CVE-2021-33503

Advisory

Spinetoolbox 0.6.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added
- Data Transformer now supports parameter value transformations.
- Project execution shortcuts: F5 to execute all DAGs, F6 to execute selected items
and F7 to stop execution.
- Time series, maps and other compound values have gained the ability to have names for their indexes.
Index names can be edited in parameter value editors, and they are also supported by Importer and Exporter items.
- Support for running Python Tools (specifications) in a Conda environment
- Execution mode (kernel spec, console, interpreter) can now be selected individually for each Python
Tool specification

Changed
- Data Transformer's specification editor has now a new interface.
- Parameter renaming in Data Transformer requires now entity class names to identify the parameters.
Data Transformer's icon will show a notification if class names are missing.
- Installation instructions advice to install directly from PyPI.
- Stand-alone DB Editor is now opened with the `spine-db-editor [URL]` command
- Python settings on the *Tools* page of *File->Settings* are now the default settings for new Python Tool
specifications. I.e. they are not global settings anymore.

Deprecated
- GdxExporter has been deprecated. Use the general purpose Exporter item instead.
GdxExporter will be removed in a future release. Please replace existing items by Exporter.

Removed

Fixed

[0.6.0-final.2] - 2021-06-03

Fixed
- [win-x64] Running Python or Julia Tools does not open an extra console window anymore

Security
- urllib3 v1.26.5 now required because of a security vulnerability in earlier versions

[0.6.0-final.1] - 2021-06-01

Fixed
- Event Log and Item Execution Logs now automatically scroll to the bottom when there are new messages
- [win-x64] Resolve correct GAMS, Python, and Julia paths in Settings->Tools

[0.6.0-final.0] - 2021-05-07

Added
- Support for parallel/multicore processing
- New project item: Data Transformer. Can be used to configure Spine database filters for successor items.
Currently, it supports renaming entity classes.
- New project item: Exporter. A general-purpose tabular data exporter.
- Support for version 3 Spine Toolbox projects and an automatic upgrade of version 2 projects to version 3.
- Support for version 4 Spine Toolbox projects.
- Support for version 5 Spine Toolbox projects.
- Support for version 6 Spine Toolbox projects.
- Support to create sysimages for Julia tools.
- New requirement: jill, for installing Julia.
- The SpineOpt configuration assistant has been moved from File->Configuration assistants,
to File->Settings->Tools->Julia, and renamed to SpineOpt Installer.
- New wizard to install Julia, accessible from File->Settings->Tools->Julia.
- File->Close project option
- Support for Python 3.8
- Automated kernel creation, if the user selects to run tools in console without having created a kernel.
- Option to pack CSV resource files into one datapackage.json file for advertising, available from Link properties.
- Option to color project item icons in the toolbar, available frm File->Settings->General.
- Reorganize project item icons in the toolbar with drag and drop.

Changed
- Project Item (Tool, Data Store, Importer, etc.) code has been removed from Spine Toolbox.
Project Items are now in a separate package called spine_items, which is upgraded at Spine
Toolbox's startup.
- Importer item now applies the same mapping to all input files. If the user needs to apply different
mappings, they need to create different Importers. The specification can be shared using the json file.
- The .gdx exporter project item is now called GdxExporter.
- [win-x64] Installer does not require admin rights anymore
- [win-x64] Installer always asks for an installation directory, even if a previous installation exists
- [win-x64] Installer wizard style changed to modern

Removed
- Combiner project item. The same functionality can be achieved by connecting a Data Store to another Data Store.
- Upgrade support for original (.proj file based) Spine Toolbox projects.
- Python 3.6 is no longer supported.
- The Spine Datapackage Editor is gone. There wasn't enough reason to keep this widget
- The app no longer checks that Spine dependencies are up to date. Users are asked to follow the upgrade procedure
which involves manually upgrading requirements after pulling the latest master branch.

Fixed
- [win-x64] returning_process.py when frozen
- Traceback in GdxExporter when there are indexing settings for a parameter that is not in the database
- Bug in installing Plugins
- Traceback when removing Plugins

[0.5.0-final.1] - 2020-02-03

Added
- Tutorial for case study A5 in the documentation

Fixed
- [win-x64] Fixed /tools/python.exe by adding sitecustomize.py and a missing python37.dll

[0.5.0-final.0] - 2020-12-14

Added
- Exporting graphs as PDF files from the *Graph* menu in the Data Store form.
- Pruning entire classes from the graph view. The option is available both from the *Graph* menu and
from *Entity Graph* context menus. Also, pruned items can be restored gradually.
- A new Input type *Indexed parameter expansion* is now available in Data Store view's Pivot table.
In this Input type the indexes, e.g. time stamps of time series get expanded as a new dimension in the table.
- Import editor now has a new Source type: Table name. It can be used e.g. to pick an Excel sheet's
or GAMS domain's name as the object class name.
- Import editor now supports multidimensional maps. The number of dimensions can be set using the
*Map dimensions* spin box in mappings options.
- Executing a project from the command line without opening the Toolbox GUI (i.e. headless execution).
The headless execution is enabled by the new command line option ``--execute-only``.
- Toolbox now supports scenarios and alternatives. They can be accessed via Data store view's new Alternative tree.
- New Project Item: Gimlet. Can be used to run any command as part of the workflow
with or without a shell. Supported shells at the moment are cmd and powershell for
Windows and bash for other OS's.
- Python and Julia Kernel spec Editor. Provides the means to make new kernel specs for Python Console and Julia
Console without leaving Spine Toolbox. Kernel (spec) Editor can be found in Settings->Tools tab.
- [win-x64] Includes Tools/python.exe for running Python Tools for systems that do not have a Python installation.
Also, pyvenv.cfg and path.pth files for configuring the included python.exe.

Fixed
- Signal disconnection issue in Graph View
- Bugs in removing objects and object classes in Spine db editor's Graph View

Changed
- Data Store Form is now called 'Spine database editor'
- Spine db editor Graph View behavior. Now selecting objects in the object tree not only shows those objects but also
all the cascading relationships. One can still go back to the previous behavior in Settings.
- Moving object items in the graph view also causes relationship icons to follow. This behavior can be disabled in the
Settings.
- Required PySide2 version is now 5.14. The version is checked at startup.
- Indexed parameter handling has been overhauled in Exporter allowing parameters to share indexing domains.
**Note**: Due to numerous changes in the backend, Exporters in old project files will not load properly
and need to be re-configured.
- The way Exporter handles missing parameter values and None values has changed. The item now ignores missing
values instead of replacing them by the default value. Further, there is a new option to replace None values by
the default value and another option to replace Nones by not-a-numbers or skip exporting them.
- The numerical indicator on the upper left corner of project items no longer indicates the execution order for
each individual item because the exact order is not know before the Execute button is actually clicked.
The number still indicates the execution order but may show the same numbers for items in different parallel
branches.
- Project.json file format has been upgraded to version 2. Version 1 project.json files are upgraded to version 2
automatically when a project is opened.
- Default Python interpreter is now {sys.executable} i.e. the one that was used in launching the app.
This affects the Python used by Python Tool specifications and the PyCall used by SpineOpt.jl configuration
assistant.
- [win-x64] Default Python interpreter is the Python in user's PATH if available. If Python is not defined in
user's PATH, the default Python interpreter is the <app_install_dir>/Tools/python.exe.
- User's now need to explicitly choose the kernel specs for the Python Console and the Julia Console. They are
not chosen (nor created) automatically anymore. The kernel specs can be selected in the drop-down menus
in application Settings->Tools.
- Database revision handling has been improved. Id est, the app does not offer to upgrade databases
that are more recent than the current version of Spine Toolbox can handle.
- Links to User Guide and Getting Started documents open only the online versions. The docs have been
published on readthedocs.org.
- Clearing the line edits for Julia executable and Python Interpreter (in Settings->Tools) shows
the full paths to their respective files as placeholder text.

Deprecated
- CustomQtKernelManager class

Removed
- python_repl_widget.py
- julia_repl_widget.py

[0.4.0-final.0] - 2020-04-03

Added
- A small notification icon is painted next to project items in the design view whenever they
are missing some configuration. Hovering the icon shows tips for completing the
configuration.
- A small icon is painted next to the project items in the design view to show the order in
which they will be executed
- Main Window menu 'File -> Open recent'. Shortcut for opening a recent project.
- A new project item *Exporter* allows a database contained in a *Data Store* to be exported
as GAMS `.gdx` file.
- It is now possible to copy and paste project items for example between projects.
- It is now possible to duplicate project items.
- Changes made in the tree view are also seen in the graph view and viceversa.
- New Setting: *Sticky selection in Graph View*. Enables users to select if they want to use
multi-selection or single selection in the Graph view Object tree when selecting items with
the **left-mouse button**.
- Projects can be saved to any directory
- Project name can be changed in Settings
- The graph view features a short live demonstration that new users can follow to discover
the basic functionality.
- New Setting: *Curved links*. When active, links on the Design View follow a smooth curve
rather than a straight line.
- When execution traverses a link, a small animation is played to denote the flow of data.
Users can set how quick they want this animation to be in Settings. The fastest setting
effectively disables the animation.
- Special 'tag' command line arguments are now available in Tool Specification which expand
to, for example, input database URLS or paths to optional input files when a Tool is executed.
- It is now possible to undo/redo database changes in the Data Store form.
- It is now possible to visualize the history of database changes in the Data Store form. The
option is available in the Session menu.
- Support for Tool command line arguments. You can now give Tool (project item) command line
arguments in addition to Tool Specification command line arguments.
- Undo/Redo in Design View
- It is now possible to add new plots to existing plot windows in Data Store View.
- Objects in Data Store's Tree View are sorted alphabetically
- A new parameter value type, *map* has been added. There is now a dedicated editor to
modify maps. Plotting of non-nested maps is supported, as well.
- [win-x64] importer_program.py has been built as an independent application. This program is
now distributed with the Spine Toolbox single-file installer. When installing Spine Toolbox,
the Importer Program app can be found in the Spine Toolbox install directory
(/importer_program).
- Import preview window now supports copy-pasting mappings and options from a source table to
another
- Import preview window header context-menus for the preview table which, allows users to
change all data types at once.
- Provide data for EditRole for nicer editor experience in MappingSpecModel.
- Red background is displayed for invalid values in MappingSpecModel
- Object tooltips now show the descriptions Data Store view's

Fixed
- Data advertised by a project item during execution is only accessible by its direct
successors. In other words, resources are passed to the next items in line but not beyond.
- [win-x64] Executing the Importer project item has been fixed on Windows release version
- Bug fixes for Data Store View
- Disappearing object names in entity graph
- Spine db manager error dialogs
- Tool configuration assistant for SpineModel.jl
- [win-x64] A problem with displaying special characters in Process Log when executing the
Importer project item.
- The context menu in Graph view's pivot table resulted in a traceback when an entity class
did not have parameter definitions.
- Combobox delegate in Import preview window had wrong list of choices.
- Don't set mapping to NoneMapping if user gives a None value.
- Exporter now also exports empty object classes and empty parameters into GDX files
- A bug that sometimes made duplicate entries to File->Open recents menu
- Bug where an Excel import with empty rows would return a None in it's get_data_iterator
- [win-x64] Executing Julia tools in the embedded Julia Console
- [win-x64] Setting up Python Console. Installing ipykernel and kernel specs now works.
- [win-x64] Setting up Julia Console. Installing IJulia and kernel specs now works.
- Column indexing in Import Editor. When entering a time or time pattern index column
manually in Import Editor's lower right corner table, the colors in the preview table
failed to update. This should fix the bug and allow column selection both by column index
or column header text.

Changed
- spinetoolbox is now a Python package. To start the app, use command
`python -m spinetoolbox` or `python spinetoolbox.py` as spinetoolbox.py has been moved to
repository root.
- Tool templates are now called Tool specifications
- File->Open Project opens a file dialog, where you can open projects by selecting an old
<project_name>.proj file or a Spine Toolbox Project directory. Valid Spine Toolbox projects
are decorated with the Spine logo.
- Old style projects (.proj files) cannot be opened anymore. The old style projects need to
be upgraded before opening. You can upgrade your .proj file projects into new ones with
*Project Upgrade Wizard* found in `File->Upgrade project` menu item.
- Project information is not saved to a <project_name>.proj file anymore. This information
is now located in file <project_dir>/.spinetoolbox/project.json. Every Spine Toolbox project
has this file.
- Work directory is now a global setting instead of a project setting
- Renamed *Data Interface* project item to *Importer*. The corresponding category
*Data Importers* was renamed to *Importers*.
- Tree, graph, and tabular views have been merged into one consolidated view. You can choose
your preferred style from the Data Store View's `View` menu.
- The graph view behavior has changed. Now selecting objects in the object tree not only
shows those objects but also all the cascading relationships. This is to facilitate exploring
the system without a previous knowledge.
- importer_program.py now uses the Python interpreter that the app was started with and not
the one that is given by user in Settings -> Tools.
- Importer now uses QProcessExecutionManager for running the importer_program.py

Removed
- The status bar of the Data store view is gone. Instead, notifications are printed in a box
on the right side of the form.
- Saving project information to .proj files is not happening anymore

Resources

• https://pypi.org/project/spinetoolbox
• https://pyup.io/changelogs/spinetoolbox/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503