Bump vulnerable transitive npm dependencies to patched versions (#944)

* Bump vulnerable transitive npm dependencies to patched versions

- minimatch 9.0.3 → 9.0.7 (ReDoS, CVE)
- picomatch 2.3.1 → 2.3.2 (ReDoS)
- picomatch 4.0.3 → 4.0.4 (ReDoS)
- yaml 1.10.2 → 1.10.3 (stack overflow via deeply nested collections)
- yaml 2.8.2 → 2.8.3 (stack overflow via deeply nested collections)

Addresses Dependabot alerts #148, #158, #159, #160, #161, #162.

* Skip R loader test when rpy2 is incompatible with installed R version

Recent rpy2 releases require R >= 4.1 (R_existsVarInFrame) / R >= 4.2
(R_getVar), but the CircleCI Ubuntu 20.04 images ship with R 3.6.3.
The existing guard (pytest.importorskip) only skips when rpy2 is not
installed, not when it is installed but incompatible with the R runtime.
Add a lightweight import check so the test is skipped gracefully in that
environment rather than erroring.

* Install R from CRAN rather than Ubuntu apt default

The Ubuntu 20.04 apt default (R 3.6.3) is incompatible with recent rpy2
releases which require R >= 4.1. Add the official CRAN Ubuntu repository
so all Python version builds get R 4.x. Uses lsb_release to pick the
correct codename (focal/jammy/noble) dynamically.

* Fix hanging 'Install R' CI step by avoiding interactive add-apt-repository

Replace `add-apt-repository` (which prompts for [ENTER]) with a direct
non-interactive write to sources.list.d. Also removes the now-unnecessary
apt update/upgrade and software-properties-common install.

* Unpin dash, dash-bootstrap-components, and dash_daq

- dash: unpinned for python > 3.7 (was <=2.18.2)
- dash-bootstrap-components: unpinned for python > 3.0 (was <=1.7.1)
- dash_daq: unpinned entirely (was <=0.5.0)

* Fix dash_daq pin and werkzeug version detection for package updates

- Pin dash_daq<=0.5.0 to avoid breakage with newer versions
- Fix werkzeug.__version__ AttributeError in test_shutdown by falling
  back to importlib.metadata for newer werkzeug versions

* Replace dash_daq with dbc.Switch and dbc.Input for Python 3+

dash_daq is incompatible with dash 4.x (removed component_loader).
Replace BooleanSwitch with dbc.Switch and NumericInput with
dbc.Input(type="number") for Python 3+, keeping dash_daq only for
Python 2.7. Add switch.css to fix Bootstrap 4/5 style collisions.

* Bump serialize-javascript to 7.0.5 and add handlebars 4.7.9 resolution

- Bump serialize-javascript from 7.0.4 to 7.0.5 to fix CPU exhaustion DoS
- Add handlebars 4.7.9 yarn resolution to fix JS injection via AST type
  confusion (CVE-2026-33937) and related vulnerabilities

Author: aschonfeld

.circleci/config.yml

@@ -145,8 +145,9 @@ python: &python
       - run:
           name: Install R
           command: |
+            wget -qO- https://cloud.r-project.org/bin/linux/ubuntu/marutter_pubkey.asc | sudo tee /etc/apt/trusted.gpg.d/cran_ubuntu_key.asc
+            echo "deb https://cloud.r-project.org/bin/linux/ubuntu $(lsb_release -cs)-cran40/" | sudo tee /etc/apt/sources.list.d/cran-r.list
             sudo apt update
-            sudo apt -y upgrade
             sudo apt -y install r-base
             if [ "${CIRCLE_JOB}" == "build_3_14" ]; then
               sudo apt -y install libtirpc-dev

dtale/dash_application/drilldown_modal.py

@@ -12,6 +12,7 @@
     chart_builder_passthru,
 )
 from dtale.dash_application.exceptions import DtalePreventUpdate
+from dtale.dash_application.layout.layout import boolean_switch_prop
 from dtale.dash_application.layout.utils import (
     build_cols,
     build_option,
@@ -345,7 +346,7 @@ def load_drilldown_content(
             [
                 State("drilldown-modal-{}".format(i), "is_open"),
                 State("input-data", "data"),
-                State("drilldown-toggle", "on"),
+                State("drilldown-toggle", boolean_switch_prop()),
             ],
         )(toggle_modal)
         dash_app.callback(
@@ -360,7 +361,7 @@ def load_drilldown_content(
                 State("yaxis-data", "data"),
                 State("map-input-data", "data"),
                 State("chart-click-data-{}".format(i), "data"),
-                State("drilldown-toggle", "on"),
+                State("drilldown-toggle", boolean_switch_prop()),
             ],
         )(update_click_data)
         dash_app.callback(
@@ -392,6 +393,6 @@ def load_drilldown_content(
                 State("yaxis-data", "data"),
                 State("map-input-data", "data"),
                 State("chart-click-data-{}".format(i), "data"),
-                State("drilldown-toggle", "on"),
+                State("drilldown-toggle", boolean_switch_prop()),
             ],
         )(load_drilldown_content)

dtale/dash_application/layout/layout.py

@@ -1,11 +1,13 @@
 import json
 
 import dash_bootstrap_components as dbc
-import dash_daq as daq
 import os
 import plotly
 from six import PY3
 
+if not PY3:
+    import dash_daq as daq
+
 from dtale.dash_application import dcc, html
 import dtale.dash_application.components as dash_components
 import dtale.dash_application.custom_geojson as custom_geojson
@@ -924,6 +926,21 @@ def bootstrap_checkbox_prop():
     return "checked"
 
 
+def boolean_switch_prop():
+    if parse_version(dbc.__version__) >= parse_version("1.0.0"):
+        return "value"
+    return "on"
+
+
+def build_boolean_switch(switch_id, on, color=None):
+    if parse_version(dbc.__version__) >= parse_version("1.0.0"):
+        return dbc.Switch(id=switch_id, value=on)
+    kwargs = {"id": switch_id, "on": on}
+    if color is not None:
+        kwargs["color"] = color
+    return daq.BooleanSwitch(**kwargs)
+
+
 def build_dropna(dropna, prop=None):
     if PY3:
         checkbox_kwargs = dict(
@@ -1031,7 +1048,7 @@ def build_funnel_inputs(inputs, df, group_options):
     stacked_toggle = build_input(
         "{}?".format(text("Stack")),
         html.Div(
-            daq.BooleanSwitch(id="funnel-stack-toggle", on=False),
+            build_boolean_switch("funnel-stack-toggle", False),
             className="toggle-wrapper",
         ),
         id="funnel-stack-input",
@@ -2330,9 +2347,7 @@ def show_map_style(show):
                                 build_input(
                                     text("Drilldowns"),
                                     html.Div(
-                                        daq.BooleanSwitch(
-                                            id="drilldown-toggle", on=False
-                                        ),
+                                        build_boolean_switch("drilldown-toggle", False),
                                         className="toggle-wrapper",
                                     ),
                                     id="drilldown-input",
@@ -2412,8 +2427,9 @@ def show_map_style(show):
                         build_input(
                             text("Bins"),
                             [
-                                daq.NumericInput(
+                                dbc.Input(
                                     id="bins-val-input",
+                                    type="number",
                                     min=1,
                                     max=30,
                                     value=inputs.get("bins_val") or 5,
@@ -2481,9 +2497,7 @@ def show_map_style(show):
                 build_input(
                     text("Chart Per\nGroup"),
                     html.Div(
-                        daq.BooleanSwitch(
-                            id="cpg-toggle", on=inputs.get("cpg") or False
-                        ),
+                        build_boolean_switch("cpg-toggle", inputs.get("cpg") or False),
                         className="toggle-wrapper",
                     ),
                     id="cpg-input",
@@ -2493,9 +2507,7 @@ def show_map_style(show):
                 build_input(
                     text("Chart Per\nY"),
                     html.Div(
-                        daq.BooleanSwitch(
-                            id="cpy-toggle", on=inputs.get("cpy") or False
-                        ),
+                        build_boolean_switch("cpy-toggle", inputs.get("cpy") or False),
                         className="toggle-wrapper",
                     ),
                     id="cpy-input",
@@ -2618,8 +2630,8 @@ def show_map_style(show):
                 build_input(
                     text("Animate"),
                     html.Div(
-                        daq.BooleanSwitch(
-                            id="animate-toggle", on=inputs.get("animate") or False
+                        build_boolean_switch(
+                            "animate-toggle", inputs.get("animate") or False
                         ),
                         className="toggle-wrapper",
                     ),
@@ -2652,9 +2664,7 @@ def show_map_style(show):
                         top="120%",
                     ),
                     html.Div(
-                        daq.BooleanSwitch(
-                            id="auto-load-toggle", on=True, color="green"
-                        ),
+                        build_boolean_switch("auto-load-toggle", True, color="green"),
                         className="toggle-wrapper",
                     ),
                     id="auto-load-input",

dtale/dash_application/views.py

@@ -47,6 +47,7 @@
     show_input_handler,
     show_yaxis_ranges,
     bootstrap_checkbox_prop,
+    boolean_switch_prop,
     get_num_cols,
 )
 from dtale.dash_application.layout.utils import show_style
@@ -66,11 +67,14 @@ class DtaleDash(dash.Dash):
 
     def __init__(self, *args, **kwargs):
         server = kwargs.get("server")
-        kwargs["external_stylesheets"] = [
+        stylesheets = [
             "/dtale/static/css/main.css",
             "/dtale/static/css/dash.css",
             "/dtale/static/css/github_fork.css",
         ]
+        if PY3:
+            stylesheets.append("/dtale/static/css/switch.css")
+        kwargs["external_stylesheets"] = stylesheets
         kwargs["external_scripts"] = [
             "/dtale/static/dash/components_bundle.js",
             "/dtale/static/dash/custom_bundle.js",
@@ -781,7 +785,7 @@ def histogram_data_callback(
             Input("funnel-label-dropdown", "value"),
             Input("funnel-group-dropdown", "value"),
             Input("funnel-dropna-checkbox", bootstrap_checkbox_prop()),
-            Input("funnel-stack-toggle", "on"),
+            Input("funnel-stack-toggle", boolean_switch_prop()),
         ],
         [State("data-tabs", "value")],
     )(funnel_callback)
@@ -868,13 +872,13 @@ def input_toggles(_ts, inputs, pathname):
     @dash_app.callback(
         Output("chart-input-data", "data"),
         [
-            Input("cpg-toggle", "on"),
-            Input("cpy-toggle", "on"),
+            Input("cpg-toggle", boolean_switch_prop()),
+            Input("cpy-toggle", boolean_switch_prop()),
             Input("barmode-dropdown", "value"),
             Input("barsort-dropdown", "value"),
             Input("top-bars", "value"),
             Input("colorscale-picker", "colorscale"),
-            Input("animate-toggle", "on"),
+            Input("animate-toggle", boolean_switch_prop()),
             Input("animate-by-dropdown", "value"),
             Input("trendline-dropdown", "value"),
             Input("yaxis-scale", "value"),
@@ -911,7 +915,9 @@ def chart_input_data(
             scale=scale,
         )
 
-    @dash_app.callback(Output("load-btn", "style"), [Input("auto-load-toggle", "on")])
+    @dash_app.callback(
+        Output("load-btn", "style"), [Input("auto-load-toggle", boolean_switch_prop())]
+    )
     def load_style(auto_load):
         return dict(display="block" if not auto_load else "none")
 
@@ -987,7 +993,7 @@ def collapse_cleaners_input(n, is_open):
             State("pareto-input-data", "data"),
             State("histogram-input-data", "data"),
             State("last-chart-input-data", "data"),
-            State("auto-load-toggle", "on"),
+            State("auto-load-toggle", boolean_switch_prop()),
             State("load-clicks", "data"),
             State("extended-aggregations", "data"),
         ],

dtale/static/css/switch.css

@@ -0,0 +1,66 @@
+/*
+ * Bootstrap 5 Switch overrides for dtale toggle-wrappers.
+ * Fixes conflicts between Bootstrap 4 .form-check-input rules in main.css
+ * and Bootstrap 5's .form-switch component used by dbc.Switch.
+ */
+
+/* Reset the form-check container within toggle-wrapper */
+.toggle-wrapper .form-check.form-switch {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding-left: 0;
+    margin-bottom: 0;
+    min-height: auto;
+    height: 100%;
+}
+
+/* Override BS4 .form-check-input { position: absolute } from main.css */
+.toggle-wrapper .form-check.form-switch .form-check-input {
+    position: relative;
+    float: none;
+    flex-shrink: 0;
+    width: 2em;
+    height: 1em;
+    margin-left: 0;
+    margin-top: 0;
+    vertical-align: top;
+    appearance: none;
+    -webkit-appearance: none;
+    background-color: #fff;
+    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='rgba%280, 0, 0, 0.25%29'/%3e%3c/svg%3e");
+    background-repeat: no-repeat;
+    background-position: left center;
+    background-size: contain;
+    border: 1px solid #dee2e6;
+    border-radius: 2em;
+    cursor: pointer;
+    transition: background-position 0.15s ease-in-out;
+    print-color-adjust: exact;
+}
+
+.toggle-wrapper .form-check.form-switch .form-check-input:checked {
+    background-color: #0d6efd;
+    border-color: #0d6efd;
+    background-position: right center;
+    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='%23fff'/%3e%3c/svg%3e");
+}
+
+.toggle-wrapper .form-check.form-switch .form-check-input:focus {
+    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='%2386b7fe'/%3e%3c/svg%3e");
+    border-color: #86b7fe;
+    outline: 0;
+    box-shadow: 0 0 0 0.25rem rgba(13, 110, 253, 0.25);
+}
+
+.toggle-wrapper .form-check.form-switch .form-check-input:disabled {
+    pointer-events: none;
+    filter: none;
+    opacity: 0.5;
+}
+
+/* Hide the empty label generated by dbc.Switch */
+.toggle-wrapper .form-check.form-switch .form-check-label {
+    padding-left: 0;
+    display: none;
+}

frontend/package.json

@@ -107,7 +107,7 @@
     "resolve": "1.22.11",
     "sass": "1.98.0",
     "sass-loader": "16.0.7",
-    "serialize-javascript": "7.0.4",
+    "serialize-javascript": "7.0.5",
     "style-loader": "4.0.0",
     "terser": "5.46.0",
     "terser-webpack-plugin": "5.4.0",
@@ -179,6 +179,7 @@
     "d3-color": "3.1.0",
     "lodash": "4.17.23",
     "lodash-es": "4.17.23",
-    "micromatch": "4.0.8"
+    "micromatch": "4.0.8",
+    "handlebars": "4.7.9"
   }
 }