run-all":"^4.1.5","prettier":"^2.1.1","rimraf":"^3.0.2","style-loader":"^0.13.1","typescript":"~4.1.3","webpack":"^3.5.5"},"sideEffects":["style/*.css","style/index.js"],"styleModule":"style/index.js","jupyterlab":{"extension":"lib/jupyterlab-plugin","outputDir":"nglview-js-widgets/labextension"},"directories":{"test":"test"}}
 
 /***/ }),
 /* 13 */
@@ -113921,9 +113921,9 @@ Object.defineProperty(__webpack_exports__, "__esModule", { value: true });
 // Named Exports
 // =============
 
-//     Underscore.js 1.12.1
+//     Underscore.js 1.13.0
 //     https://underscorejs.org
-//     (c) 2009-2020 Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
+//     (c) 2009-2021 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud and Investigative Reporters & Editors
 //     Underscore may be freely distributed under the MIT license.
 
 // Baseline setup.
@@ -119861,6 +119861,11 @@ function escapeChar(match) {
   return '\\' + escapes[match];
 }
 
+// In order to prevent third-party code injection through
+// `_.templateSettings.variable`, we test it against the following regular
+// expression. It is intentionally a bit more liberal than just matching valid
+// identifiers, but still prevents possible loopholes through defaults or
+// destructuring assignment.
 var bareIdentifier = /^\s*(\w|\$)+\s*$/;
 
 // JavaScript micro-templating, similar to John Resig's implementation.
@@ -119900,7 +119905,10 @@ function template(text, settings, oldSettings) {
 
   var argument = settings.variable;
   if (argument) {
-    if (!bareIdentifier.test(argument)) throw new Error(argument);
+    // Insure against third-party code injection. (CVE-2021-23358)
+    if (!bareIdentifier.test(argument)) throw new Error(
+      'variable is not a bare identifier: ' + argument
+    );
   } else {
     // If a variable is not specified, place data values in local scope.
     source = 'with(obj||{}){\n' + source + '}\n';

nglview/staticlab/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nglview-js-widgets",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "nglview-js-widgets",
   "keywords": [
     "ipython",
@@ -35,7 +35,7 @@
   },
   "scripts": {
     "prepublish": "jlpm build:prod && webpack && jlpm run copy:labextension",
-    "copy:labextension": "cp -r nglview-js-widgets/labextension/* ../nglview/labextension/",
+    "copy:labextension": "cp -r nglview-js-widgets/labextension/* ../nglview/staticlab/",
     "build": "jlpm run build:lib && jlpm run build:labextension:dev",
     "build:prod": "jlpm run build:lib && jlpm run build:labextension",
     "build:labextension": "jupyter labextension build .",
@@ -95,7 +95,7 @@
     "extension": "lib/jupyterlab-plugin",
     "outputDir": "nglview-js-widgets/labextension",
     "_build": {
-      "load": "static/remoteEntry.e11678c4549ac1e5a714.js",
+      "load": "static/remoteEntry.4560fdad4055be520b35.js",
       "extension": "./extension",
       "style": "./style"
     }