Skip to content

Update dependency kaleido to v0.2.1.post1 #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ivan-flamingo wants to merge 1 commit into
base: develop
Choose a base branch
from
+1 −1
Open

Update dependency kaleido to v0.2.1.post1 #46

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api/tacticalrmm/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ vine==5.1.0
websockets==13.1
zipp==3.20.2
pandas==2.2.3
kaleido==0.2.1
kaleido==0.2.1.post1

@coderabbitai coderabbitai Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify kaleido 0.2.1.post1 exists and check for security advisories

# Check if version 0.2.1.post1 exists on PyPI
echo "Checking if kaleido 0.2.1.post1 exists on PyPI..."
curl -s https://pypi.org/pypi/kaleido/json | jq -r '.releases | keys[]' | grep -E '^0\.2\.1\.post1$'

# Get latest version for comparison
echo -e "\nLatest kaleido version:"
curl -s https://pypi.org/pypi/kaleido/json | jq -r '.info.version'

# Check for security advisories
echo -e "\nChecking for security advisories..."
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: PIP, package: "kaleido") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: flamingo-stack/tacticalrmm

Length of output: 249

🏁 Script executed:

#!/bin/bash
set -euo pipefail

PKG="kaleido"
VER="0.2.1.post1"
URL="https://pypi.org/pypi/${PKG}/${VER}/json"

echo "Fetching PyPI metadata for ${PKG}==${VER}..."
curl -s "$URL" | jq -r '
  {
    version: .info.version,
    requires_dist: .info.requires_dist,
    classifiers: .info.classifiers,
    summary: .info.summary
  } | `@json`
'

echo
echo "Wheel/platform filenames for ${PKG}==${VER} (to infer arm32 support):"
curl -s "$URL" | jq -r '.releases[env.VER] // .urls' 2>/dev/null || true
# Print filenames from releases object if present
curl -s "https://pypi.org/pypi/${PKG}/${VER}/json" | jq -r '
  (.urls[]?.filename // empty),
  (.releases[env.VER][]?.filename // empty)
' 2>/dev/null | sed -n '1,80p'

echo
echo "Checking whether metadata declares plotly as a dependency:"
curl -s "https://pypi.org/pypi/${PKG}/${VER}/json" | jq -r '
  (.info.requires_dist // []) | map(select(test("plotly";"i"))) | .[]
' || true

Repository: flamingo-stack/tacticalrmm

Length of output: 447

🌐 Web query:

Plotly Kaleido compatibility plotly 5.24 kaleido required version 0.2.1.post1

💡 Result:

For Plotly 5.24.x, the Kaleido package version 0.2.1 (not 0.2.1.post1) is the recommended and compatible version [1][2]. Key points regarding compatibility: 1. Version Mismatch: Kaleido 1.0.0 and later are not compatible with Plotly 5.x [1]. Installing the latest version of Kaleido (via pip install -U kaleido) will cause static image export (e.g., fig.write_image()) to fail in Plotly 5.24 because it triggers an incompatibility error [1]. 2. Kaleido 0.2.1.post1 Limitations: The 0.2.1.post1 version of Kaleido is a specific release intended only for ARM32 Linux architectures [3][4]. It does not provide wheels or source distributions for most standard operating systems (like Windows, macOS, or standard x86_64 Linux), and attempting to install it on those platforms will typically fail [3]. 3. Recommended Setup: For users on Plotly 5.24 who need static image export, you should explicitly install Kaleido version 0.2.1: pip install kaleido==0.2.1 [1][2][3] If you require the features or updates found in Kaleido 1.x, you must upgrade your Plotly library to version 6.1.1 or greater [5][6][1].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '35,55p' api/tacticalrmm/requirements.txt | nl -ba

Repository: flamingo-stack/tacticalrmm

Length of output: 113

🏁 Script executed:

#!/bin/bash
set -euo pipefail
awk 'NR>=38 && NR<=48 {print NR ":" $0}' api/tacticalrmm/requirements.txt

Repository: flamingo-stack/tacticalrmm

Length of output: 285

🌐 Web query:

Plotly 5.24 kaleido==0.2.1.post1 compatibility

💡 Result:

Yes, Kaleido 0.2.1.post1 is compatible with Plotly 5.24.x [1][2]. In fact, for users running Plotly version 5.x, using the 0.2.x series of Kaleido (such as 0.2.1 or 0.2.1.post1) is the recommended approach [1]. Starting with Kaleido 1.0.0, the package introduced breaking changes and required upgrading to Plotly 6.1.1 or later [3][4]. If a user on Plotly 5.24 attempts to use Kaleido 1.0.0 or higher, they will encounter compatibility warnings and errors stating that the versions are incompatible [1]. Important notes regarding Kaleido 0.2.1.post1: 1. Installation issues: Some users have reported installation failures for 0.2.1.post1 on certain platforms because it was originally released with limited wheel support (specifically targeting arm32 Linux) [5][6][7]. If you encounter platform-specific installation errors, it is generally recommended to use kaleido==0.2.1 instead, which has broader platform support [5]. 2. Deprecation context: While the 0.2.x series works for Plotly 5.x, it is considered a legacy version [8]. Official support for Plotly image export now focuses on Kaleido 1.0.0+ for modern Plotly versions (6.x+) [3][4]. If you are using Plotly 5.24 and need to perform static image export, ensure you have a compatible version of Kaleido installed (e.g., pip install "kaleido<1.0.0") [1].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail
PKG="kaleido"
VER="0.2.1.post1"
curl -s "https://pypi.org/pypi/${PKG}/${VER}/json" | jq -r '
  if (.releases["'"$VER"'"]|type)=="array" then
    .releases["'"$VER"'"][]?.filename
  else
    "No .releases entries for that version key"
  end
'

Repository: flamingo-stack/tacticalrmm

Length of output: 112

🏁 Script executed:

#!/bin/bash
set -euo pipefail
PKG="kaleido"
VER="0.2.1.post1"
curl -s "https://pypi.org/pypi/${PKG}/json" | jq -r '
  ( .releases | keys[] ) as $k
  | select($k|tostring|test("^0\\.2\\.1\\.post1$")) 
  | "matched_key=\($k)" 
'

curl -s "https://pypi.org/pypi/${PKG}/json" | jq -r '
  if (.releases|has("'"$VER"'")) then
    ("has_key=true type=" + (.releases["'"$VER"'"]|type))
  else
    "has_key=false"
  end
'

curl -s "https://pypi.org/pypi/${PKG}/json" | jq -r '
  .releases | keys | map(select(startswith("0.2.1"))) | .[:20] | .[]
'

Repository: flamingo-stack/tacticalrmm

Length of output: 136

🏁 Script executed:

#!/bin/bash
set -euo pipefail
PKG="kaleido"
VER="0.2.1.post1"
curl -s "https://pypi.org/pypi/${PKG}/${VER}/json" | jq -r '
  .releases? as $r
' >/dev/null 2>&1 || true

curl -s "https://pypi.org/pypi/${PKG}/json" | jq -r '
  (.releases["'"$VER"'"] // [])[]
  | .filename
'

Repository: flamingo-stack/tacticalrmm

Length of output: 128

Update kaleido==0.2.1.post1 is valid and secure for Plotly 5.x, but it’s arm32-only on PyPI.

  • api/tacticalrmm/requirements.txt (line 43) pins kaleido==0.2.1.post1, which exists on PyPI.
  • No security advisories were returned for kaleido in the GitHub advisory lookup.
  • plotly==5.24.1 is compatible with the Kaleido 0.2.x series (Kaleido >=1.0.0 is the incompatible line for Plotly 5.x).
  • PyPI artifacts for 0.2.1.post1 only include kaleido-0.2.1.post1-...-manylinux2014_armv7l.whl (no x86_64/other wheels or sdist), so this pin may break pip install on non-arm32 platforms unless the requirements are architecture-specific.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/tacticalrmm/requirements.txt` at line 43, The pinned dependency
kaleido==0.2.1.post1 is an arm32-only wheel on PyPI and will break installs on
non-arm platforms; update api/tacticalrmm/requirements.txt to avoid the
architecture-specific pin by either: (A) relax the pin to a Plotly-compatible
range (for example change kaleido==0.2.1.post1 to kaleido>=0.2.1,<1.0.0) so pip
can select a suitable release, or (B) make the pin platform-specific (e.g., keep
kaleido==0.2.1.post1 but add an environment marker so it only applies on
armv7l), and ensure plotly==5.24.1 remains compatible with the chosen kaleido
range.

jinja2==3.1.5
markdown==3.7
plotly==5.24.1
Expand Down
Loading