PyPi: Nwb-Conversion-Tools

CVE-2021-34141

Transitive

Safety vulnerability ID: 50173

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Dec 17, 2021 Updated at Mar 22, 2023
Scan your Python projects for vulnerabilities →

Advisory

Nwb-conversion-tools 0.11.38 updates its dependency 'numpy' to v1.22.0 to include security fixes.

Affected package

nwb-conversion-tools

Latest version: 0.11.38

Convert data from proprietary formats to NWB format.

Affected versions

Fixed versions

Vulnerability changelog

Upcoming deprecations
- Introduced a soft deprecation of keyword argument 'save_path' from various interface and tool-specific write and conversion functions. This argument should now be named 'nwbfile_path' for consistency with the main converter calls.
- For the `spikeinterface.add_unit`s auxiliary function, argument `write_as: str` has been changed to `write_in_processing_module: bool`. Default behavior has not changed. Also removed override of ElectrodeTable descriptions, allowing PyNWB to set these instead.


New Features and Improvements
- For latest security fixes, bumps minimum required version of numpy to >=1.22.0 for Python versions >=3.8. Python 3.7 can only go up to numpy 1.21.0, however.
- Enables the `nwbct-run-conversion` entrypoint for calling the YAML conversion specification from the command line.
- Adds a stubbing option to all ophys ImagingInterfaces.
- Improved the local version of the GenericDataChunkIterator by padding the buffer when beneficial.
- Various improvements to automated metadata extraction for various recording interfaces.
- Allows the JSON validators to parse datetime objects as iso and adds a context helper for making or appending NWBFiles.
- Enables recording, imaging, and sorting interfaces to perform standalone write of an NWBFile (that is, without requiring an NWBConverter with only a single interface).
- Added appending functionality to `spikeinterface.add_units`.
- Added a data transfer tool for submitting and tracking tasks over Globus endpoints.
- Added a helper function for performing a fully automated DANDI upload process, assuming the token has been set as an environment variable.
- Added helper functions for automatically downloading data from Figshare.
- Added verbosity control to the NWBConverter class and base DataInterfaces.
- Added support for string-valued channel_ids from SpikeInterface. It does so by introducing a new column 'channel_names' to any ElectrodeTable written by add_electrodes or write_recording. This is enforced to be unique across rows of the table both here and in individual SpikeInterface recordings.


New Interfaces
- Introduced the BaseIcephysInterface and the first intracellular format interface - the AbfInterface!
- Added the KilosortSortingInterface.


Interface Changes
- Added SpikeInterface support for the NeuralynxRecordingInterface, SpikeGadgetsRecordingInterface, BlackrockRecordingInterface, PhySortingInterface, IntanRecordingInterface, and NeuroscopeSortingInterface. The CEDRecordingInterface now only uses SpikeInterface as the backend (and has dropped _a priori_ setting of channel IDs - this is planned to be automatically reintroduced as a non-class method to subset channels after initialization, but for now that must be done manually).
- Removed the `nwbfile` object as a required argument of the `BaseRecordingInterface. run_conversion`.


Tool Changes
- Prevents any response series associated with a TwoPhotonSeries from being written if it is simply an array of zeros.
- Introduced a util function for calculating the rate of a regular series.
- Introduced deprecation of `use_times` to `roiextractors.add_two_photon_series`, as the behavior now mimics the modern SpikeInterface approach of always using them when available, and falling back to sampling frequency usage if not.


Bug Fixes
- Disabled the `nwb-gui` entrypoint as it has not worked for some time now.
- Fixed a bug where metadata values were duplicated in `roiextractors.write_imaging`.
- Prevented duplicate ophys metadata from becoming set during a manual override.
- Small fixes to ophys imaging metadata construction.
- Corrects the metadata schema for segmentation interfaces to be compatible with the ImagingInterfaces.
- Allows timestamps to be used with `external_file=True` in the MovieInterface.
- Fixed the matching of unique group_names with groups on the ElectrodesTable.
- Fixed a problem when running the YAML conversion feature on the Windows platform.

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

MEDIUM 5.3

CVSS v3 Details

MEDIUM 5.3
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
LOW

CVSS v2 Details

MEDIUM 5.0
Access Vector (AV)
NETWORK
Access Complexity (AC)
LOW
Authentication (Au)
NONE
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Impact (A)
PARTIAL