Repository navigation
alert users that depend on plotly-latest that the website is using latest v1 not the latest #3118
Description
@archmoj we really need to mark plotly-latest with a console warning.
@BPowell76 plotly-latest is the end of the v1.x line. Starting in v2.0 we stopped updating this so that the major update and following updates don't accidentally break existing projects. Please update your project to use a specific version from the CDN.
Originally posted by @alexcjohnson in #1794
Activity
archmoj commentedon Jan 6, 2025
@gvwilson This is an issue that IMHO require input from @ndrezn and @emilykl in terms of existing apps.
I appreciate it if you please add it to the list of items we discuss in our upcoming libraries meetings.
Thank you.
ndrezn commentedon Jan 6, 2025
We could probably add a note to our documentation but I agree with Alex that in terms of how this should materialize in the product, we should issue a patch release on top of
plotly-latestadding a console warning that this is1.xand not actually latest.alexcjohnson commentedon Jan 6, 2025
I don’t think it even needs a new release (in fact it should not be a new release, anyone using 1.x explicitly should see no change), just a new file uploaded to plotly-latest that adds a console warning to the existing file
archmoj commentedon Jan 6, 2025
Only overwriting the CDN files may/will potentially break websites that load the source file using a hash for extra security. Please see https://content-security-policy.com/hash/
Instead IMHO we should release a plotly.js v1 patch to properly address this issue.
alexcjohnson commentedon Jan 6, 2025
But plotly-latest changed many times in the past and we never worried about the hash changing, why would it be different now? If you're using an unversioned file like plotly-latest you expect the file and its hash to change from time to time.
Anyway if you really want to create a new release in the 1.x branch for this, how do we ensure that anyone loading that new release explicitly will not see this warning, only people loading plotly-latest will see it?
ndrezn commentedon Jan 6, 2025
Yeah I tend to agree with Alex -- in Python this would probably be issued as a
postrelease but to my understanding there's not really an equivalent in JS. It seems reasonable just to push an extra file with the console warning to the CDN.I think it's fine not to issue a new release and to just add the warning straight to the CDN.
archmoj commentedon Jan 6, 2025
@ndrezn What should the console warning contain exactly?
ndrezn commentedon Jan 6, 2025
Something along the lines of:
@LiamConnors do you have opinions on this?
alexcjohnson commentedon Jan 6, 2025
I like that message, though I'd tweak it a little. It's v1.58.5, which was released July 2021, but that's just a security patch. The latest feature release on the 1.x branch is from Dec 2020 but both are so old I'd stick with the actual 1.58.5 date. And I'd emphasize that despite the name it's no longer the latest. So something like:
[-]Should we alert users and/or developers/owners of all websites that still depend on `plotly-latest` that the website is using latest v1 not the latest? And how?[/-][+]alert users that depend on `plotly-latest` that the website is using latest v1 not the latest[/+]alexcjohnson commentedon Feb 21, 2025
These files now contain a
console.errormessage similar to the above.