Skip to content
This repository has been archived by the owner on Oct 29, 2024. It is now read-only.

Revert MUI update that was breaking table display #148

Merged
merged 3 commits into from
Jul 8, 2024
Merged

Conversation

gtardif
Copy link
Contributor

@gtardif gtardif commented Jul 5, 2024

Also added E2E test, that would have prevented to merge this dependabot PR in the first place

@gtardif gtardif requested a review from a team as a code owner July 5, 2024 15:15
Copy link

github-actions bot commented Jul 5, 2024

🔍 Vulnerabilities of docker/volumes-backup-extension:pr-148

📦 Image Reference docker/volumes-backup-extension:pr-148
digestsha256:c40b164295302282fe63853e933e7f15aea06d82b6530f4b2a6f105945bd3103
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0
size46 MB
packages52
📦 Base Image busybox:1
also known as
  • 1-glibc
  • 1.36
  • 1.36-glibc
  • 1.36.1
  • 1.36.1-glibc
  • glibc
  • latest
  • stable
  • stable-glibc
digestsha256:50aa4698fa6262977cff89181b2664b99d8a56dbca847bf62f2ef04854597cf8
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.10.0 (golang)

pkg:golang/golang.org/x/net@0.10.0

high 7.5: CVE--2023--39325 Uncontrolled Resource Consumption

Affected range<0.17.0
Fixed version0.17.0
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.00209
EPSS Percentile0.59147
Description

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.

With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Copy link

github-actions bot commented Jul 5, 2024

Docker image tag(s) pushed:

docker/volumes-backup-extension:pr-148

To install the extension from this PR:

docker extension install -f docker/volumes-backup-extension:pr-148

Labels added to images:

org.opencontainers.image.created=2024-07-05T15:52:43.493Z
org.opencontainers.image.description=Back up, clone, restore, and share Docker volumes effortlessly.
org.opencontainers.image.licenses=Apache-2.0
org.opencontainers.image.revision=
org.opencontainers.image.source=https://github.com/docker/volumes-backup-extension
org.opencontainers.image.title=volumes-backup-extension
org.opencontainers.image.url=https://github.com/docker/volumes-backup-extension
org.opencontainers.image.version=pr-148

Copy link

github-actions bot commented Jul 5, 2024

Overview

Image reference docker/volumes-backup-extension:latest docker/volumes-backup-extension:pr-148
- digest 9592303acc0b c40b16429530
- provenance https://github.com/docker/volumes-backup-extension.git#549e8f6ae4d0c476ce4a0f2a45cda12c4bf56524/commit/549e8f6ae4d0c476ce4a0f2a45cda12c4bf56524
- vulnerabilities critical: 0 high: 1 medium: 7 low: 0 unspecified: 1 critical: 0 high: 1 medium: 7 low: 0 unspecified: 1
- platform linux/amd64 linux/amd64
- size 41 MB 46 MB (+5.1 MB)
- packages 51 52 (+1)
Base Image busybox:1
also known as:
1-glibc
1.36
1.36-glibc
1.36.1
1.36.1-glibc
glibc
latest
stable
stable-glibc
busybox:1
also known as:
1-glibc
1.36
1.36-glibc
1.36.1
1.36.1-glibc
glibc
latest
stable
stable-glibc
- vulnerabilities critical: 0 high: 0 medium: 0 low: 0 critical: 0 high: 0 medium: 0 low: 0
Environment Variables (2 changes)
  • ± 2 changed
  • 1 unchanged
-BUGSNAG_APP_VERSION=
+BUGSNAG_APP_VERSION=latest
-BUGSNAG_RELEASE_STAGE=production
+BUGSNAG_RELEASE_STAGE=local
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Labels (2 changes)
  • - 2 removed
  • 11 unchanged
 com.docker.desktop.extension.api.version=>= 0.2.3
 com.docker.desktop.extension.icon=https://raw.githubusercontent.com/docker/volumes-backup-extension/main/icon.svg
 com.docker.extension.additional-urls=[     {"title":"Support", "url":"https://github.com/docker/volumes-backup-extension/issues"}     ]
 com.docker.extension.categories=volumes
 com.docker.extension.changelog=<ul>    <li>Fixed some security CVEs in JavaScript dependencies.</li>     <li>Fixed extension not working in some cases with Docker Desktop Business with enforced login.</li>     </ul>
 com.docker.extension.detailed-description=<p><strong>The functionality in this extension is now available as a Beta feature in the Volumes tab in Docker Desktop versions 4.29.0 and later. This extension will be deprecated once the features are out of Beta.</strong> <a href='https://docs.docker.com/desktop/use-desktop/volumes/'>Learn more</a></p>     <p>With Volumes Backup & Share you can easily create copies of your volumes and also share them with others through SSH or pushing them to a registry.</p>     <h2 id=-features>✨ What can you do with this extension?</h2>     <ul>     <li>Export a volume:</li>     <ul><li>To a compressed file in your local filesystem</li>     <li>To an existing local image</li>     <li>To a new local image</li>     <li>To a new image in Docker Hub (or another registry)</li></ul>     <li>Import data into a new container or into an existing container:</li>     <ul><li>From a compressed file in your local filesystem</li>     <li>From an existing image</li>     <li>From an existing image in Docker Hub (or another registry)</li></ul>     <li>Transfer a volume via SSH to another host that runs Docker Desktop or Docker engine.</li>     <li>Clone, empty or delete a volume</li>     </ul>     <h2>Acknowledgements</h2>     <ul>     <li><a href="/BretFisher/docker-vackup">Vackup project by Bret Fisher</a></li>     <li><a href="https://www.youtube.com/watch?v=BHKp7Sc3VVc">Building Vackup - LiveStream on YouTube</a></li>     <ul>     
 com.docker.extension.publisher-url=https://www.docker.com/
 com.docker.extension.screenshots=[     {"alt": "Home page - list of volumes", "url": "https://raw.githubusercontent.com/docker/volumes-backup-extension/main/docs/images/1-table.png"},     {"alt": "Import data into a new volume", "url": "https://raw.githubusercontent.com/docker/volumes-backup-extension/main/docs/images/2-import-new.png"},     {"alt": "Export volume dialog", "url": "https://raw.githubusercontent.com/docker/volumes-backup-extension/main/docs/images/3-export.png"},     {"alt": "Transfer volume to another host", "url": "https://raw.githubusercontent.com/docker/volumes-backup-extension/main/docs/images/4-transfer.png"},     {"alt": "Clone volume dialog", "url": "https://raw.githubusercontent.com/docker/volumes-backup-extension/main/docs/images/5-clone.png"},     {"alt": "Delete volume dialog", "url": "https://raw.githubusercontent.com/docker/volumes-backup-extension/main/docs/images/6-delete.png"}     ]
 org.opencontainers.image.description=Backup, clone, restore, and share Docker volumes effortlessly. Also available as a Beta feature in the Volumes tab in Docker Desktop version 4.29.0 and later. This extension will be soon deprecated.
-org.opencontainers.image.revision=549e8f6ae4d0c476ce4a0f2a45cda12c4bf56524
-org.opencontainers.image.source=https://github.com/docker/volumes-backup-extension
 org.opencontainers.image.title=Volumes Backup & Share
 org.opencontainers.image.vendor=Docker Inc.
Policies (1 improved, 1 worsened, 1 missing data)
Policy Name docker/volumes-backup-extension:latest docker/volumes-backup-extension:pr-148 Change Standing
Copyleft licenses No Change
Default non-root user ⚠️ ⚠️ No Change
Fixable critical and high vulnerabilities ⚠️ 1 ⚠️ 1 No Change
High-profile vulnerabilities ⚠️ 1 -1 Improved
Outdated base images ❓ No data
Supply chain attestations ⚠️ 2 +2 Worsened
Packages and Vulnerabilities (1 package changes and 0 vulnerability changes)
  • ♾️ 1 packages changed
  • 49 packages unchanged
Changes for packages of type golang (1 changes)
Package Version
docker/volumes-backup-extension:latest
Version
docker/volumes-backup-extension:pr-148
♾️ stdlib 1.22.5 go1.22.5

Signed-off-by: Guillaume Tardif <guillaume.tardif@gmail.com>
@gtardif gtardif force-pushed the revert_mui_update branch from d9f21a4 to 11f1aaf Compare July 5, 2024 15:22
Signed-off-by: Guillaume Tardif <guillaume.tardif@gmail.com>
@gtardif gtardif merged commit 44f28dd into main Jul 8, 2024
4 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants