From b93ef5f4e10828d07dc95d83879269bd84074e1b Mon Sep 17 00:00:00 2001 From: "opensearch-trigger-bot[bot]" <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 14:09:58 -0700 Subject: [PATCH 1/4] add opensearch-dashboards-docker-dev to .gitignore (#3780) (cherry picked from commit 6b42669f1168644806a9d4231077746405623c6a) Signed-off-by: Aigerim Suleimenova Signed-off-by: github-actions[bot] Co-authored-by: github-actions[bot] --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 8f252da0826f..8a46d14efe45 100644 --- a/.gitignore +++ b/.gitignore @@ -8,6 +8,7 @@ .node_binaries .native_modules node_modules +opensearch-dashboards-docker-dev/ !/src/dev/npm/integration_tests/__fixtures__/fixture1/node_modules !/src/dev/notice/__fixtures__/node_modules trash From 39818e3867cc0286367f0f92544e410b2cf7a42f Mon Sep 17 00:00:00 2001 From: Anan Zhuang Date: Tue, 4 Apr 2023 17:10:30 -0700 Subject: [PATCH 2/4] [CVE-2022-25858][1.x] Bump terser from 4.8.0 to 4.8.1 (#3726) Issue Resolved: https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1907 Signed-off-by: Anan Zhuang --- CHANGELOG.md | 1 + yarn.lock | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 56850a462778..6857bc4d2d96 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - [CVE-2022-0436] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) - [CVE-2021-23382] Bump postcss from `8.2.10` to `8.2.13` ([#3739](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3739)) - [CVE-2021-3803] Bump nth-check from `1.0.2` to `2.0.1` ([#3729](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3729)) +- [CVE-2022-25858] Bump terser from `4.8.0` to `4.8.1` ([#3726](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3726)) ### 📈 Features/Enhancements diff --git a/yarn.lock b/yarn.lock index cc02d40f9c85..cea7adaa4567 100644 --- a/yarn.lock +++ b/yarn.lock @@ -20283,9 +20283,9 @@ terser-webpack-plugin@^2.1.2: webpack-sources "^1.4.3" terser@^4.1.2, terser@^4.6.12: - version "4.8.0" - resolved "https://registry.yarnpkg.com/terser/-/terser-4.8.0.tgz#63056343d7c70bb29f3af665865a46fe03a0df17" - integrity sha512-EAPipTNeWsb/3wLPeup1tVPaXfIaU68xMnVdPafIL1TV05OhASArYyIfFvnvJCNrR2NIOvDVNNTFRa+Re2MWyw== + version "4.8.1" + resolved "https://registry.yarnpkg.com/terser/-/terser-4.8.1.tgz#a00e5634562de2239fd404c649051bf6fc21144f" + integrity sha512-4GnLC0x667eJG0ewJTa6z/yXrbLGv80D9Ru6HIpCQmO+Q4PfEtBFi0ObSckqwL6VyQv/7ENJieXHo2ANmdQwgw== dependencies: commander "^2.20.0" source-map "~0.6.1" From 5d4fdd2bd77b05c82f19a956afd3367fcc91c327 Mon Sep 17 00:00:00 2001 From: Anan Zhuang Date: Wed, 5 Apr 2023 10:47:24 -0700 Subject: [PATCH 3/4] [CVE-2022-25758][1.x]Bump scss-tokenizer from 0.3.0 to 0.4.3 (#3727) Issue Resolve https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1842 Signed-off-by: Anan Zhuang Co-authored-by: Josh Romero --- CHANGELOG.md | 1 + package.json | 1 + yarn.lock | 16 ++++++++-------- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6857bc4d2d96..f7103d0a72b3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ### 🛡 Security +- [CVE-2022-25758] Bump scss-tokenizer from `0.3.0` to `0.4.3` ([#3727](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3727)) - [CVE-2021-3765] Update `@microsoft/api-documenter` and `@microsoft/api-extractor` versions to bump validator from `8.2.0` to `13.9.0` ([#3725](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3725)) - [CVE-2022-1537] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) - [CVE-2022-0436] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) diff --git a/package.json b/package.json index 87f416cee485..030b69c308de 100644 --- a/package.json +++ b/package.json @@ -118,6 +118,7 @@ "**/react-syntax-highlighter/**/highlight.js": "^10.4.1", "**/request": "^2.88.2", "**/shelljs": "0.8.5", + "**/scss-tokenizer": "^0.4.3", "**/ssri": "^6.0.2", "**/tar": "^6.1.11", "**/trim": "^0.0.3", diff --git a/yarn.lock b/yarn.lock index cea7adaa4567..c6e63076a8e6 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13288,7 +13288,7 @@ jquery@^3.5.0: resolved "https://registry.yarnpkg.com/jquery/-/jquery-3.5.0.tgz#9980b97d9e4194611c36530e7dc46a58d7340fc9" integrity sha512-Xb7SVYMvygPxbFMpTFQiHh1J7HClEaThguL15N/Gg37Lri/qKyhRGZYzHRyLH8Stq3Aow0LsHO2O2ci86fCrNQ== -js-base64@^2.4.3: +js-base64@^2.4.9: version "2.6.4" resolved "https://registry.yarnpkg.com/js-base64/-/js-base64-2.6.4.tgz#f4e686c5de1ea1f867dbcad3d46d969428df98c4" integrity sha512-pZe//GGmwJndub7ZghVHz7vjb2LgC1m8B07Au3eYqeqv9emhESByMXxaEgkUkEqJe87oBbSniGYoQNIBklc7IQ== @@ -18796,13 +18796,13 @@ screenfull@^5.0.0: resolved "https://registry.yarnpkg.com/screenfull/-/screenfull-5.0.0.tgz#5c2010c0e84fd4157bf852877698f90b8cbe96f6" integrity sha512-yShzhaIoE9OtOhWVyBBffA6V98CDCoyHTsp8228blmqYy1Z5bddzE/4FPiJKlr8DVR4VBiiUyfPzIQPIYDkeMA== -scss-tokenizer@^0.3.0: - version "0.3.0" - resolved "https://registry.yarnpkg.com/scss-tokenizer/-/scss-tokenizer-0.3.0.tgz#ef7edc3bc438b25cd6ffacf1aa5b9ad5813bf260" - integrity sha512-14Zl9GcbBvOT9057ZKjpz5yPOyUWG2ojd9D5io28wHRYsOrs7U95Q+KNL87+32p8rc+LvDpbu/i9ZYjM9Q+FsQ== +scss-tokenizer@^0.3.0, scss-tokenizer@^0.4.3: + version "0.4.3" + resolved "https://registry.yarnpkg.com/scss-tokenizer/-/scss-tokenizer-0.4.3.tgz#1058400ee7d814d71049c29923d2b25e61dc026c" + integrity sha512-raKLgf1LI5QMQnG+RxHz6oK0sL3x3I4FN2UDLqgLOGO8hodECNnNh5BXn7fAyBxrA8zVzdQizQ6XjNJQ+uBwMw== dependencies: - js-base64 "^2.4.3" - source-map "^0.7.1" + js-base64 "^2.4.9" + source-map "^0.7.3" secure-json-parse@^2.1.0: version "2.1.0" @@ -19287,7 +19287,7 @@ source-map@^0.6.0, source-map@^0.6.1, source-map@~0.6.0, source-map@~0.6.1: resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.6.1.tgz#74722af32e9614e9c287a8d0bbde48b5e2f1a263" integrity sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g== -source-map@^0.7.1, source-map@^0.7.3: +source-map@^0.7.3: version "0.7.3" resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.7.3.tgz#5302f8169031735226544092e64981f751750383" integrity sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ== From 6af2ae2dff8bee35d9cfa58d482c45e0b04e7ddd Mon Sep 17 00:00:00 2001 From: Anan Zhuang Date: Mon, 10 Apr 2023 17:35:57 -0700 Subject: [PATCH 4/4] [CVE-2021-23490][1.x] Bump parse-link-header from 1.0.1 to 2.0.0 (#3738) Issue Resolve https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1111 Backport PR https://github.com/opensearch-project/OpenSearch-Dashboards/pull/1108 Signed-off-by: Anan Zhuang Co-authored-by: Josh Romero --- CHANGELOG.md | 1 + packages/osd-test/package.json | 2 +- yarn.lock | 8 ++++---- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f7103d0a72b3..56fa191f2d0e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ### 🛡 Security +- [CVE-2021-23490] Bump parse-link-header from `1.0.1` to `2.0.0` ([#3738](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3738)) - [CVE-2022-25758] Bump scss-tokenizer from `0.3.0` to `0.4.3` ([#3727](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3727)) - [CVE-2021-3765] Update `@microsoft/api-documenter` and `@microsoft/api-extractor` versions to bump validator from `8.2.0` to `13.9.0` ([#3725](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3725)) - [CVE-2022-1537] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) diff --git a/packages/osd-test/package.json b/packages/osd-test/package.json index b1bf2f50f4b5..3d36be8507f4 100644 --- a/packages/osd-test/package.json +++ b/packages/osd-test/package.json @@ -33,7 +33,7 @@ "glob": "^7.1.7", "joi": "^13.5.2", "lodash": "^4.17.21", - "parse-link-header": "^1.0.1", + "parse-link-header": "^2.0.0", "rxjs": "^6.5.5", "strip-ansi": "^6.0.0", "tar-fs": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index c6e63076a8e6..d01ed199296c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -16367,10 +16367,10 @@ parse-json@^5.0.0: json-parse-better-errors "^1.0.1" lines-and-columns "^1.1.6" -parse-link-header@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/parse-link-header/-/parse-link-header-1.0.1.tgz#bedfe0d2118aeb84be75e7b025419ec8a61140a7" - integrity sha1-vt/g0hGK64S+deewJUGeyKYRQKc= +parse-link-header@^2.0.0: + version "2.0.0" + resolved "https://registry.yarnpkg.com/parse-link-header/-/parse-link-header-2.0.0.tgz#949353e284f8aa01f2ac857a98f692b57733f6b7" + integrity sha512-xjU87V0VyHZybn2RrCX5TIFGxTVZE6zqqZWMPlIKiSKuWh/X5WZdt+w1Ki1nXB+8L/KtL+nZ4iq+sfI6MrhhMw== dependencies: xtend "~4.0.1"