Skip to content

Commit

Permalink
[1.3][CVE-2022-33987] Partially fix security issues for got
Browse files Browse the repository at this point in the history 
This CVE requires to update got to 11.8.5 or 12.1.0. got is used in multiple versions
3.3.1
5.6.0
6.7.1
7.1.0
8.3.2
9.6.0
11.8.2

For 11.8.2, we need to clean yarn.lock and bootstrap.
For 3.3.1, we could bump @elastic/makelogs to 6.1.1.
Other versions can't be fixed in 1.x.

Signed-off-by: ananzh <[email protected]>
  • Loading branch information
@ananzh
ananzh committed Sep 13, 2023
1 parent 22657d7 commit 9f084b4
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 131 deletions.
2 changes: 1 addition & 1 deletion package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,7 @@
"@elastic/eslint-config-kibana": "0.15.0",
"@elastic/eslint-plugin-eui": "0.0.2",
"@elastic/filesaver": "1.1.2",
"@elastic/makelogs": "^6.0.0",
"@elastic/makelogs": "^6.1.1",
"@osd/babel-preset": "1.0.0",
"@osd/dev-utils": "1.0.0",
"@osd/opensearch": "1.0.0",
Expand Down
149 changes: 19 additions & 130 deletions yarn.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1248,10 +1248,10 @@
oppsy "2.x.x"
pumpify "1.3.x"

"@elastic/makelogs@^6.0.0":
version "6.0.0"
resolved "https://registry.yarnpkg.com/@elastic/makelogs/-/makelogs-6.0.0.tgz#d6d74d5d0f020123c54160370d49ca5e0aab1fe1"
integrity sha512-i+BMxM3pKy9CAqcvMvdHLxvM0Dlnx+4JeScWHM9fFn4+2rAHGCqWflm/UGhTgQh3xn+yXKMLoEbfMIi5Aw1ysw==
"@elastic/makelogs@^6.1.1":
version "6.1.1"
resolved "https://registry.yarnpkg.com/@elastic/makelogs/-/makelogs-6.1.1.tgz#5bc173b16acdfd7844fd85c97824ddcffd67cfb3"
integrity sha512-cmfXFQITwyT4SV+Ryerg/vVbGQ9E2BhYKQ9flG85Ba3blGVmOjkgv7TYQam6xAIvGXFGBBrcyqEwmuw7xZ5ZNQ==
dependencies:
async "^1.4.2"
commander "^5.0.0"
Expand All @@ -1260,7 +1260,6 @@
moment "^2.10.6"
progress "^1.1.8"
through2 "^2.0.0"
update-notifier "^0.5.0"

"@elastic/[email protected]":
version "1.1.1"
Expand Down Expand Up @@ -5513,17 +5512,17 @@ cacheable-request@^6.0.0:
normalize-url "^4.1.0"
responselike "^1.0.2"

cacheable-request@^7.0.1:
version "7.0.1"
resolved "https://registry.yarnpkg.com/cacheable-request/-/cacheable-request-7.0.1.tgz#062031c2856232782ed694a257fa35da93942a58"
integrity sha512-lt0mJ6YAnsrBErpTMWeu5kl/tg9xMAWjavYTN6VQXM1A/teBITuNcccXsCxF0tDQQJf9DfAaX5O4e0zp0KlfZw==
cacheable-request@^7.0.2:
version "7.0.4"
resolved "https://registry.yarnpkg.com/cacheable-request/-/cacheable-request-7.0.4.tgz#7a33ebf08613178b403635be7b899d3e69bbe817"
integrity sha512-v+p6ongsrp0yTGbJXjgxPow2+DL93DASP4kXCDKb8/bwRtt9OEF3whggkkDkGNzgcWy2XaF4a8nZglC7uElscg==
dependencies:
clone-response "^1.0.2"
get-stream "^5.1.0"
http-cache-semantics "^4.0.0"
keyv "^4.0.0"
lowercase-keys "^2.0.0"
normalize-url "^4.1.0"
normalize-url "^6.0.1"
responselike "^2.0.0"

caching-transform@^3.0.2:
Expand Down Expand Up @@ -6466,20 +6465,6 @@ config-chain@^1.1.11:
ini "^1.3.4"
proto-list "~1.2.1"

configstore@^1.0.0:
version "1.4.0"
resolved "https://registry.yarnpkg.com/configstore/-/configstore-1.4.0.tgz#c35781d0501d268c25c54b8b17f6240e8a4fb021"
integrity sha1-w1eB0FAdJowlxUuLF/YkDopPsCE=
dependencies:
graceful-fs "^4.1.2"
mkdirp "^0.5.0"
object-assign "^4.0.1"
os-tmpdir "^1.0.0"
osenv "^0.1.0"
uuid "^2.0.1"
write-file-atomic "^1.1.2"
xdg-basedir "^2.0.0"

configstore@^3.0.0, configstore@^3.1.2:
version "3.1.2"
resolved "https://registry.yarnpkg.com/configstore/-/configstore-3.1.2.tgz#c6f25defaeef26df12dd33414b001fe81a543f8f"
Expand Down Expand Up @@ -7986,7 +7971,7 @@ duplexer@^0.1.1:
resolved "https://registry.yarnpkg.com/duplexer/-/duplexer-0.1.1.tgz#ace6ff808c1ce66b57d1ebf97977acb02334cfc1"
integrity sha1-rOb/gIwc5mtX0ev5eXessCM0z8E=

duplexify@^3.2.0, duplexify@^3.4.2, duplexify@^3.5.3:
duplexify@^3.4.2, duplexify@^3.5.3:
version "3.7.1"
resolved "https://registry.yarnpkg.com/duplexify/-/duplexify-3.7.1.tgz#2a4df5317f6ccfd91f86d6fd25d8d8a103b88309"
integrity sha512-07z8uv2wMyS51kKhD1KsdXJg5WQ6t93RneqRxUHnskXVtlYYkLqM0gqStQZ3pj073g687jPCHrqNfCzawLYh5g==
Expand Down Expand Up @@ -10278,38 +10263,22 @@ [email protected]:
url-parse-lax "^1.0.0"

got@^11.8.2:
version "11.8.2"
resolved "https://registry.yarnpkg.com/got/-/got-11.8.2.tgz#7abb3959ea28c31f3576f1576c1effce23f33599"
integrity sha512-D0QywKgIe30ODs+fm8wMZiAcZjypcCodPNuMz5H9Mny7RJ+IjJ10BdmGW7OM7fHXP+O7r6ZwapQ/YQmMSvB0UQ==
version "11.8.6"
resolved "https://registry.yarnpkg.com/got/-/got-11.8.6.tgz#276e827ead8772eddbcfc97170590b841823233a"
integrity sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g==
dependencies:
"@sindresorhus/is" "^4.0.0"
"@szmarczak/http-timer" "^4.0.5"
"@types/cacheable-request" "^6.0.1"
"@types/responselike" "^1.0.0"
cacheable-lookup "^5.0.3"
cacheable-request "^7.0.1"
cacheable-request "^7.0.2"
decompress-response "^6.0.0"
http2-wrapper "^1.0.0-beta.5.2"
lowercase-keys "^2.0.0"
p-cancelable "^2.0.0"
responselike "^2.0.0"

got@^3.2.0:
version "3.3.1"
resolved "https://registry.yarnpkg.com/got/-/got-3.3.1.tgz#e5d0ed4af55fc3eef4d56007769d98192bcb2eca"
integrity sha1-5dDtSvVfw+701WAHdp2YGSvLLso=
dependencies:
duplexify "^3.2.0"
infinity-agent "^2.0.0"
is-redirect "^1.0.0"
is-stream "^1.0.0"
lowercase-keys "^1.0.0"
nested-error-stacks "^1.0.0"
object-assign "^3.0.0"
prepend-http "^1.0.0"
read-all-stream "^3.0.0"
timed-out "^2.0.0"

got@^6.2.0, got@^6.7.1:
version "6.7.1"
resolved "https://registry.yarnpkg.com/got/-/got-6.7.1.tgz#240cd05785a9a18e561dc1b44b41c763ef1e8db0"
Expand Down Expand Up @@ -11489,11 +11458,6 @@ infer-owner@^1.0.3, infer-owner@^1.0.4:
resolved "https://registry.yarnpkg.com/infer-owner/-/infer-owner-1.0.4.tgz#c4cefcaa8e51051c2a40ba2ce8a3d27295af9467"
integrity sha512-IClj+Xz94+d7irH5qRyfJonOdfTzuDaifE6ZPWfx0N0+/ATZCbuTPq2prFl526urkQd90WyUKIh1DfBQ2hMz9A==

infinity-agent@^2.0.0:
version "2.0.3"
resolved "https://registry.yarnpkg.com/infinity-agent/-/infinity-agent-2.0.3.tgz#45e0e2ff7a9eb030b27d62b74b3744b7a7ac4216"
integrity sha1-ReDi/3qesDCyfWK3SzdEt6esQhY=

inflight@^1.0.4:
version "1.0.6"
resolved "https://registry.yarnpkg.com/inflight/-/inflight-1.0.6.tgz#49bd6331d7d02d0c09bc910a1075ba8165b56df9"
Expand Down Expand Up @@ -13392,13 +13356,6 @@ kuler@^2.0.0:
resolved "https://registry.yarnpkg.com/kuler/-/kuler-2.0.0.tgz#e2c570a3800388fb44407e851531c1d670b061b3"
integrity sha512-Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A==

latest-version@^1.0.0:
version "1.0.1"
resolved "https://registry.yarnpkg.com/latest-version/-/latest-version-1.0.1.tgz#72cfc46e3e8d1be651e1ebb54ea9f6ea96f374bb"
integrity sha1-cs/Ebj6NG+ZR4eu1Tqn26pbzdLs=
dependencies:
package-json "^1.0.0"

latest-version@^3.0.0, latest-version@^3.1.0:
version "3.1.0"
resolved "https://registry.yarnpkg.com/latest-version/-/latest-version-3.1.0.tgz#a205383fea322b33b5ae3b18abee0dc2f356ee15"
Expand Down Expand Up @@ -15015,13 +14972,6 @@ neo-async@^2.5.0, neo-async@^2.6.0, neo-async@^2.6.1:
resolved "https://registry.yarnpkg.com/neo-async/-/neo-async-2.6.1.tgz#ac27ada66167fa8849a6addd837f6b189ad2081c"
integrity sha512-iyam8fBuCUpWeKPGpaNMetEocMt364qkCsfL9JuhjXX6dRnguRVOfk2GZaDpPjcOKiiXCPINZC1GczQ7iTq3Zw==

nested-error-stacks@^1.0.0:
version "1.0.2"
resolved "https://registry.yarnpkg.com/nested-error-stacks/-/nested-error-stacks-1.0.2.tgz#19f619591519f096769a5ba9a86e6eeec823c3cf"
integrity sha1-GfYZWRUZ8JZ2mlupqG5u7sgjw88=
dependencies:
inherits "~2.0.1"

nested-error-stacks@^2.0.0, nested-error-stacks@^2.1.0:
version "2.1.0"
resolved "https://registry.yarnpkg.com/nested-error-stacks/-/nested-error-stacks-2.1.0.tgz#0fbdcf3e13fe4994781280524f8b96b0cdff9c61"
Expand Down Expand Up @@ -15299,7 +15249,7 @@ normalize-range@^0.1.2:
resolved "https://registry.yarnpkg.com/normalize-range/-/normalize-range-0.1.2.tgz#2d10c06bdfd312ea9777695a4d28439456b75942"
integrity sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=

[email protected], normalize-url@^4.1.0, normalize-url@^4.5.1:
[email protected], normalize-url@^4.1.0, normalize-url@^4.5.1, normalize-url@^6.0.1:
version "4.5.1"
resolved "https://registry.yarnpkg.com/normalize-url/-/normalize-url-4.5.1.tgz#0dd90cf1288ee1d1313b87081c9a5932ee48518a"
integrity sha512-9UZCFRHQdNrfTpGg8+1INIg93B6zE0aXMVFkw1WFwvO4SlZywU6aLg5Of0Ap/PgcbSw4LNxvMWXMeugwMCX0AA==
Expand Down Expand Up @@ -15452,11 +15402,6 @@ [email protected], object-assign@^4, object-assign@^4.0.1, object-assign@^4.1.0,
resolved "https://registry.yarnpkg.com/object-assign/-/object-assign-4.1.1.tgz#2109adc7965887cfc05cbbd442cac8bfbb360863"
integrity sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM=

object-assign@^3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/object-assign/-/object-assign-3.0.0.tgz#9bedd5ca0897949bca47e7ff408062d549f587f2"
integrity sha1-m+3VygiXlJvKR+f/QIBi1Un1h/I=

object-copy@^0.1.0:
version "0.1.0"
resolved "https://registry.yarnpkg.com/object-copy/-/object-copy-0.1.0.tgz#7e7d858b781bd7c991a41ba975ed3812754e998c"
Expand Down Expand Up @@ -15770,7 +15715,7 @@ os-tmpdir@^1.0.0, os-tmpdir@~1.0.1, os-tmpdir@~1.0.2:
resolved "https://registry.yarnpkg.com/os-tmpdir/-/os-tmpdir-1.0.2.tgz#bbe67406c79aa85c5cfec766fe5734555dfa1274"
integrity sha1-u+Z0BseaqFxc/sdm/lc0VV36EnQ=

osenv@^0.1.0, osenv@^0.1.4:
osenv@^0.1.4:
version "0.1.5"
resolved "https://registry.yarnpkg.com/osenv/-/osenv-0.1.5.tgz#85cdfafaeb28e8677f416e287592b5f3f49ea410"
integrity sha512-0CWcCECdMVc2Rw3U5w9ZjqX6ga6ubk1xDVKxtBQPK7wis/0F2r9T6k4ydGYhecl7YUBxBVxhL5oisPsNxAPe2g==
Expand Down Expand Up @@ -15955,14 +15900,6 @@ package-hash@^3.0.0:
lodash.flattendeep "^4.4.0"
release-zalgo "^1.0.0"

package-json@^1.0.0:
version "1.2.0"
resolved "https://registry.yarnpkg.com/package-json/-/package-json-1.2.0.tgz#c8ecac094227cdf76a316874ed05e27cc939a0e0"
integrity sha1-yOysCUInzfdqMWh07QXifMk5oOA=
dependencies:
got "^3.2.0"
registry-url "^3.0.0"

package-json@^4.0.0:
version "4.0.1"
resolved "https://registry.yarnpkg.com/package-json/-/package-json-4.0.1.tgz#8869a0401253661c4c4ca3da6c2121ed555f5eed"
Expand Down Expand Up @@ -16626,7 +16563,7 @@ prelude-ls@~1.1.2:
resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.1.2.tgz#21932a549f5e52ffd9a827f570e04be62a97da54"
integrity sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=

prepend-http@^1.0.0, prepend-http@^1.0.1:
prepend-http@^1.0.1:
version "1.0.4"
resolved "https://registry.yarnpkg.com/prepend-http/-/prepend-http-1.0.4.tgz#d4f4562b0ce3696e41ac52d0e002e57a635dc6dc"
integrity sha1-1PRWKwzjaW5BrFLQ4ALlemNdxtw=
Expand Down Expand Up @@ -17799,7 +17736,7 @@ registry-auth-token@^4.0.0:
dependencies:
rc "^1.2.8"

registry-url@^3.0.0, registry-url@^3.0.3, registry-url@^3.1.0:
registry-url@^3.0.3, registry-url@^3.1.0:
version "3.1.0"
resolved "https://registry.yarnpkg.com/registry-url/-/registry-url-3.1.0.tgz#3d4ef870f73dde1d77f0cf9a381432444e174942"
integrity sha1-PU74cPc93h138M+aOBQyRE4XSUI=
Expand Down Expand Up @@ -17970,13 +17907,6 @@ repeat-string@^1.5.4, repeat-string@^1.6.1:
resolved "https://registry.yarnpkg.com/repeat-string/-/repeat-string-1.6.1.tgz#8dcae470e1c88abc2d600fff4a776286da75e637"
integrity sha1-jcrkcOHIirwtYA//Sndihtp15jc=

repeating@^1.1.2:
version "1.1.3"
resolved "https://registry.yarnpkg.com/repeating/-/repeating-1.1.3.tgz#3d4114218877537494f97f77f9785fab810fa4ac"
integrity sha1-PUEUIYh3U3SU+X93+Xhfq4EPpKw=
dependencies:
is-finite "^1.0.0"

repeating@^2.0.0:
version "2.0.1"
resolved "https://registry.yarnpkg.com/repeating/-/repeating-2.0.1.tgz#5214c53a926d3552707527fbab415dbc08d06dda"
Expand Down Expand Up @@ -18884,7 +18814,7 @@ slice-ansi@^2.1.0:
astral-regex "^1.0.0"
is-fullwidth-code-point "^2.0.0"

slide@^1.1.5, slide@~1.1.3:
slide@~1.1.3:
version "1.1.6"
resolved "https://registry.yarnpkg.com/slide/-/slide-1.1.6.tgz#56eb027d65b4d2dce6cb2e2d32c4d4afc9e1d707"
integrity sha1-VusCfWW00tzmyy4tMsTUr8nh1wc=
Expand Down Expand Up @@ -19368,13 +19298,6 @@ string-argv@~0.3.1:
resolved "https://registry.yarnpkg.com/string-argv/-/string-argv-0.3.1.tgz#95e2fbec0427ae19184935f816d74aaa4c5c19da"
integrity sha512-a1uQGz7IyVy9YwhqjZIZu1c8JO8dNIe20xBmSS6qu9kv++k3JGzCVmprbNN5Kn+BgzD5E7YYwg1CcjuJMRNsvg==

string-length@^1.0.0:
version "1.0.1"
resolved "https://registry.yarnpkg.com/string-length/-/string-length-1.0.1.tgz#56970fb1c38558e9e70b728bf3de269ac45adfac"
integrity sha1-VpcPscOFWOnnC3KL894mmsRa36w=
dependencies:
strip-ansi "^3.0.0"

string-length@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/string-length/-/string-length-2.0.0.tgz#d40dbb686a3ace960c1cffca562bf2c45f8363ed"
Expand Down Expand Up @@ -20864,19 +20787,6 @@ upath@^1.1.1:
resolved "https://registry.yarnpkg.com/upath/-/upath-1.1.2.tgz#3db658600edaeeccbe6db5e684d67ee8c2acd068"
integrity sha512-kXpym8nmDmlCBr7nKdIx8P2jNBa+pBpIUFRnKJ4dr8htyYGJFokkr2ZvERRtUN+9SY+JqXouNgUPtv6JQva/2Q==

update-notifier@^0.5.0:
version "0.5.0"
resolved "https://registry.yarnpkg.com/update-notifier/-/update-notifier-0.5.0.tgz#07b5dc2066b3627ab3b4f530130f7eddda07a4cc"
integrity sha1-B7XcIGazYnqztPUwEw9+3doHpMw=
dependencies:
chalk "^1.0.0"
configstore "^1.0.0"
is-npm "^1.0.0"
latest-version "^1.0.0"
repeating "^1.1.2"
semver-diff "^2.0.0"
string-length "^1.0.0"

update-notifier@^2.5.0:
version "2.5.0"
resolved "https://registry.yarnpkg.com/update-notifier/-/update-notifier-2.5.0.tgz#d0744593e13f161e406acb1d9408b72cad08aff6"
Expand Down Expand Up @@ -21061,11 +20971,6 @@ [email protected]:
resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.3.2.tgz#1b4af4955eb3077c501c23872fc6513811587131"
integrity sha512-yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA==

uuid@^2.0.1:
version "2.0.3"
resolved "https://registry.yarnpkg.com/uuid/-/uuid-2.0.3.tgz#67e2e863797215530dff318e5bf9dcebfd47b21a"
integrity sha1-Z+LoY3lyFVMN/zGOW/nc6/1Hsho=

uuid@^3.0.0, uuid@^3.3.2, uuid@^3.4.0:
version "3.4.0"
resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
Expand Down Expand Up @@ -22182,15 +22087,6 @@ [email protected]:
boom "7.x.x"
hoek "5.x.x"

write-file-atomic@^1.1.2:
version "1.3.4"
resolved "https://registry.yarnpkg.com/write-file-atomic/-/write-file-atomic-1.3.4.tgz#f807a4f0b1d9e913ae7a48112e6cc3af1991b45f"
integrity sha1-+Aek8LHZ6ROuekgRLmzDrxmRtF8=
dependencies:
graceful-fs "^4.1.11"
imurmurhash "^0.1.4"
slide "^1.1.5"

write-file-atomic@^2.0.0, write-file-atomic@^2.3.0, write-file-atomic@^2.4.2:
version "2.4.3"
resolved "https://registry.yarnpkg.com/write-file-atomic/-/write-file-atomic-2.4.3.tgz#1fd2e9ae1df3e75b8d8c367443c692d4ca81f481"
Expand Down Expand Up @@ -22260,13 +22156,6 @@ x-is-string@^0.1.0:
resolved "https://registry.yarnpkg.com/x-is-string/-/x-is-string-0.1.0.tgz#474b50865af3a49a9c4657f05acd145458f77d82"
integrity sha1-R0tQhlrzpJqcRlfwWs0UVFj3fYI=

xdg-basedir@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/xdg-basedir/-/xdg-basedir-2.0.0.tgz#edbc903cc385fc04523d966a335504b5504d1bd2"
integrity sha1-7byQPMOF/ARSPZZqM1UEtVBNG9I=
dependencies:
os-homedir "^1.0.0"

xdg-basedir@^3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/xdg-basedir/-/xdg-basedir-3.0.0.tgz#496b2cc109eca8dbacfe2dc72b603c17c5870ad4"
Expand Down

0 comments on commit 9f084b4

Please sign in to comment.