Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CVE-2024-4067][CVE-2024-4068] Bump packages dependent on braces versions lower than 3.0.3 #6911

Merged
merged 1 commit into from
Jun 5, 2024

Conversation

AMoo-Miki
Copy link
Collaborator

@AMoo-Miki AMoo-Miki commented Jun 5, 2024

Bumped packages:

  • @amoo-miki/webpack to 4.46.0-xxhash.1
  • micromatch to 4.0.7
  • @types/watchpack to 2.4.4
  • watchpack to 2.4.1

Removed:

  • @types/globby

Issues Resolved

Fixes #6791
Fixes #6792

Changelog

  • skip

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

Copy link
Contributor

github-actions bot commented Jun 5, 2024

❌ Changelog Entry Missing Hyphen

Changelog entries must begin with a hyphen (-).

Copy link

codecov bot commented Jun 5, 2024

Codecov Report

Attention: Patch coverage is 0% with 1 line in your changes missing coverage. Please review.

Project coverage is 67.44%. Comparing base (c6820db) to head (2521f5c).
Report is 3 commits behind head on main.

Files Patch % Lines
packages/osd-optimizer/src/optimizer/watcher.ts 0.00% 1 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #6911   +/-   ##
=======================================
  Coverage   67.44%   67.44%           
=======================================
  Files        3444     3444           
  Lines       67849    67849           
  Branches    11035    11035           
=======================================
  Hits        45764    45764           
  Misses      19418    19418           
  Partials     2667     2667           
Flag Coverage Δ
Linux_1 33.08% <0.00%> (ø)
Linux_2 55.12% <0.00%> (ø)
Linux_3 45.29% <ø> (+0.01%) ⬆️
Linux_4 34.82% <0.00%> (ø)
Windows_1 33.10% <0.00%> (ø)
Windows_2 55.09% <0.00%> (ø)
Windows_3 45.29% <ø> (ø)
Windows_4 34.82% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@AMoo-Miki AMoo-Miki force-pushed the bump-braces branch 2 times, most recently from 670ee35 to f02878c Compare June 5, 2024 02:59
…rsions lower than 3.0.3

Bumped packages:
* `@amoo-miki/webpack` to `4.46.0-xxhash.1`
* `micromatch` to `4.0.7`
* `@types/watchpack` to `2.4.4`
* `watchpack` to `2.4.1`

Removed:
* `@types/globby`

Signed-off-by: Miki <miki@amazon.com>
@@ -49,6 +49,6 @@
"sass-embedded": "1.66.1",
"sass-loader": "npm:@amoo-miki/sass-loader@10.4.1-node-sass-9.0.0-libsass-3.6.5-with-sass-embedded.rc1",
"val-loader": "^2.1.2",
"webpack": "npm:@amoo-miki/webpack@4.46.0-rc.2"
"webpack": "npm:@amoo-miki/webpack@4.46.0-xxhash.1"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

xxhash?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. The patched webpack I released was to add and make that algo the default.

Copy link
Contributor

github-actions bot commented Jun 5, 2024

❌ Changeset File Must Not Exist With Skip Entry

Changeset file 6911.yml under folder changelogs/fragments must not exist if ##Changelog section in PR description includes a "skip" entry option. Please remove the changeset file and try again.

@AMoo-Miki AMoo-Miki merged commit 418bf19 into opensearch-project:main Jun 5, 2024
64 of 67 checks passed
@opensearch-trigger-bot
Copy link
Contributor

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-6911-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 418bf192692627ce32f4b9c0fb1a4eca1c8f26f5
# Push it to GitHub
git push --set-upstream origin backport/backport-6911-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-6911-to-2.x.

AMoo-Miki added a commit to AMoo-Miki/OpenSearch-Dashboards that referenced this pull request Jun 5, 2024
…rsions lower than 3.0.3 (opensearch-project#6911)

Bumped packages:
* `@amoo-miki/webpack` to `4.46.0-xxhash.1`
* `micromatch` to `4.0.7`
* `@types/watchpack` to `2.4.4`
* `watchpack` to `2.4.1`

Removed:
* `@types/globby`

cherry-picked from 418bf19

Signed-off-by: Miki <miki@amazon.com>
AMoo-Miki added a commit to AMoo-Miki/OpenSearch-Dashboards that referenced this pull request Jun 7, 2024
…rsions lower than 3.0.3 (opensearch-project#6911)

Bumped packages:
* `@amoo-miki/webpack` to `4.46.0-xxhash.1`
* `micromatch` to `4.0.7`
* `@types/watchpack` to `2.4.4`
* `watchpack` to `2.4.1`

Removed:
* `@types/globby`

cherry-picked from 418bf19

Signed-off-by: Miki <miki@amazon.com>
AMoo-Miki added a commit to AMoo-Miki/OpenSearch-Dashboards that referenced this pull request Jun 7, 2024
…rsions lower than 3.0.3 (opensearch-project#6911)

Bumped packages:
* `@amoo-miki/webpack` to `4.46.0-xxhash.1`
* `micromatch` to `4.0.7`
* `@types/watchpack` to `2.4.4`
* `watchpack` to `2.4.1`

Removed:
* `@types/globby`

cherry-picked from 418bf19

Signed-off-by: Miki <miki@amazon.com>
ZilongX pushed a commit that referenced this pull request Jun 7, 2024
…rsions lower than 3.0.3 (#6911) (#6925)

Bumped packages:
* `@amoo-miki/webpack` to `4.46.0-xxhash.1`
* `micromatch` to `4.0.7`
* `@types/watchpack` to `2.4.4`
* `watchpack` to `2.4.1`

Removed:
* `@types/globby`

cherry-picked from 418bf19

Signed-off-by: Miki <miki@amazon.com>
@zhyuanqi zhyuanqi added the cve Security vulnerabilities detected by Dependabot or Mend label Jun 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 2.x cve Security vulnerabilities detected by Dependabot or Mend distinguished-contributor failed changeset v2.15.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2024-4068 (High) detected in multiple libraries CVE-2024-4067 (Medium) detected in multiple libraries
4 participants