docs: Add Security Advisory Policy for `vega` by hydrosquall · Pull Request #4008 · vega/vega

hydrosquall · 2025-02-02T01:02:19Z

Motivation

Make it easy for researchers and engineers to have a safe path to reporting security vulnerabilities
Keep Vega and its dependents (Vega-lite, altair, etc) secure

Changes

Add a SECURITY.md (Security Policy), following a slack discussion in the Maintainers channel. This is based on
- Electron https://github.com/electron/electron/blob/main/SECURITY.md
- Microsoft: https://github.com/microsoft/.github/blob/main/SECURITY.md
While linking this file from the homepage, I noticed we could make the Vega README a bit more like the Vega-Lite one (shorter and with more direct docs links). I can revert these changes if preferred, I figured it didn't hurt to propose them.

hydrosquall · 2025-02-02T01:02:50Z

CONTRIBUTING.md

-To setup a development environment follow the [Build Instructions in README.md](https://github.com/vega/vega/#Build-Instructions). We use [Yarn workspaces](https://yarnpkg.com/lang/en/docs/workspaces/) and [lerna](https://github.com/lerna/lerna) to manage the monorepo packages.
+To setup a development environment follow the [Build Instructions in README.md](#build-instructions). We use [Yarn workspaces](https://yarnpkg.com/lang/en/docs/workspaces/) and [lerna](https://github.com/lerna/lerna) to manage the monorepo packages.
+
+## Build Instructions


This section was lifted without modifications from README.md

hydrosquall · 2025-02-02T01:03:24Z

README.md

- After running either `yarn test` or `yarn build`, run `yarn serve` to launch a local web server &mdash; your default browser will open and you can browse to the `"test"` folder to view test specifications.
-
-This repository includes the Vega website and documentation in the `docs` folder. To launch the website locally, first run `bundle install` in the `docs` folder to install the necessary Jekyll libraries. Afterwards, use `yarn docs` to build the documentation and launch a local webserver. After launching, you can open [`http://127.0.0.1:4000/vega/`](http://127.0.0.1:4000/vega/) to see the website.
+Try using Vega in the online [Vega Editor](https://vega.github.io/editor/#/examples/vega/bar-chart).


This is based on a similar line in the Vega-Lite readme.md to encourage people to try the library right away without having to install anything.

hydrosquall · 2025-02-02T01:05:09Z

README.md


 ## Internet Explorer Support
-For backwards compatibility, Vega includes a [babel-ified](https://babeljs.io/) IE-compatible version of the code in the `packages/vega/build-es5` directory. Older browser would also require several polyfill libraries:
+For backwards compatibility, Vega includes a [babel-ified](https://babeljs.io/) IE-compatible version of the code in the `packages/vega/build-es5` directory. Older browsers also require these polyfill libraries:


I considered moving this section on IE into Contributing / Development as well, but decided to leave it in place. I'm not sure how relevant this section still is to keep on the homepage given the default MSFT browser has been Edge for 10 years.

Let's delete it in the next major version.

Noting this as part of the ESM support (since switching over would end that compatibility): #3990

hydrosquall · 2025-02-02T01:06:51Z

SECURITY.md

@@ -0,0 +1,21 @@
+# Security
+


I blended the Github and Electron README's together.

We could alternately put this directly in our .github community folder to have a policy that applies to all repos in the vega org, but I figured it would be safe and meaningful to start with vega/vega (since this is the core browser runtime that every other package is importing).

Yeah, makes sense to have one for Vega specifically. We could also link to the org one for more info so we only have to maintain one place.

domoritz · 2025-02-02T01:05:41Z

SECURITY.md

+
+## Preferred Languages
+
+We prefer communications to be in English.


I think we require it.

domoritz · 2025-02-02T01:06:21Z

README.md

+Try using Vega in the online [Vega Editor](https://vega.github.io/editor/#/examples/vega/bar-chart).

 ## Internet Explorer Support
-For backwards compatibility, Vega includes a [babel-ified](https://babeljs.io/) IE-compatible version of the code in the `packages/vega/build-es5` directory. Older browser would also require several polyfill libraries:


We should get rid of that actually. But not here.

Makes sense to handle that in a separate issue 👍

domoritz · 2025-02-02T02:02:10Z

SECURITY.md

+
+A Vega maintainer will send a response indicating next steps in handling your report. After the initial reply, the team will keep you informed of the progress towards a fix and announcement, and may ask for additional information or guidance.
+
+You can also report a vulnerability through the [npm contact form](https://www.npmjs.com/support) by selecting "I'm reporting a security vulnerability".


Where does that go?

I believe the NPM security team would contact the account owner for https://www.npmjs.com/package/vega . I'm including this mainly so that someone without a Github account has a way to reach us.

If we would find this redundant with the Github security advisory feature, I can remove it.

Yeah, let's remove it and have one clear path.

domoritz · 2025-02-02T02:02:54Z

SECURITY.md

@@ -0,0 +1,21 @@
+# Security


Is there a way to have an org wide document rather than per repo?

We have the option of putting this in .github like Microsoft does here. It will fill in the "security" tab if a repo doesn't already have one, just confirmed from checking an old Microsoft example

I can relocate this draft to vega/.github if we prefer!

Added a modified proposal to the shared repo vega/.github#20 . It will fill in for any repos that are missing a local security advisory.

domoritz · 2025-02-02T19:06:50Z

SECURITY.md

+
+## Languages
+
+Communications should be in English.


I think we can delete that since we already have that for the org. If we ever get a request not in English, we can respond.

domoritz · 2025-02-02T19:07:21Z

SECURITY.md

@@ -0,0 +1,21 @@
+# Security
+


Yeah, makes sense to have one for Vega specifically. We could also link to the org one for more info so we only have to maintain one place.

domoritz · 2025-02-03T21:47:21Z

Can we just not do anything specific here? Or just add a short reference to the org one?

hydrosquall · 2025-02-04T05:17:00Z

The main reason to have a dedicated one for Vega/Vega vs reusing the org one is to have an updated link for the “report a vulnerability” tab, and so people have a copy of this file when they git clone. You are right that most of the document is the same as in the org link. We could shorten this doc to just the pointer to the org link and the intro/report a vulnerability link if we prefer. There’s already a link to the org one at the bottom of the security.MD in this PR.

…

On Mon, Feb 3, 2025 at 4:47 PM Dominik Moritz ***@***.***> wrote: Can we just not do anything specific here? Or just add a short reference to the org one? Screenshot.2025-02-03.at.16.45.52.png (view on web) <https://github.com/user-attachments/assets/0baa02bb-6859-4bd8-9069-97ffc0716226> — Reply to this email directly, view it on GitHub <#4008 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACE2MM2KS27EYQMT3XXT2DT2N7PX7AVCNFSM6AAAAABWJ2S6FOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMZSGE2DQMZSGU> . You are receiving this because you were assigned.Message ID: ***@***.***>

domoritz · 2025-02-04T19:52:06Z

You are right that most of the document is the same as in the org link. We
could shorten this doc to just the pointer to the org link and the
intro/report a vulnerability link if we prefer.

Yes, that was what I was thinking.

@hydrosquall

Changes since v5.31.0 **vega-expression** * Add base64 string encoder/decoder to `vega-expression` and `vega-interpreter` (via #4009). (Thanks @hydrosquall!) **vega-typings** * Add Typescript Types for `vega-loader` (via #4000). (Thanks @hydrosquall!) **docs** * Correct data year citation in dorling-cartogram example (via #4006). (Thanks @dsmedia!) * Update typo in vega.timeFloor description (via #4010). (Thanks @hydrosquall!) * Add Security Advisory Policy for Vega (via #4008). (Thanks @hydrosquall!) * Replace redirect url in `expressions.md` (via #3996). (Thanks @dangotbanned!) * correct queries to query in `crossfilter.md` (via #4005). (Thanks @danmarshall!) --------- Signed-off-by: Lukas Hermann <1734032+lsh@users.noreply.github.com>

feat(docs): draft security.md for Vega

4ac18a3

hydrosquall self-assigned this Feb 2, 2025

hydrosquall commented Feb 2, 2025

View reviewed changes

hydrosquall changed the title ~~docs: Propose SECURITY.md for vega~~ docs: Add Security Advisory Policy for vega Feb 2, 2025

domoritz reviewed Feb 2, 2025

View reviewed changes

hydrosquall force-pushed the cameron.yick/draft-security-advisory-vega branch from a9cf317 to e1f6639 Compare February 2, 2025 17:34

hydrosquall mentioned this pull request Feb 2, 2025

docs: Add security policy for the Vega org vega/.github#20

Merged

domoritz reviewed Feb 2, 2025

View reviewed changes

hydrosquall force-pushed the cameron.yick/draft-security-advisory-vega branch from e1f6639 to 15e5e62 Compare February 2, 2025 19:21

docs: reference Security.md on Vega README.md

170ac17

hydrosquall force-pushed the cameron.yick/draft-security-advisory-vega branch from 15e5e62 to 170ac17 Compare February 2, 2025 23:39

hydrosquall marked this pull request as ready for review February 3, 2025 20:11

hydrosquall requested a review from a team as a code owner February 3, 2025 20:11

hydrosquall requested a review from domoritz February 3, 2025 20:11

feat(docs): simplify Vega -org-specific security guidelines

13c5f0c

domoritz approved these changes Feb 7, 2025

View reviewed changes

hydrosquall merged commit 560aeec into main Feb 8, 2025
4 checks passed

hydrosquall deleted the cameron.yick/draft-security-advisory-vega branch February 8, 2025 02:50

lsh mentioned this pull request Feb 24, 2025

chore: v5.32.0 #4014

Merged


		## Preferred Languages

		We prefer communications to be in English.


		A Vega maintainer will send a response indicating next steps in handling your report. After the initial reply, the team will keep you informed of the progress towards a fix and announcement, and may ask for additional information or guidance.

		You can also report a vulnerability through the [npm contact form](https://www.npmjs.com/support) by selecting "I'm reporting a security vulnerability".

Uh oh!

Conversation

hydrosquall commented Feb 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

domoritz commented Feb 3, 2025

Uh oh!

hydrosquall commented Feb 4, 2025 via email

Uh oh!

domoritz commented Feb 4, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hydrosquall commented Feb 2, 2025 •

edited

Loading