Bump version of jgit to 6.7.0.202309050840-r to fix CVE-2023-4759 #10147
Conversation
Signed-off-by: Poojita Raj <[email protected]>
Poojita-Raj
requested review from
reta,
anasalkouz,
andrross,
Bukhtawar,
CEHENKLE,
dblock,
gbbafna,
setiah,
kartg,
kotwanikunal,
mch2,
nknize,
owaiskazi19,
peternied,
Rishikesh1159,
ryanbogan,
saratvemulapalli,
shwetathareja,
dreamer-89,
VachaShah,
dbwiddis,
sachinpkale,
sohami and
msfroh
as code owners
Signed-off-by: Poojita Raj <[email protected]>
Gradle Check (Jenkins) Run Completed with:
|
Compatibility status:Checks if related components are compatible with change 5b0e32b Incompatible componentsIncompatible components: [https://github.com/opensearch-project/k-nn.git] Skipped componentsCompatible componentsCompatible components: [https://github.com/opensearch-project/security-analytics.git, https://github.com/opensearch-project/security.git, https://github.com/opensearch-project/custom-codecs.git, https://github.com/opensearch-project/opensearch-oci-object-storage.git, https://github.com/opensearch-project/index-management.git, https://github.com/opensearch-project/geospatial.git, https://github.com/opensearch-project/sql.git, https://github.com/opensearch-project/notifications.git, https://github.com/opensearch-project/job-scheduler.git, https://github.com/opensearch-project/observability.git, https://github.com/opensearch-project/neural-search.git, https://github.com/opensearch-project/cross-cluster-replication.git, https://github.com/opensearch-project/alerting.git, https://github.com/opensearch-project/anomaly-detection.git, https://github.com/opensearch-project/performance-analyzer.git, https://github.com/opensearch-project/asynchronous-search.git, https://github.com/opensearch-project/ml-commons.git, https://github.com/opensearch-project/performance-analyzer-rca.git, https://github.com/opensearch-project/common-utils.git, https://github.com/opensearch-project/reporting.git] |
Gradle Check (Jenkins) Run Completed with:
|
Codecov Report
@@ Coverage Diff @@
## main #10147 +/- ##
============================================
+ Coverage 71.04% 71.10% +0.05%
- Complexity 58090 58144 +54
============================================
Files 4825 4825
Lines 274101 274101
Branches 39945 39945
============================================
+ Hits 194741 194896 +155
+ Misses 63026 62870 -156
- Partials 16334 16335 +1 |
Gradle Check (Jenkins) Run Completed with:
|
|
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
reta
added
dependencies
|
The backport to To backport manually, run these commands in your terminal: # Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch/backport-2.x
# Create a new branch
git switch --create backport/backport-10147-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 ef343d769439f510aba6f20b7746bbcf5f42e377
# Push it to GitHub
git push --set-upstream origin backport/backport-10147-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch/backport-2.xThen, create a pull request where the |
|
@Poojita-Raj could you please manually backport to |
…ensearch-project#10147) * change dependency version of jgit Signed-off-by: Poojita Raj <[email protected]> * add changelog Signed-off-by: Poojita Raj <[email protected]> --------- Signed-off-by: Poojita Raj <[email protected]>
…0147) (#10166) * change dependency version of jgit * add changelog --------- Signed-off-by: Poojita Raj <[email protected]>
…ensearch-project#10147) * change dependency version of jgit Signed-off-by: Poojita Raj <[email protected]> * add changelog Signed-off-by: Poojita Raj <[email protected]> --------- Signed-off-by: Poojita Raj <[email protected]>
…ensearch-project#10147) * change dependency version of jgit Signed-off-by: Poojita Raj <[email protected]> * add changelog Signed-off-by: Poojita Raj <[email protected]> --------- Signed-off-by: Poojita Raj <[email protected]> Signed-off-by: Ivan Brusic <[email protected]>
…ensearch-project#10147) * change dependency version of jgit Signed-off-by: Poojita Raj <[email protected]> * add changelog Signed-off-by: Poojita Raj <[email protected]> --------- Signed-off-by: Poojita Raj <[email protected]>
…ensearch-project#10147) * change dependency version of jgit Signed-off-by: Poojita Raj <[email protected]> * add changelog Signed-off-by: Poojita Raj <[email protected]> --------- Signed-off-by: Poojita Raj <[email protected]> Signed-off-by: Shivansh Arora <[email protected]>
Description
Fixes CVE-2023-4759.
Related Issues
Resolves #[Issue number to be closed when this PR is merged]
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.