OSS vulnerabilities found in ansys-fluent-core and ansys-fluent-visualization package

[sraipurkar]

🐞 Description

We ran an OSS scan for one of the solution in which we are using ansys-fluent-core and ansys-fluent-visualization package. In the scan report we found some critical and high vulnerabilities. A detailed vulnerability report has been attached.

Report Summary :

**1. ansys-fluent-core --> Critical : 1 & High: 2

2. ansys-fluent-visualization --> Critical : 1 & High: 3**

-ansys-fluent-core    -h5py (vulnerabilities)

-ansys-fluent-vizualization     -pyvista         -pillow (vulnerabilities)         -vtk (vulnerabilities)

📝 Steps to reproduce

Scan for all the dependencies used in ansys-fluent-core and ansys-fluent-visualization package using OSS software (revenera | code insight).

💻 Which operating system are you using?

Windows

📀 Which ANSYS version are you using?

ansys-fluent-core == 0.12.5 ansys-fluent-visualization == 0.6.0

🐍 Which Python version are you using?

3.8

📦 Installed packages

- <Solution>
  - ansys-fluent-core [required: >=0.12.3,<0.13.0, installed: 0.12.5]
    - ansys-api-fluent [required: ==0.3.5, installed: 0.3.5]
      - grpcio [required: ~=1.30, installed: 1.47.0]
        - six [required: >=1.5.2, installed: 1.16.0]
      - protobuf [required: ~=3.20, installed: 3.20.3]
    - ansys-platform-instancemanagement [required: ~=1.0, installed: 1.0.3]
      - ansys-api-platform-instancemanagement [required: >=1.0.0b3, installed: 1.0.0b3]
        - googleapis-common-protos [required: Any, installed: 1.59.0]
          - protobuf [required: >=3.19.5,<5.0.0dev,!=4.21.5,!=4.21.4,!=4.21.3,!=4.21.2,!=4.21.1,!=3.20.1,!=3.20.0, installed: 3.20.3]
        - grpcio [required: Any, installed: 1.47.0]
          - six [required: >=1.5.2, installed: 1.16.0]
        - protobuf [required: ~=3.13, installed: 3.20.3]
        - protoc-gen-swagger [required: Any, installed: 0.1.0]
          - protobuf [required: >=3.0.0, installed: 3.20.3]
      - importlib-metadata [required: >=4.0, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
    - appdirs [required: >=1.4.0, installed: 1.4.4]
    - grpcio [required: >=1.30.0, installed: 1.47.0]
      - six [required: >=1.5.2, installed: 1.16.0]
    - h5py [required: >=3.7.0, installed: 3.8.0]
      - numpy [required: >=1.14.5, installed: 1.21.6]
    - numpy [required: >=1.21.5, installed: 1.21.6]
    - pandas [required: >=1.1.5, installed: 1.1.5]
      - numpy [required: >=1.15.4, installed: 1.21.6]
      - python-dateutil [required: >=2.7.3, installed: 2.8.2]
        - six [required: >=1.5, installed: 1.16.0]
      - pytz [required: >=2017.2, installed: 2023.3]
  - ansys-fluent-visualization [required: >=0.6.0,<0.7.0, installed: 0.6.0]
    - ansys-fluent-core [required: >=0.12.dev5,<1.0, installed: 0.12.5]
      - ansys-api-fluent [required: ==0.3.5, installed: 0.3.5]
        - grpcio [required: ~=1.30, installed: 1.47.0]
          - six [required: >=1.5.2, installed: 1.16.0]
        - protobuf [required: ~=3.20, installed: 3.20.3]
      - ansys-platform-instancemanagement [required: ~=1.0, installed: 1.0.3]
        - ansys-api-platform-instancemanagement [required: >=1.0.0b3, installed: 1.0.0b3]
          - googleapis-common-protos [required: Any, installed: 1.59.0]
            - protobuf [required: >=3.19.5,<5.0.0dev,!=4.21.5,!=4.21.4,!=4.21.3,!=4.21.2,!=4.21.1,!=3.20.1,!=3.20.0, installed: 3.20.3]
          - grpcio [required: Any, installed: 1.47.0]
            - six [required: >=1.5.2, installed: 1.16.0]
          - protobuf [required: ~=3.13, installed: 3.20.3]
          - protoc-gen-swagger [required: Any, installed: 0.1.0]
            - protobuf [required: >=3.0.0, installed: 3.20.3]
        - importlib-metadata [required: >=4.0, installed: 4.13.0]
          - zipp [required: >=0.5, installed: 3.15.0]
      - appdirs [required: >=1.4.0, installed: 1.4.4]
      - grpcio [required: >=1.30.0, installed: 1.47.0]
        - six [required: >=1.5.2, installed: 1.16.0]
      - h5py [required: >=3.7.0, installed: 3.8.0]
        - numpy [required: >=1.14.5, installed: 1.21.6]
      - numpy [required: >=1.21.5, installed: 1.21.6]
      - pandas [required: >=1.1.5, installed: 1.1.5]
        - numpy [required: >=1.15.4, installed: 1.21.6]
        - python-dateutil [required: >=2.7.3, installed: 2.8.2]
          - six [required: >=1.5, installed: 1.16.0]
        - pytz [required: >=2017.2, installed: 2023.3]
    - matplotlib [required: >=3.5.1, installed: 3.5.3]
      - cycler [required: >=0.10, installed: 0.11.0]
      - fonttools [required: >=4.22.0, installed: 4.38.0]
      - kiwisolver [required: >=1.0.1, installed: 1.4.4]
      - numpy [required: >=1.17, installed: 1.21.6]
      - packaging [required: >=20.0, installed: 23.0]
      - pillow [required: >=6.2.0, installed: 9.5.0]
      - pyparsing [required: >=2.2.1, installed: 3.0.9]
      - python-dateutil [required: >=2.7, installed: 2.8.2]
        - six [required: >=1.5, installed: 1.16.0]
    - pyside6 [required: >=6.2.3, installed: 6.5.0]
      - PySide6-Addons [required: ==6.5.0, installed: 6.5.0]
        - PySide6-Essentials [required: ==6.5.0, installed: 6.5.0]
          - shiboken6 [required: ==6.5.0, installed: 6.5.0]
        - shiboken6 [required: ==6.5.0, installed: 6.5.0]
      - PySide6-Essentials [required: ==6.5.0, installed: 6.5.0]
        - shiboken6 [required: ==6.5.0, installed: 6.5.0]
      - shiboken6 [required: ==6.5.0, installed: 6.5.0]
    - pyvista [required: >=0.33.2, installed: 0.38.5]
      - imageio [required: Any, installed: 2.27.0]
        - numpy [required: Any, installed: 1.21.6]
        - pillow [required: >=8.3.2, installed: 9.5.0]
      - numpy [required: Any, installed: 1.21.6]
      - pillow [required: Any, installed: 9.5.0]
      - pooch [required: Any, installed: 1.7.0]
        - packaging [required: >=20.0, installed: 23.0]
        - platformdirs [required: >=2.5.0, installed: 3.2.0]
        - requests [required: >=2.19.0, installed: 2.28.2]
          - certifi [required: >=2017.4.17, installed: 2022.12.7]
          - charset-normalizer [required: >=2,<4, installed: 3.1.0]
          - idna [required: >=2.5,<4, installed: 3.4]
          - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
      - scooby [required: >=0.5.1, installed: 0.7.1]
      - vtk [required: Any, installed: 9.2.6]
        - matplotlib [required: >=2.0.0, installed: 3.5.3]
          - cycler [required: >=0.10, installed: 0.11.0]
          - fonttools [required: >=4.22.0, installed: 4.38.0]
          - kiwisolver [required: >=1.0.1, installed: 1.4.4]
          - numpy [required: >=1.17, installed: 1.21.6]
          - packaging [required: >=20.0, installed: 23.0]
          - pillow [required: >=6.2.0, installed: 9.5.0]
          - pyparsing [required: >=2.2.1, installed: 3.0.9]
          - python-dateutil [required: >=2.7, installed: 2.8.2]
            - six [required: >=1.5, installed: 1.16.0]
    - pyvistaqt [required: >=0.7.0, installed: 0.10.0]
      - importlib-resources [required: >=5.10.2, installed: 5.12.0]
        - zipp [required: >=3.1.0, installed: 3.15.0]
      - pyvista [required: >=0.32.0, installed: 0.38.5]
        - imageio [required: Any, installed: 2.27.0]
          - numpy [required: Any, installed: 1.21.6]
          - pillow [required: >=8.3.2, installed: 9.5.0]
        - numpy [required: Any, installed: 1.21.6]
        - pillow [required: Any, installed: 9.5.0]
        - pooch [required: Any, installed: 1.7.0]
          - packaging [required: >=20.0, installed: 23.0]
          - platformdirs [required: >=2.5.0, installed: 3.2.0]
          - requests [required: >=2.19.0, installed: 2.28.2]
            - certifi [required: >=2017.4.17, installed: 2022.12.7]
            - charset-normalizer [required: >=2,<4, installed: 3.1.0]
            - idna [required: >=2.5,<4, installed: 3.4]
            - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
        - scooby [required: >=0.5.1, installed: 0.7.1]
        - vtk [required: Any, installed: 9.2.6]
          - matplotlib [required: >=2.0.0, installed: 3.5.3]
            - cycler [required: >=0.10, installed: 0.11.0]
            - fonttools [required: >=4.22.0, installed: 4.38.0]
            - kiwisolver [required: >=1.0.1, installed: 1.4.4]
            - numpy [required: >=1.17, installed: 1.21.6]
            - packaging [required: >=20.0, installed: 23.0]
            - pillow [required: >=6.2.0, installed: 9.5.0]
            - pyparsing [required: >=2.2.1, installed: 3.0.9]
            - python-dateutil [required: >=2.7, installed: 2.8.2]
              - six [required: >=1.5, installed: 1.16.0]
      - QtPy [required: >=1.9.0, installed: 2.3.1]
        - packaging [required: Any, installed: 23.0]
    - vtk [required: >=9.0.3, installed: 9.2.6]
      - matplotlib [required: >=2.0.0, installed: 3.5.3]
        - cycler [required: >=0.10, installed: 0.11.0]
        - fonttools [required: >=4.22.0, installed: 4.38.0]
        - kiwisolver [required: >=1.0.1, installed: 1.4.4]
        - numpy [required: >=1.17, installed: 1.21.6]
        - packaging [required: >=20.0, installed: 23.0]
        - pillow [required: >=6.2.0, installed: 9.5.0]
        - pyparsing [required: >=2.2.1, installed: 3.0.9]
        - python-dateutil [required: >=2.7, installed: 2.8.2]
          - six [required: >=1.5, installed: 1.16.0]
  - ansys-saf-glow [required: ==0.1.6, installed: 0.1.6]
    - aiofiles [required: >=22.1.0,<23.0.0, installed: 22.1.0]
    - ansys-platform-instancemanagement [required: >=1.0.2,<2.0.0, installed: 1.0.3]
      - ansys-api-platform-instancemanagement [required: >=1.0.0b3, installed: 1.0.0b3]
        - googleapis-common-protos [required: Any, installed: 1.59.0]
          - protobuf [required: >=3.19.5,<5.0.0dev,!=4.21.5,!=4.21.4,!=4.21.3,!=4.21.2,!=4.21.1,!=3.20.1,!=3.20.0, installed: 3.20.3]
        - grpcio [required: Any, installed: 1.47.0]
          - six [required: >=1.5.2, installed: 1.16.0]
        - protobuf [required: ~=3.13, installed: 3.20.3]
        - protoc-gen-swagger [required: Any, installed: 0.1.0]
          - protobuf [required: >=3.0.0, installed: 3.20.3]
      - importlib-metadata [required: >=4.0, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
    - cefpython3 [required: >=66.1,<67.0, installed: 66.1]
    - cookiecutter [required: >=2.1.1,<3.0.0, installed: 2.1.1]
      - binaryornot [required: >=0.4.4, installed: 0.4.4]
        - chardet [required: >=3.0.2, installed: 5.1.0]
      - click [required: >=7.0,<9.0.0, installed: 8.1.3]
        - colorama [required: Any, installed: 0.4.6]
      - Jinja2 [required: >=2.7,<4.0.0, installed: 3.1.2]
        - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - jinja2-time [required: >=0.2.0, installed: 0.2.0]
        - arrow [required: Any, installed: 1.2.3]
          - python-dateutil [required: >=2.7.0, installed: 2.8.2]
            - six [required: >=1.5, installed: 1.16.0]
        - jinja2 [required: Any, installed: 3.1.2]
          - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - python-slugify [required: >=4.0.0, installed: 8.0.1]
        - text-unidecode [required: >=1.3, installed: 1.3]
      - pyyaml [required: >=5.3.1, installed: 6.0]
      - requests [required: >=2.23.0, installed: 2.28.2]
        - certifi [required: >=2017.4.17, installed: 2022.12.7]
        - charset-normalizer [required: >=2,<4, installed: 3.1.0]
        - idna [required: >=2.5,<4, installed: 3.4]
        - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - debugpy [required: >=1.6.3,<2.0.0, installed: 1.6.7]
    - fastapi [required: >=0.86.0,<0.87.0, installed: 0.86.0]
      - pydantic [required: >=1.6.2,<2.0.0,!=1.8.1,!=1.8,!=1.7.3,!=1.7.2,!=1.7.1,!=1.7, installed: 1.10.7]
        - typing-extensions [required: >=4.2.0, installed: 4.5.0]
      - starlette [required: ==0.20.4, installed: 0.20.4]
        - anyio [required: >=3.4.0,<5, installed: 3.6.2]
          - idna [required: >=2.8, installed: 3.4]
          - sniffio [required: >=1.1, installed: 1.3.0]
        - typing-extensions [required: >=3.10.0, installed: 4.5.0]
    - googleapis-common-protos [required: >=1.52.0,<2.0.0, installed: 1.59.0]
      - protobuf [required: >=3.19.5,<5.0.0dev,!=4.21.5,!=4.21.4,!=4.21.3,!=4.21.2,!=4.21.1,!=3.20.1,!=3.20.0, installed: 3.20.3]
    - grpcio [required: <=1.47.0, installed: 1.47.0]
      - six [required: >=1.5.2, installed: 1.16.0]
    - grpcio-health-checking [required: <=1.24.0, installed: 1.24.0]
      - grpcio [required: >=1.24.0, installed: 1.47.0]
        - six [required: >=1.5.2, installed: 1.16.0]
      - protobuf [required: >=3.6.0, installed: 3.20.3]
    - networkx [required: >=2.6,<3.0, installed: 2.6.3]
    - protobuf [required: >=3,<4, installed: 3.20.3]
    - psutil [required: >=5.9.4,<6.0.0, installed: 5.9.4]
    - pyshortcuts [required: >=1.8.2,<2.0.0, installed: 1.8.3]
      - pywin32 [required: Any, installed: 306]
    - python-multipart [required: >=0.0.5,<0.0.6, installed: 0.0.5]
      - six [required: >=1.4.0, installed: 1.16.0]
    - pywebview [required: >=3.7,<4.0, installed: 3.7.2]
      - proxy-tools [required: Any, installed: 0.1.0]
      - pythonnet [required: Any, installed: 3.0.1]
        - clr-loader [required: >=0.2.2,<0.3.0, installed: 0.2.5]
          - cffi [required: >=1.13, installed: 1.15.1]
            - pycparser [required: Any, installed: 2.21]
    - requests [required: >=2.28,<3.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - toml [required: Any, installed: 0.10.2]
    - tox [required: Any, installed: 3.28.0]
      - colorama [required: >=0.4.1, installed: 0.4.6]
      - filelock [required: >=3.0.0, installed: 3.8.0]
      - packaging [required: >=14, installed: 23.0]
      - pluggy [required: >=0.12.0, installed: 1.0.0]
      - py [required: >=1.4.17, installed: 1.11.0]
      - six [required: >=1.14.0, installed: 1.16.0]
      - tomli [required: >=2.0.1, installed: 2.0.1]
      - virtualenv [required: >=16.0.0,!=20.0.7,!=20.0.6,!=20.0.5,!=20.0.4,!=20.0.3,!=20.0.2,!=20.0.1,!=20.0.0, installed: 20.21.0]
        - distlib [required: >=0.3.6,<1, installed: 0.3.6]
        - filelock [required: >=3.4.1,<4, installed: 3.8.0]
        - platformdirs [required: >=2.4,<4, installed: 3.2.0]
    - uvicorn [required: >=0.18.3,<0.19.0, installed: 0.18.3]
      - click [required: >=7.0, installed: 8.1.3]
        - colorama [required: Any, installed: 0.4.6]
      - h11 [required: >=0.8, installed: 0.14.0]
    - wheel [required: >=0.37.1,<0.38.0, installed: 0.37.1]
  - packaging [required: >=23.0,<24.0, installed: 23.0]
  - toml [required: Any, installed: 0.10.2]
  - tox [required: Any, installed: 3.28.0]
    - colorama [required: >=0.4.1, installed: 0.4.6]
    - filelock [required: >=3.0.0, installed: 3.8.0]
    - packaging [required: >=14, installed: 23.0]
    - pluggy [required: >=0.12.0, installed: 1.0.0]
    - py [required: >=1.4.17, installed: 1.11.0]
    - six [required: >=1.14.0, installed: 1.16.0]
    - tomli [required: >=2.0.1, installed: 2.0.1]
    - virtualenv [required: >=16.0.0,!=20.0.7,!=20.0.6,!=20.0.5,!=20.0.4,!=20.0.3,!=20.0.2,!=20.0.1,!=20.0.0, installed: 20.21.0]
      - distlib [required: >=0.3.6,<1, installed: 0.3.6]
      - filelock [required: >=3.4.1,<4, installed: 3.8.0]
      - platformdirs [required: >=2.4,<4, installed: 3.2.0]
ansys-sphinx-theme==0.8.0
  - Jinja2 [required: >=3.1.2, installed: 3.1.2]
    - MarkupSafe [required: >=2.0, installed: 2.1.2]
  - pydata-sphinx-theme [required: ==0.9.0, installed: 0.9.0]
    - beautifulsoup4 [required: Any, installed: 4.12.2]
      - soupsieve [required: >1.2, installed: 2.4]
    - docutils [required: !=0.17.0, installed: 0.18.1]
    - packaging [required: Any, installed: 23.0]
    - sphinx [required: >=4.0.2, installed: 5.3.0]
      - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
      - babel [required: >=2.9, installed: 2.12.1]
        - pytz [required: >=2015.7, installed: 2023.3]
      - colorama [required: >=0.4.5, installed: 0.4.6]
      - docutils [required: >=0.14,<0.20, installed: 0.18.1]
      - imagesize [required: >=1.3, installed: 1.4.1]
      - importlib-metadata [required: >=4.8, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - Jinja2 [required: >=3.0, installed: 3.1.2]
        - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - packaging [required: >=21.0, installed: 23.0]
      - Pygments [required: >=2.12, installed: 2.15.0]
      - requests [required: >=2.5.0, installed: 2.28.2]
        - certifi [required: >=2017.4.17, installed: 2022.12.7]
        - charset-normalizer [required: >=2,<4, installed: 3.1.0]
        - idna [required: >=2.5,<4, installed: 3.4]
        - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
      - snowballstemmer [required: >=2.0, installed: 2.2.0]
      - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
      - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
      - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
      - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
      - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
      - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
  - Sphinx [required: >=4.0.0, installed: 5.3.0]
    - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
    - babel [required: >=2.9, installed: 2.12.1]
      - pytz [required: >=2015.7, installed: 2023.3]
    - colorama [required: >=0.4.5, installed: 0.4.6]
    - docutils [required: >=0.14,<0.20, installed: 0.18.1]
    - imagesize [required: >=1.3, installed: 1.4.1]
    - importlib-metadata [required: >=4.8, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - Jinja2 [required: >=3.0, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - packaging [required: >=21.0, installed: 23.0]
    - Pygments [required: >=2.12, installed: 2.15.0]
    - requests [required: >=2.5.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - snowballstemmer [required: >=2.0, installed: 2.2.0]
    - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
    - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
    - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
    - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
    - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
    - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
black==22.12.0
  - click [required: >=8.0.0, installed: 8.1.3]
    - colorama [required: Any, installed: 0.4.6]
  - mypy-extensions [required: >=0.4.3, installed: 1.0.0]
  - pathspec [required: >=0.9.0, installed: 0.11.1]
  - platformdirs [required: >=2, installed: 3.2.0]
  - tomli [required: >=1.1.0, installed: 2.0.1]
  - typing-extensions [required: >=3.10.0.0, installed: 4.5.0]
codespell==2.2.2
docker==6.0.1
  - packaging [required: >=14.0, installed: 23.0]
  - pywin32 [required: >=304, installed: 306]
  - requests [required: >=2.26.0, installed: 2.28.2]
    - certifi [required: >=2017.4.17, installed: 2022.12.7]
    - charset-normalizer [required: >=2,<4, installed: 3.1.0]
    - idna [required: >=2.5,<4, installed: 3.4]
    - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
  - urllib3 [required: >=1.26.0, installed: 1.26.15]
  - websocket-client [required: >=0.32.0, installed: 1.5.1]
flake8==6.0.0
  - mccabe [required: >=0.7.0,<0.8.0, installed: 0.7.0]
  - pycodestyle [required: >=2.10.0,<2.11.0, installed: 2.10.0]
  - pyflakes [required: >=3.0.0,<3.1.0, installed: 3.0.1]
isort==5.11.2
mock==4.0.3
numpydoc==1.4.0
  - Jinja2 [required: >=2.10, installed: 3.1.2]
    - MarkupSafe [required: >=2.0, installed: 2.1.2]
  - sphinx [required: >=3.0, installed: 5.3.0]
    - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
    - babel [required: >=2.9, installed: 2.12.1]
      - pytz [required: >=2015.7, installed: 2023.3]
    - colorama [required: >=0.4.5, installed: 0.4.6]
    - docutils [required: >=0.14,<0.20, installed: 0.18.1]
    - imagesize [required: >=1.3, installed: 1.4.1]
    - importlib-metadata [required: >=4.8, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - Jinja2 [required: >=3.0, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - packaging [required: >=21.0, installed: 23.0]
    - Pygments [required: >=2.12, installed: 2.15.0]
    - requests [required: >=2.5.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - snowballstemmer [required: >=2.0, installed: 2.2.0]
    - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
    - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
    - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
    - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
    - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
    - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
pip==23.0.1
pipdeptree==2.7.0
pydocstyle==6.3.0
  - snowballstemmer [required: >=2.2.0, installed: 2.2.0]
pyright==1.1.302
  - nodeenv [required: >=1.6.0, installed: 1.7.0]
    - setuptools [required: Any, installed: 56.0.0]
PySocks==1.7.1
pytest-cov==3.0.0
  - coverage [required: >=5.2.1, installed: 6.4.1]
  - pytest [required: >=4.6, installed: 7.1.2]
    - atomicwrites [required: >=1.0, installed: 1.4.1]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - colorama [required: Any, installed: 0.4.6]
    - iniconfig [required: Any, installed: 2.0.0]
    - packaging [required: Any, installed: 23.0]
    - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
    - py [required: >=1.8.2, installed: 1.11.0]
    - tomli [required: >=1.0.0, installed: 2.0.1]
pytest-dependency==0.5.1
  - pytest [required: >=3.6.0, installed: 7.1.2]
    - atomicwrites [required: >=1.0, installed: 1.4.1]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - colorama [required: Any, installed: 0.4.6]
    - iniconfig [required: Any, installed: 2.0.0]
    - packaging [required: Any, installed: 23.0]
    - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
    - py [required: >=1.8.2, installed: 1.11.0]
    - tomli [required: >=1.0.0, installed: 2.0.1]
pytest-flakes==4.0.5
  - pyflakes [required: Any, installed: 3.0.1]
  - pytest [required: >=5, installed: 7.1.2]
    - atomicwrites [required: >=1.0, installed: 1.4.1]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - colorama [required: Any, installed: 0.4.6]
    - iniconfig [required: Any, installed: 2.0.0]
    - packaging [required: Any, installed: 23.0]
    - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
    - py [required: >=1.8.2, installed: 1.11.0]
    - tomli [required: >=1.0.0, installed: 2.0.1]
pytest-pep8==1.0.6
  - pep8 [required: >=1.3, installed: 1.7.1]
  - pytest [required: >=2.4.2, installed: 7.1.2]
    - atomicwrites [required: >=1.0, installed: 1.4.1]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - colorama [required: Any, installed: 0.4.6]
    - iniconfig [required: Any, installed: 2.0.0]
    - packaging [required: Any, installed: 23.0]
    - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
    - py [required: >=1.8.2, installed: 1.11.0]
    - tomli [required: >=1.0.0, installed: 2.0.1]
  - pytest-cache [required: Any, installed: 1.0]
    - execnet [required: >=1.1.dev1, installed: 1.9.0]
    - pytest [required: >=2.2, installed: 7.1.2]
      - atomicwrites [required: >=1.0, installed: 1.4.1]
      - attrs [required: >=19.2.0, installed: 22.2.0]
      - colorama [required: Any, installed: 0.4.6]
      - iniconfig [required: Any, installed: 2.0.0]
      - packaging [required: Any, installed: 23.0]
      - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
      - py [required: >=1.8.2, installed: 1.11.0]
      - tomli [required: >=1.0.0, installed: 2.0.1]
pytest-pythonpath==0.7.3
  - pytest [required: >=2.5.2, installed: 7.1.2]
    - atomicwrites [required: >=1.0, installed: 1.4.1]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - colorama [required: Any, installed: 0.4.6]
    - iniconfig [required: Any, installed: 2.0.0]
    - packaging [required: Any, installed: 23.0]
    - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
    - py [required: >=1.8.2, installed: 1.11.0]
    - tomli [required: >=1.0.0, installed: 2.0.1]
pytest-xdist==3.0.2
  - execnet [required: >=1.1, installed: 1.9.0]
  - pytest [required: >=6.2.0, installed: 7.1.2]
    - atomicwrites [required: >=1.0, installed: 1.4.1]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - colorama [required: Any, installed: 0.4.6]
    - iniconfig [required: Any, installed: 2.0.0]
    - packaging [required: Any, installed: 23.0]
    - pluggy [required: >=0.12,<2.0, installed: 1.0.0]
    - py [required: >=1.8.2, installed: 1.11.0]
    - tomli [required: >=1.0.0, installed: 2.0.1]
selenium==4.8.3
  - certifi [required: >=2021.10.8, installed: 2022.12.7]
  - trio [required: ~=0.17, installed: 0.22.0]
    - async-generator [required: >=1.9, installed: 1.10]
    - attrs [required: >=19.2.0, installed: 22.2.0]
    - cffi [required: >=1.14, installed: 1.15.1]
      - pycparser [required: Any, installed: 2.21]
    - exceptiongroup [required: >=1.0.0rc9, installed: 1.1.1]
    - idna [required: Any, installed: 3.4]
    - outcome [required: Any, installed: 1.2.0]
      - attrs [required: >=19.2.0, installed: 22.2.0]
    - sniffio [required: Any, installed: 1.3.0]
    - sortedcontainers [required: Any, installed: 2.4.0]
  - trio-websocket [required: ~=0.9, installed: 0.10.2]
    - exceptiongroup [required: Any, installed: 1.1.1]
    - trio [required: >=0.11, installed: 0.22.0]
      - async-generator [required: >=1.9, installed: 1.10]
      - attrs [required: >=19.2.0, installed: 22.2.0]
      - cffi [required: >=1.14, installed: 1.15.1]
        - pycparser [required: Any, installed: 2.21]
      - exceptiongroup [required: >=1.0.0rc9, installed: 1.1.1]
      - idna [required: Any, installed: 3.4]
      - outcome [required: Any, installed: 1.2.0]
        - attrs [required: >=19.2.0, installed: 22.2.0]
      - sniffio [required: Any, installed: 1.3.0]
      - sortedcontainers [required: Any, installed: 2.4.0]
    - wsproto [required: >=0.14, installed: 1.2.0]
      - h11 [required: >=0.9.0,<1, installed: 0.14.0]
  - urllib3 [required: ~=1.26, installed: 1.26.15]
sphinx-copybutton==0.5.1
  - sphinx [required: >=1.8, installed: 5.3.0]
    - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
    - babel [required: >=2.9, installed: 2.12.1]
      - pytz [required: >=2015.7, installed: 2023.3]
    - colorama [required: >=0.4.5, installed: 0.4.6]
    - docutils [required: >=0.14,<0.20, installed: 0.18.1]
    - imagesize [required: >=1.3, installed: 1.4.1]
    - importlib-metadata [required: >=4.8, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - Jinja2 [required: >=3.0, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - packaging [required: >=21.0, installed: 23.0]
    - Pygments [required: >=2.12, installed: 2.15.0]
    - requests [required: >=2.5.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - snowballstemmer [required: >=2.0, installed: 2.2.0]
    - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
    - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
    - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
    - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
    - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
    - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
sphinx-design==0.3.0
  - sphinx [required: >=4,<6, installed: 5.3.0]
    - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
    - babel [required: >=2.9, installed: 2.12.1]
      - pytz [required: >=2015.7, installed: 2023.3]
    - colorama [required: >=0.4.5, installed: 0.4.6]
    - docutils [required: >=0.14,<0.20, installed: 0.18.1]
    - imagesize [required: >=1.3, installed: 1.4.1]
    - importlib-metadata [required: >=4.8, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - Jinja2 [required: >=3.0, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - packaging [required: >=21.0, installed: 23.0]
    - Pygments [required: >=2.12, installed: 2.15.0]
    - requests [required: >=2.5.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - snowballstemmer [required: >=2.0, installed: 2.2.0]
    - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
    - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
    - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
    - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
    - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
    - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
sphinx-gallery==0.11.1
  - sphinx [required: >=3, installed: 5.3.0]
    - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
    - babel [required: >=2.9, installed: 2.12.1]
      - pytz [required: >=2015.7, installed: 2023.3]
    - colorama [required: >=0.4.5, installed: 0.4.6]
    - docutils [required: >=0.14,<0.20, installed: 0.18.1]
    - imagesize [required: >=1.3, installed: 1.4.1]
    - importlib-metadata [required: >=4.8, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - Jinja2 [required: >=3.0, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - packaging [required: >=21.0, installed: 23.0]
    - Pygments [required: >=2.12, installed: 2.15.0]
    - requests [required: >=2.5.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - snowballstemmer [required: >=2.0, installed: 2.2.0]
    - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
    - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
    - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
    - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
    - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
    - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
sphinx-mdinclude==0.5.3
  - docutils [required: >=0.16,<1.0, installed: 0.18.1]
  - mistune [required: >=2.0,<3.0, installed: 2.0.5]
  - pygments [required: >=2.8, installed: 2.15.0]
sphinx-toolbox==3.2.0
  - apeye [required: >=0.4.0, installed: 1.3.0]
    - apeye-core [required: >=1.0.0b2, installed: 1.1.2]
      - domdf-python-tools [required: >=2.6.0, installed: 3.6.0]
        - importlib-metadata [required: >=3.6.0, installed: 4.13.0]
          - zipp [required: >=0.5, installed: 3.15.0]
        - natsort [required: >=7.0.1, installed: 8.3.1]
        - typing-extensions [required: >=3.7.4.1, installed: 4.5.0]
      - idna [required: >=2.5, installed: 3.4]
    - domdf-python-tools [required: >=2.6.0, installed: 3.6.0]
      - importlib-metadata [required: >=3.6.0, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - natsort [required: >=7.0.1, installed: 8.3.1]
      - typing-extensions [required: >=3.7.4.1, installed: 4.5.0]
    - platformdirs [required: >=2.3.0, installed: 3.2.0]
    - requests [required: >=2.24.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
  - autodocsumm [required: >=0.2.0, installed: 0.2.10]
    - Sphinx [required: >=2.2,<7.0, installed: 5.3.0]
      - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
      - babel [required: >=2.9, installed: 2.12.1]
        - pytz [required: >=2015.7, installed: 2023.3]
      - colorama [required: >=0.4.5, installed: 0.4.6]
      - docutils [required: >=0.14,<0.20, installed: 0.18.1]
      - imagesize [required: >=1.3, installed: 1.4.1]
      - importlib-metadata [required: >=4.8, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - Jinja2 [required: >=3.0, installed: 3.1.2]
        - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - packaging [required: >=21.0, installed: 23.0]
      - Pygments [required: >=2.12, installed: 2.15.0]
      - requests [required: >=2.5.0, installed: 2.28.2]
        - certifi [required: >=2017.4.17, installed: 2022.12.7]
        - charset-normalizer [required: >=2,<4, installed: 3.1.0]
        - idna [required: >=2.5,<4, installed: 3.4]
        - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
      - snowballstemmer [required: >=2.0, installed: 2.2.0]
      - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
      - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
      - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
      - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
      - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
      - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
  - beautifulsoup4 [required: >=4.9.1, installed: 4.12.2]
    - soupsieve [required: >1.2, installed: 2.4]
  - cachecontrol [required: >=0.12.6, installed: 0.12.11]
    - msgpack [required: >=0.5.2, installed: 1.0.5]
    - requests [required: Any, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
  - dict2css [required: >=0.2.3, installed: 0.3.0]
    - cssutils [required: >=2.2.0, installed: 2.6.0]
    - domdf-python-tools [required: >=2.2.0, installed: 3.6.0]
      - importlib-metadata [required: >=3.6.0, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - natsort [required: >=7.0.1, installed: 8.3.1]
      - typing-extensions [required: >=3.7.4.1, installed: 4.5.0]
  - docutils [required: >=0.16,<0.19, installed: 0.18.1]
  - domdf-python-tools [required: >=2.9.0, installed: 3.6.0]
    - importlib-metadata [required: >=3.6.0, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - natsort [required: >=7.0.1, installed: 8.3.1]
    - typing-extensions [required: >=3.7.4.1, installed: 4.5.0]
  - html5lib [required: >=1.1, installed: 1.1]
    - six [required: >=1.9, installed: 1.16.0]
    - webencodings [required: Any, installed: 0.5.1]
  - lockfile [required: >=0.12.2, installed: 0.12.2]
  - ruamel.yaml [required: >=0.16.12, installed: 0.17.21]
    - ruamel.yaml.clib [required: >=0.2.6, installed: 0.2.7]
  - sphinx [required: >=3.2.0, installed: 5.3.0]
    - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
    - babel [required: >=2.9, installed: 2.12.1]
      - pytz [required: >=2015.7, installed: 2023.3]
    - colorama [required: >=0.4.5, installed: 0.4.6]
    - docutils [required: >=0.14,<0.20, installed: 0.18.1]
    - imagesize [required: >=1.3, installed: 1.4.1]
    - importlib-metadata [required: >=4.8, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - Jinja2 [required: >=3.0, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - packaging [required: >=21.0, installed: 23.0]
    - Pygments [required: >=2.12, installed: 2.15.0]
    - requests [required: >=2.5.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
    - snowballstemmer [required: >=2.0, installed: 2.2.0]
    - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
    - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
    - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
    - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
    - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
    - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
  - sphinx-autodoc-typehints [required: >=1.11.1, installed: 1.22]
    - sphinx [required: >=5.3, installed: 5.3.0]
      - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
      - babel [required: >=2.9, installed: 2.12.1]
        - pytz [required: >=2015.7, installed: 2023.3]
      - colorama [required: >=0.4.5, installed: 0.4.6]
      - docutils [required: >=0.14,<0.20, installed: 0.18.1]
      - imagesize [required: >=1.3, installed: 1.4.1]
      - importlib-metadata [required: >=4.8, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - Jinja2 [required: >=3.0, installed: 3.1.2]
        - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - packaging [required: >=21.0, installed: 23.0]
      - Pygments [required: >=2.12, installed: 2.15.0]
      - requests [required: >=2.5.0, installed: 2.28.2]
        - certifi [required: >=2017.4.17, installed: 2022.12.7]
        - charset-normalizer [required: >=2,<4, installed: 3.1.0]
        - idna [required: >=2.5,<4, installed: 3.4]
        - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
      - snowballstemmer [required: >=2.0, installed: 2.2.0]
      - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
      - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
      - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
      - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
      - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
      - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
  - sphinx-jinja2-compat [required: >=0.1.0, installed: 0.2.0]
    - jinja2 [required: >=2.10, installed: 3.1.2]
      - MarkupSafe [required: >=2.0, installed: 2.1.2]
    - markupsafe [required: >=1, installed: 2.1.2]
  - sphinx-prompt [required: >=1.1.0, installed: 1.5.0]
    - pygments [required: Any, installed: 2.15.0]
    - Sphinx [required: Any, installed: 5.3.0]
      - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
      - babel [required: >=2.9, installed: 2.12.1]
        - pytz [required: >=2015.7, installed: 2023.3]
      - colorama [required: >=0.4.5, installed: 0.4.6]
      - docutils [required: >=0.14,<0.20, installed: 0.18.1]
      - imagesize [required: >=1.3, installed: 1.4.1]
      - importlib-metadata [required: >=4.8, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - Jinja2 [required: >=3.0, installed: 3.1.2]
        - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - packaging [required: >=21.0, installed: 23.0]
      - Pygments [required: >=2.12, installed: 2.15.0]
      - requests [required: >=2.5.0, installed: 2.28.2]
        - certifi [required: >=2017.4.17, installed: 2022.12.7]
        - charset-normalizer [required: >=2,<4, installed: 3.1.0]
        - idna [required: >=2.5,<4, installed: 3.4]
        - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
      - snowballstemmer [required: >=2.0, installed: 2.2.0]
      - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
      - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
      - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
      - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
      - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
      - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
  - sphinx-tabs [required: >=1.2.1,<3.5.0, installed: 3.4.1]
    - docutils [required: ~=0.18.0, installed: 0.18.1]
    - pygments [required: Any, installed: 2.15.0]
    - sphinx [required: Any, installed: 5.3.0]
      - alabaster [required: >=0.7,<0.8, installed: 0.7.13]
      - babel [required: >=2.9, installed: 2.12.1]
        - pytz [required: >=2015.7, installed: 2023.3]
      - colorama [required: >=0.4.5, installed: 0.4.6]
      - docutils [required: >=0.14,<0.20, installed: 0.18.1]
      - imagesize [required: >=1.3, installed: 1.4.1]
      - importlib-metadata [required: >=4.8, installed: 4.13.0]
        - zipp [required: >=0.5, installed: 3.15.0]
      - Jinja2 [required: >=3.0, installed: 3.1.2]
        - MarkupSafe [required: >=2.0, installed: 2.1.2]
      - packaging [required: >=21.0, installed: 23.0]
      - Pygments [required: >=2.12, installed: 2.15.0]
      - requests [required: >=2.5.0, installed: 2.28.2]
        - certifi [required: >=2017.4.17, installed: 2022.12.7]
        - charset-normalizer [required: >=2,<4, installed: 3.1.0]
        - idna [required: >=2.5,<4, installed: 3.4]
        - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
      - snowballstemmer [required: >=2.0, installed: 2.2.0]
      - sphinxcontrib-applehelp [required: Any, installed: 1.0.4]
      - sphinxcontrib-devhelp [required: Any, installed: 1.0.2]
      - sphinxcontrib-htmlhelp [required: >=2.0.0, installed: 2.0.1]
      - sphinxcontrib-jsmath [required: Any, installed: 1.0.1]
      - sphinxcontrib-qthelp [required: Any, installed: 1.0.3]
      - sphinxcontrib-serializinghtml [required: >=1.1.5, installed: 1.1.5]
  - tabulate [required: >=0.8.7, installed: 0.9.0]
  - typing-extensions [required: >=3.7.4.3,!=3.10.0.1, installed: 4.5.0]
sphinxcontrib-mermaid==0.8.1
twine==4.0.1
  - importlib-metadata [required: >=3.6, installed: 4.13.0]
    - zipp [required: >=0.5, installed: 3.15.0]
  - keyring [required: >=15.1, installed: 23.13.1]
    - importlib-metadata [required: >=4.11.4, installed: 4.13.0]
      - zipp [required: >=0.5, installed: 3.15.0]
    - importlib-resources [required: Any, installed: 5.12.0]
      - zipp [required: >=3.1.0, installed: 3.15.0]
    - jaraco.classes [required: Any, installed: 3.2.3]
      - more-itertools [required: Any, installed: 9.1.0]
    - pywin32-ctypes [required: >=0.2.0, installed: 0.2.0]
  - pkginfo [required: >=1.8.1, installed: 1.9.6]
  - readme-renderer [required: >=35.0, installed: 37.3]
    - bleach [required: >=2.1.0, installed: 6.0.0]
      - six [required: >=1.9.0, installed: 1.16.0]
      - webencodings [required: Any, installed: 0.5.1]
    - docutils [required: >=0.13.1, installed: 0.18.1]
    - Pygments [required: >=2.5.1, installed: 2.15.0]
  - requests [required: >=2.20, installed: 2.28.2]
    - certifi [required: >=2017.4.17, installed: 2022.12.7]
    - charset-normalizer [required: >=2,<4, installed: 3.1.0]
    - idna [required: >=2.5,<4, installed: 3.4]
    - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
  - requests-toolbelt [required: >=0.8.0,!=0.9.0, installed: 0.10.1]
    - requests [required: >=2.0.1,<3.0.0, installed: 2.28.2]
      - certifi [required: >=2017.4.17, installed: 2022.12.7]
      - charset-normalizer [required: >=2,<4, installed: 3.1.0]
      - idna [required: >=2.5,<4, installed: 3.4]
      - urllib3 [required: >=1.21.1,<1.27, installed: 1.26.15]
  - rfc3986 [required: >=1.4.0, installed: 2.0.0]
  - rich [required: >=12.0.0, installed: 13.3.3]
    - markdown-it-py [required: >=2.2.0,<3.0.0, installed: 2.2.0]
      - mdurl [required: ~=0.1, installed: 0.1.2]
    - pygments [required: >=2.13.0,<3.0.0, installed: 2.15.0]
    - typing-extensions [required: >=4.0.0,<5.0, installed: 4.5.0]
  - urllib3 [required: >=1.26.0, installed: 1.26.15]

[akaszynski]

@sraipurkar, could you please report the specific vulnerabilities? We might be able to use a different version of vtk and pillow to address this.

[akaszynski]

For everyone's information regarding the critical vulnerabilities:

I think we should be able to resolve this by either downgrading to an older version or waiting until they fix these issues upstream. I'll keep everyone posted as I dig into this.

There are really libraries that we need to worry about:

• zlib <1.2.12 - CVE-2022-37434 CVE-2018-25032
• libtiff < 4.5.0 - CVE-2022-3970

Applicable upstream issues for CVE-2022-37434

• https://github.com/h5py/h5py/issues/2254
• https://gitlab.kitware.com/vtk/vtk/-/issues/18962

Applicable upstream issues for CVE-2022-3970

• https://gitlab.com/libtiff/libtiff/-/issues/551

[akaszynski]

Mitigations

• [x] ~h5py - @seanpearsonuk, is it possible to make h5py optional?~ False positive. See https://github.com/h5py/h5py/issues/2254
• [x] ~pillow - This can be made optional within pyvista in https://github.com/pyvista/pyvista/issues/4336. I expect this to be resolved soon and out in pyvista==0.39.0 in a week or two.~ This was resolved in v4.5.0. See https://gitlab.com/libtiff/libtiff/-/issues/551, and also CVE-2022-3970, which states that it's upto and excluding v4.5.0
• [x] wheel - can be resolved by simply removing the package. wheel is not used during runtime, only when building the package. Same with setuptools and pip. These are all required for initial installation, but do not need to be there for the deployment.
• [x] vtk - PyVista automatically imports the TIFF library, but you can actually just delete that DLL in the deployment as soon as https://github.com/pyvista/pyvista/pull/4337 is merged and pyvista==0.39.0 is released.

All in all, I think we can actually resolve fairly soon provided we can work around h5py.

[tacaswell]

The version of zlib is a build time choice, the most expedient path will be to install h5py from source (I am assuming it came from pip?) rather from the wheels.

[tacaswell]

That would mean you have to provide your own libhdf5 + zlib. https://github.com/h5py/h5py/blob/7893c57e0f12e11a936dd137369ff062eaa9bec5/ci/get_hdf5_win.py is how we build libhdf5 for the wheels and it looks like we pull zlib from nuget https://github.com/h5py/h5py/blob/7893c57e0f12e11a936dd137369ff062eaa9bec5/ci/azure-pipelines-wheels.yml#L26-L32

[tacaswell]

Per https://github.com/h5py/h5py/issues/2254#issuecomment-1522499010 I think this is a false positive.

[dnwillia]

Not sure it makes sense to have h5py optional. Another strategy would be to move the case reader capability to a new OSS package. pyfluent-reader say. This might be more consistent with our goal to keep the core library free of dependencies, which helps avoid issues like this.

[seanpearsonuk]

Not sure it makes sense to have h5py optional. Another strategy would be to move the case reader capability to a new OSS package. pyfluent-reader say. This might be more consistent with our goal to keep the core library free of dependencies, which helps avoid issues like this.

Yes that seems like a good option

[ansSReuss]

OK - Can someone confirm that this is how the team will proceed (and what sort of path and timeline is associated)? We need resolutions for customer deployments.

[seanpearsonuk]

Is that still required, @ansSReuss ? My understanding is that we are OK to include h5py in the core dependencies.

[ansSReuss]

Is that still required, @ansSReuss ? My understanding is that we are OK to include h5py in the core dependencies.

Because of this?

Per h5py/h5py#2254 (comment) I think this is a false positive.

[dnwillia]

Yes, that's right. The hdf5 CVE is a false positive.

The other things will be updated as mentioned by akaszynski.

[akaszynski]

PyVista v0.39.0 is out. This should address any outstanding OSS vulnerabilities. Let's keep this issue live until we've verified they've been resolved.

[seanpearsonuk]

@akaszynski should we try to update https://github.com/pyansys/pyfluent-visualization/blob/main/pyproject.toml right now? We currently have pyvista = ">=0.33.2" set there.

[akaszynski]

@akaszynski should we try to update https://github.com/pyansys/pyfluent-visualization/blob/main/pyproject.toml right now? We currently have pyvista = ">=0.33.2" set there.

I'd do it.

FYI, VTK solved the zlib CVE. Please see https://gitlab.kitware.com/vtk/vtk/-/issues/18962

[seanpearsonuk]

@akaszynski should we try to update https://github.com/pyansys/pyfluent-visualization/blob/main/pyproject.toml right now? We currently have pyvista = ">=0.33.2" set there.

I'd do it.

FYI, VTK solved the zlib CVE. Please see https://gitlab.kitware.com/vtk/vtk/-/issues/18962

@raph-luc, Would you like to take care of it?

[raph-luc]

@seanpearsonuk @raph-luc, Would you like to take care of it?

Sure

[raph-luc]

Going to keep this issue open as a reminder, until the VTK release with the fix for CVE-2022-37434 is available to update our dependencies

[dnwillia]

should this not be an issue on the viz repo?

[seanpearsonuk]

This issue is completely resolved now.

[dnwillia]

by this it seems: https://github.com/ansys/pyfluent-visualization/pull/263

[seanpearsonuk]

Thanks @dnwillia @dnwillia-work

I linked it

[raph-luc]

@seanpearsonuk Sorry I wasn't clear: I was keeping this issue open as a reminder of the VTK zlib vulnerability that hasn't yet made it to a release, this is the commit to VTK that fixed it: https://gitlab.kitware.com/vtk/vtk/-/commit/e0ba55ffcaa82114fbb4441d6e82b3f32c666bd7

In my understanding we still need to update our VTK dependency once that fix makes it to a release there (probably going to be VTK 9.2.7)

I am going to open an issue on the pyfluent-visualization repo to track this, as I agree with @dnwillia that is a better place for it

[landon-kanner]

What about CVE-2021-37501 (https://nvd.nist.gov/vuln/detail/CVE-2021-37501) and CVE-2018-25032 (https://nvd.nist.gov/vuln/detail/CVE-2018-25032) ?

[raph-luc]

@landon-kanner

As discussed above, CVE-2021-37501 for hdf5 seems to have been a false positive, the link you shared https://nvd.nist.gov/vuln/detail/CVE-2021-37501 also says "This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis".

CVE-2018-25032 is also related to older zlib versions like CVE-2022-37434, should also be fixed once VTK releases its next version, with our dependencies updated through pyfluent-visualization as currently being tracked here: https://github.com/ansys/pyfluent-visualization/issues/289

[landon-kanner]

Thanks @raph-luc

As discussed above, CVE-2021-37501 for hdf5 seems to have been a false positive, the link you shared https://nvd.nist.gov/vuln/detail/CVE-2021-37501 also says "This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis".

I see where CVE-2022-37434 is discussed and documented as a false positive, but I don't see anything showing that CVE-2021-37501 is a false positive. Can you share a link please?

CVE-2018-25032 is also related to older zlib versions like CVE-2022-37434, should also be fixed once VTK releases its next version, with our dependencies updated through pyfluent-visualization as currently being tracked here: ansys/pyfluent-visualization#289

Due to CVE-2018-25032, is if fair to say that pyfluent's dependency tree still has known vulnerabilities, at least until VTK releases its next version?

[dnwillia]

pyfluent does not have known vulnerabilities but pyfluent-visualization does. Best to move the discussion here to that repo: https://github.com/ansys/pyfluent-visualization/issues/289

[raph-luc]

I see where CVE-2022-37434 is discussed and documented as a false positive, but I don't see anything showing that CVE-2021-37501 is a false positive. Can you share a link please?

Thank you @landon-kanner, the link you shared read to me like that vulnerability is/was being re-evaluated: "This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis" https://nvd.nist.gov/vuln/detail/CVE-2021-37501, and I did think it was related to the hdf5/h5py CVE already discussed, but seems like that isn't quite the case, you are right.

Due to CVE-2018-25032, is if fair to say that pyfluent's dependency tree still has known vulnerabilities, at least until VTK releases its next version?

As @dnwillia said, for CVE-2018-25032, not pyfluent, but pyfluent-visualization. It is a different repository and package, and pyfluent does not always use it.

@dnwillia @seanpearsonuk I think we still need clarification on CVE-2021-37501 which seems to not have been fully addressed yet (it was also originally identified above in the image in https://github.com/ansys/pyfluent/issues/1552#issuecomment-1522274223 but not further discussed), I can confirm we are currently using h5py which on PyPI is compiled against hdf5 1.12.2 which seems to be affected and use h5dump.

Looks like the solutions would be to build h5py from source with a newer hdf5 version as in https://github.com/ansys/pyfluent/issues/1552#issuecomment-1522465028, or reevaluate/move the case reader functionality to a separate and optional pyfluent-reader package as suggested by @dnwillia.

[seanpearsonuk]

We could create a separate reader package. Does everyone agree to that as the way forward?

[raph-luc]

Was investigating and I am not yet 100% sure whether our usage is affected by h5dump (this might indeed be a false positive).

Regardless, to avoid future issues like this, rather than separating the reader into a new package, another (I believe less cumbersome) option as previously mentioned would be to make h5py an optional dependency, such as in https://setuptools.pypa.io/en/latest/userguide/dependency_management.html#optional-dependencies

Users would then need to install it separately or specify e.g. pip install pyfluent[h5py] if they want to make use of h5py, and it wouldn't be the default pyfluent installation. If the user does not install h5py, I believe the only difference is that the case reader would not work. Thoughts @seanpearsonuk ?

[mkundu1]

I found that the symbol h5tools_str_sprint under CVE-2021-37501 is part of a different hdf5_tools.dll which is not installed with h5py.

[raph-luc]

h5dump is a command line tool that neither we nor h5py seem to use (they only list its usage as part of a single example).

Related to what @mkundu1 found, it seems that h5dump which is part of hdf5_tools is not even installed by default on Windows due to this commit: https://github.com/h5py/h5py/commit/4086ac2518fd8457fc146c3de0a1d3b2df4f7d49

[mkundu1]

I also don't find the symbol h5tools_str_sprint within a linux installation of h5py/pyfluent.

[raph-luc]

Thanks @mkundu1, same, also can't find any instance of dump nor tools on a Linux install.

As far as I can tell CVE-2021-37501 is false positive on pyfluent, going to go ahead and close this issue tracker. Please let us know if anyone has any additional concerns.

For remaining zlib vulnerabilities CVE-2018-25032 and CVE-2022-37434, they do not affect pyfluent and are being tracked here for pyfluent-visualization: https://github.com/ansys/pyfluent-visualization/issues/289

[raph-luc]

As @landon-kanner identified, it seems that https://nvd.nist.gov/vuln/detail/CVE-2018-25032 is not only an issue for older VTK versions, but also for current h5py release.

On Windows, a current pyfluent install ends up with Lib\site-packages\h5py\zlib.dll that is zlib version 1.2.11 and affected by this vulnerability. This is not an issue on Linux. See also https://github.com/h5py/h5py/issues/2261.

This could still be a false positive as I believe we are only using decompression to read files, and not compression/deflation.

Regardless, the changes proposed in https://github.com/ansys/pyfluent/issues/2096 (to support Python 3.12) should already work around this vulnerability, as the h5py dependency will then be moved to an optional separate package, and won't affect the pyfluent core package anymore.

Edit: As a short term solution, we can make h5py optional in PyFluent and not installed by default as mentioned in https://github.com/ansys/pyfluent/issues/1552#issuecomment-1654059912

[raph-luc]

Confirmed as resolved with @landon-kanner, for PyFluent version 0.18.1 and above