Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update @itwin/object-storage to 2.2.5 #7082

Merged
merged 8 commits into from
Aug 14, 2024
Merged

Update @itwin/object-storage to 2.2.5 #7082

merged 8 commits into from
Aug 14, 2024

Conversation

pmconne
Copy link
Member

@pmconne pmconne commented Aug 14, 2024 •
edited
Loading

Reverts #7078 now that CVE is patched.

@pmconne pmconne enabled auto-merge (squash) August 14, 2024 11:09
@pmconne
Copy link
Member Author

pmconne commented Aug 14, 2024

Wheee...

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Server-Side Request Forgery in axios                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ axios                                                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=1.3.2 <=1.7.3                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.7.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ../../full-stack-tests/core >                          │
│                     │ @itwin/reality-data-client@1.2.1 > axios@1.7.3         │
│                     │                                                        │
│                     │ ../../test-apps/display-performance-test-app >         │
│                     │ @itwin/reality-data-client@1.2.1 > axios@1.7.3         │
│                     │                                                        │
│                     │ ../../test-apps/display-test-app >                     │
│                     │ @itwin/reality-data-client@1.2.1 > axios@1.7.3         │
│                     │                                                        │
│                     │ ... Found 42 paths, run `pnpm why axios` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ /~https://github.com/advisories/GHSA-8hc4-vh64-cxmj      │
└─────────────────────┴────────────────────────────────────────────────────────┘

@pmconne pmconne mentioned this pull request Aug 14, 2024
Closed
@pmconne
Copy link
Member Author

pmconne commented Aug 14, 2024

Fun! @austeja-bentley

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Server-Side Request Forgery in axios                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ axios                                                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=1.3.2 <=1.7.3                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.7.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ../../full-stack-tests/backend >                       │
│                     │ @itwin/imodels-access-backend@5.1.2 >                  │
│                     │ @itwin/imodels-access-common@5.1.2 >                   │
│                     │ @itwin/imodels-client-management@5.6.0 > axios@1.6.8   │
│                     │                                                        │
│                     │ ../../full-stack-tests/backend >                       │
│                     │ @itwin/imodels-access-backend@5.1.2 >                  │
│                     │ @itwin/imodels-client-authoring@5.6.0 >                │
│                     │ @itwin/imodels-client-management@5.6.0 > axios@1.6.8   │
│                     │                                                        │
│                     │ ../../full-stack-tests/backend >                       │
│                     │ @itwin/imodels-access-backend@5.1.2 > axios@1.6.8      │
│                     │                                                        │
│                     │ ... Found 39 paths, run `pnpm why axios` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ /~https://github.com/advisories/GHSA-8hc4-vh64-cxmj      │
└─────────────────────┴────────────────────────────────────────────────────────┘

@pmconne
Copy link
Member Author

pmconne commented Aug 14, 2024

Waiting on iTwin/imodels-clients#272

@austeja-bentley
Copy link
Contributor

Waiting on iTwin/imodels-clients#272

released new versions:
@itwin/imodels-client-management, @itwin/imodels-client-authoring - 5.8.1
@itwin/imodels-access-frontend, @itwin/imodels-access-backend - 5.2.1

@pmconne pmconne merged commit 30584ce into master Aug 14, 2024
16 checks passed
@pmconne pmconne deleted the pmc/object-storage-2.2.5 branch August 14, 2024 16:41
@ben-polinsky
Copy link
Contributor

@Mergifyio backport release/4.8.x

@mergify Mergify
Copy link
Contributor

mergify bot commented Aug 14, 2024 •
edited
Loading

backport release/4.8.x

✅ Backports have been created

mergify bot pushed a commit that referenced this pull request Aug 14, 2024
@pmconne @mergify
Update @itwin/object-storage to 2.2.5 (#7082)
727e37f 
(cherry picked from commit 30584ce)

# Conflicts:
#	common/config/rush/pnpm-lock.yaml
#	core/backend/package.json
#	core/common/package.json
#	core/frontend/package.json
#	full-stack-tests/core/package.json
#	test-apps/display-test-app/package.json
@mergify mergify bot mentioned this pull request Aug 14, 2024
Merged
ben-polinsky added a commit that referenced this pull request Aug 14, 2024
@mergify @pmconne
@ben-polinsky @aruniverse
Update @itwin/object-storage to 2.2.5 (backport #7082) [release/4.8.x] (
1744e93 
#7085)

Co-authored-by: Paul Connelly <22944042+pmconne@users.noreply.github.com>
Co-authored-by: Ben Polinsky <ben-polinsky@users.noreply.github.com>
Co-authored-by: Ben Polinsky <78756012+ben-polinsky@users.noreply.github.com>
Co-authored-by: Arun George <11051042+aruniverse@users.noreply.github.com>
naronchen pushed a commit that referenced this pull request Sep 27, 2024
@pmconne
Update @itwin/object-storage to 2.2.5 (#7082)
9cf4a05
naronchen pushed a commit that referenced this pull request Sep 30, 2024
@pmconne
Update @itwin/object-storage to 2.2.5 (#7082)
c5a1a70
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ColinKerr ColinKerr ColinKerr approved these changes

@aruniverse aruniverse aruniverse approved these changes

@bbastings bbastings Awaiting requested review from bbastings

@ben-polinsky ben-polinsky Awaiting requested review from ben-polinsky

@paulius-valiunas paulius-valiunas Awaiting requested review from paulius-valiunas

@wgoehrig wgoehrig Awaiting requested review from wgoehrig

@christophermlawson christophermlawson Awaiting requested review from christophermlawson

@StefanApfel-Bentley StefanApfel-Bentley Awaiting requested review from StefanApfel-Bentley

Assignees
No one assigned
Labels
security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@pmconne @austeja-bentley @ben-polinsky @aruniverse @ColinKerr