GitHub Sends API Deprecation Notice on Authentication

[latefield]

Environment:
cs50 Lab/Sandbox

Upon authentication using username and password when running check50, GitHub sends following email to user:

Hi ,

You recently used a password to access an endpoint through the GitHub API using python-requests/2.22.0. We will deprecate basic authentication using password to this endpoint soon:

https://api.github.com/user

We recommend using a personal access token (PAT) with the appropriate scope to access this endpoint instead. Visit https://github.com/settings/tokens for more information.

Thanks,
The GitHub Team

See related GitHub blog post regarding depreciation:
https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/

[cmlsharp]

@tinycrimsonpandas Could you print the output of check50 --version please? Also pip show lib50.

@kzidane Do you know where are we querying the Github API with passwords? I think we used to check for 2-factor but we don't anymore. lib50 contains no API calls as far as I can tell. The other possibility is submit.cs50.io but we use tokens exclusively there too I'm pretty sure.

[kzidane]

I think Lab and Sandbox have an older version @dmalan.

[latefield]

$ check50 --version
check50 3.0.10

$ pip show lib50
Name: lib50
Version: 2.0.0
Summary: This is lib50, CS50's own internal library used in many of its tools.
Home-page: https://github.com/cs50/lib50
Author: CS50
Author-email: [email protected]
License: GPLv3
Location: /usr/local/lib/python3.7/site-packages
Requires: attrs, pexpect, pyyaml, requests, termcolor, jellyfish, cryptography
Required-by: submit50, help50, compare50, check50
$ 

From the Sandbox.

[pazz]

I've received a similar email and reported this in cs50/lib50#41 before finding this issue.
Apologies for the cross-posting but this really makes me nervous TBH.

[pazz]

Sorry to keep bringing this up but the emails from GitHub keep coming:

From: GitHub <[email protected]>
Subject: [GitHub] Deprecation Notice
Date: Fri, 11 Sep 2020 04:54:12 -0700

Hi @pazz,

On September 11th, 2020 at 11:54 (UTC) you used a password to access an endpoint through the GitHub API using
python-requests/2.22.0:

https://api.github.com/user

Basic authentication using a password to the API is deprecated and will soon no longer work. Visit
https://developer.github.com/changes/2020-02-14-deprecating-password-auth/ for more information around suggested
workarounds and removal dates.

I got this just after using check50 in the lab sandbox on https://lab.cs50.io.
The versions of check50/lib50 are as reported above.

Can you confirm that it really is just a matter of updating check50/lib50 in the sandbox container?

[cmlsharp]

@kzidane Can we try updating check50 in the sandbox to 3.2?

[stevemuench]

Still happening. Got such an email today after using check50 and/or submit50 to submit Lab1 hello.c source.