Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CVE-2024-28863] Bump node-tar from 6.1.11 to 6.2.1 #6876

Closed
wants to merge 6 commits into from

Conversation

aggarwalShivani
Copy link

@aggarwalShivani aggarwalShivani commented May 31, 2024

Description

This is to fix CVE-2024-28863 in main branch by bumping the version of node-tar dependency.

Issues Resolved

GHSA-f5x3-32g6-xq36

Changelog

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

Copy link
Contributor

ℹ️ Manual Changeset Creation Reminder

Please ensure manual commit for changeset file 6876.yml under folder changelogs/fragments to complete this PR.

If you want to use the available OpenSearch Changeset Bot App to avoid manual creation of changeset file you can install it in your forked repository following this link.

For more information about formatting of changeset files, please visit OpenSearch Auto Changeset and Release Notes Tool.

Copy link
Contributor

❌ Changeset File Not Added Yet

Please ensure manual commit for changeset file 6876.yml under folder changelogs/fragments to complete this PR. File still missing.

Copy link

codecov bot commented May 31, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.36%. Comparing base (32fbe18) to head (74a6922).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6876      +/-   ##
==========================================
- Coverage   67.43%   67.36%   -0.08%     
==========================================
  Files        3444     3444              
  Lines       67847    67847              
  Branches    11035    11035              
==========================================
- Hits        45755    45706      -49     
- Misses      19426    19469      +43     
- Partials     2666     2672       +6     
Flag Coverage Δ
Linux_1 33.08% <ø> (ø)
Linux_2 55.12% <ø> (ø)
Linux_3 45.25% <ø> (ø)
Linux_4 34.82% <ø> (ø)
Windows_1 ?
Windows_2 ?
Windows_3 ?
Windows_4 ?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

github-actions bot commented Jun 2, 2024

❌ Changeset File Not Added Yet

Please ensure manual commit for changeset file 6876.yml under folder changelogs/fragments to complete this PR. File still missing.

Copy link
Contributor

github-actions bot commented Jun 2, 2024

❌ Changeset File Not Added Yet

Please ensure manual commit for changeset file 6876.yml under folder changelogs/fragments to complete this PR. File still missing.

Copy link
Contributor

github-actions bot commented Jun 2, 2024

❌ Invalid Prefix For Manual Changeset Creation

Invalid description prefix. Found "security". Only "skip" entry option is permitted for manual commit of changeset files.

If you were trying to skip the changelog entry, please use the "skip" entry option in the ##Changelog section of your PR description.

Signed-off-by: aggarwalShivani <[email protected]>
Copy link
Contributor

github-actions bot commented Jun 2, 2024

❌ Changeset File Not Added Yet

Please ensure manual commit for changeset file 6876.yml under folder changelogs/fragments to complete this PR. File still missing.

@aggarwalShivani
Copy link
Author

@virajsanghvi Thanks for the approval previously. But i was getting errors related to Manual Changeset Creation, and as prompted, I have created the file now and repushed. Request you for approval :)

@virajsanghvi
Copy link
Collaborator

Just FYI, looks like this was addressed independently in #6492

@aggarwalShivani
Copy link
Author

Just FYI, looks like this was addressed independently in #6492

Oh that's a bummer :( Looks like it was merged only a few hours ago..
Anyways, thanks for catching that! I'll close my PR then.

Fixed as part of #6492

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants