Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address CVEs #125

Merged
merged 1 commit into from
Jan 16, 2025
Merged

Address CVEs #125

merged 1 commit into from
Jan 16, 2025

Conversation

mprahl
Copy link

@mprahl mprahl commented Jan 15, 2025

This updates:

This also updates to Node.js 22.

Many of the CVEs addressed are not in the delivered product, but it can help to avoid false positives from CVE scanners and avoid CVEs during development.

Relates:
https://issues.redhat.com/browse/RHOAIENG-17816

@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Jan 15, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from mprahl. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@dsp-developers
Copy link

Commit Checker results:

**NOTE**: These are the results of the commit checker scans. 
If these are not commits from upstream kfp, then please ensure
you adhere to the commit checker formatting

commitchecker verson unknown
Validating 1 commits between 2969fcac9a590bc26c59ca95a9ed8eacc514b6a3...453c61776636f925467e8fc8fc92f26c2b926b03

UPSTREAM commit 453c617 has invalid summary Address CVEs.

UPSTREAM commits are validated against the following regular expression:
  ^UPSTREAM: (revert: )?(([\w.-]+/[\w-.-]+)?: )?(\d+:|<carry>:|<drop>:)

UPSTREAM commit summaries should look like:

  UPSTREAM: <PR number|carry|drop>: description

UPSTREAM commits which revert previous UPSTREAM commits should look like:

  UPSTREAM: revert: <normal upstream format>

Examples of valid summaries:

  UPSTREAM: 12345: A kube fix
  UPSTREAM: <carry>: A carried kube change
  UPSTREAM: <drop>: A dropped kube change
  UPSTREAM: revert: 12345: A kube revert

hbelmiro
hbelmiro reviewed Jan 16, 2025
View reviewed changes
Copy link

@hbelmiro hbelmiro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm label Jan 16, 2025
DharmitD
DharmitD reviewed Jan 16, 2025
View reviewed changes
kubernetes_platform/go.mod

require (
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mprahl could you please confirm that you ran a go mod tidy for the go.mod changes here? Just want to make sure since I don't see a corresponding go.sum file.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! I forgot to commit it.

@mprahl
Copy link
Author

mprahl commented Jan 16, 2025

/hold

@openshift-ci openshift-ci bot removed the lgtm label Jan 16, 2025
@mprahl
Address CVEs
577d131 
This updates:
- nanoid (JavaScript) (CVE-2024-55565)
- path-to-regexp (JavaScript) (CVE-2024-52798)
- golang.org/x/net (Go) (CVE-2024-45338)

This also updates to Node.js 22.

Many of the CVEs addressed are not in the delivered product, but it can
help to avoid false positives from CVE scanners and avoid CVEs during
development.

Relates:
https://issues.redhat.com/browse/RHOAIENG-17816

Signed-off-by: mprahl <[email protected]>
@dsp-developers
Copy link

Commit Checker results:

**NOTE**: These are the results of the commit checker scans. 
If these are not commits from upstream kfp, then please ensure
you adhere to the commit checker formatting

commitchecker verson unknown
Validating 1 commits between 2969fcac9a590bc26c59ca95a9ed8eacc514b6a3...8f5907de1046e9e20ef0f035041dc538bdc8042d

UPSTREAM commit 8f5907d has invalid summary Address CVEs.

UPSTREAM commits are validated against the following regular expression:
  ^UPSTREAM: (revert: )?(([\w.-]+/[\w-.-]+)?: )?(\d+:|<carry>:|<drop>:)

UPSTREAM commit summaries should look like:

  UPSTREAM: <PR number|carry|drop>: description

UPSTREAM commits which revert previous UPSTREAM commits should look like:

  UPSTREAM: revert: <normal upstream format>

Examples of valid summaries:

  UPSTREAM: 12345: A kube fix
  UPSTREAM: <carry>: A carried kube change
  UPSTREAM: <drop>: A dropped kube change
  UPSTREAM: revert: 12345: A kube revert

@mprahl
Copy link
Author

mprahl commented Jan 16, 2025

/unhold

@mprahl mprahl requested review from DharmitD and hbelmiro January 16, 2025 14:42
@dsp-developers
Copy link

Commit Checker results:

**NOTE**: These are the results of the commit checker scans. 
If these are not commits from upstream kfp, then please ensure
you adhere to the commit checker formatting

commitchecker verson unknown
Validating 1 commits between 2969fcac9a590bc26c59ca95a9ed8eacc514b6a3...577d1310b1ae58b6ef8af5e9a879ce46fe9929c8

UPSTREAM commit 577d131 has invalid summary Address CVEs.

UPSTREAM commits are validated against the following regular expression:
  ^UPSTREAM: (revert: )?(([\w.-]+/[\w-.-]+)?: )?(\d+:|<carry>:|<drop>:)

UPSTREAM commit summaries should look like:

  UPSTREAM: <PR number|carry|drop>: description

UPSTREAM commits which revert previous UPSTREAM commits should look like:

  UPSTREAM: revert: <normal upstream format>

Examples of valid summaries:

  UPSTREAM: 12345: A kube fix
  UPSTREAM: <carry>: A carried kube change
  UPSTREAM: <drop>: A dropped kube change
  UPSTREAM: revert: 12345: A kube revert

@dsp-developers
Copy link

Change to PR detected. A new PR build was completed.
A set of new images have been built to help with testing out this PR:
API Server: quay.io/opendatahub/ds-pipelines-api-server:pr-125
DSP DRIVER: quay.io/opendatahub/ds-pipelines-driver:pr-125
DSP LAUNCHER: quay.io/opendatahub/ds-pipelines-launcher:pr-125
Persistence Agent: quay.io/opendatahub/ds-pipelines-persistenceagent:pr-125
Scheduled Workflow Manager: quay.io/opendatahub/ds-pipelines-scheduledworkflow:pr-125
MLMD Server: quay.io/opendatahub/mlmd-grpc-server:latest
MLMD Envoy Proxy: registry.redhat.io/openshift-service-mesh/proxyv2-rhel8:2.3.9-2
UI: quay.io/opendatahub/ds-pipelines-frontend:pr-125

1 similar comment
@dsp-developers
Copy link

Change to PR detected. A new PR build was completed.
A set of new images have been built to help with testing out this PR:
API Server: quay.io/opendatahub/ds-pipelines-api-server:pr-125
DSP DRIVER: quay.io/opendatahub/ds-pipelines-driver:pr-125
DSP LAUNCHER: quay.io/opendatahub/ds-pipelines-launcher:pr-125
Persistence Agent: quay.io/opendatahub/ds-pipelines-persistenceagent:pr-125
Scheduled Workflow Manager: quay.io/opendatahub/ds-pipelines-scheduledworkflow:pr-125
MLMD Server: quay.io/opendatahub/mlmd-grpc-server:latest
MLMD Envoy Proxy: registry.redhat.io/openshift-service-mesh/proxyv2-rhel8:2.3.9-2
UI: quay.io/opendatahub/ds-pipelines-frontend:pr-125

@mprahl
Copy link
Author

mprahl commented Jan 16, 2025

@hbelmiro and @DharmitD could you please take another look?

DharmitD
DharmitD reviewed Jan 16, 2025
View reviewed changes
Copy link
Member

@DharmitD DharmitD left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm label Jan 16, 2025
hbelmiro
hbelmiro reviewed Jan 16, 2025
View reviewed changes
Copy link

@hbelmiro hbelmiro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@mprahl mprahl merged commit dcf2d0e into opendatahub-io:master Jan 16, 2025
4 of 5 checks passed
@dsp-developers
Copy link

Commit Checker results:

**NOTE**: These are the results of the commit checker scans. 
If these are not commits from upstream kfp, then please ensure
you adhere to the commit checker formatting

commitchecker verson unknown
Validating 0 commits between dcf2d0e86e8470a2fbcd87401a9d09ed1e35f0ed...577d1310b1ae58b6ef8af5e9a879ce46fe9929c8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hbelmiro hbelmiro hbelmiro left review comments

@DharmitD DharmitD DharmitD left review comments

@rimolive rimolive Awaiting requested review from rimolive

@HumairAK HumairAK Awaiting requested review from HumairAK

Assignees

@hbelmiro hbelmiro

@DharmitD DharmitD

Labels
lgtm
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@mprahl @dsp-developers @hbelmiro @DharmitD