Just five-months ago Google’s head of search spam strongly recommended to nofollow links in widgets because the widget space has been abused with link spam.
That may have changed with a small but significant update to the Google Webmaster Guidelines link schemes page. Now, the page specifies the exact type of links that are not allowed within widgets, as opposed to saying any links.
Previously the guideline read:
Links embedded in widgets that are distributed across various sites.
Today the guideline reads:
Keyword-rich, hidden or low-quality links embedded in widgets that are distributed across various sites.
As you can see, Google changed their stance on the type of links you can have in widgets. Specifically saying that not all links are not allowed but only keyword rich, hidden or low-quality links are not allowed.