Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Force using snakeyaml version 1.32 to fix CVE issue #535

Merged
merged 17 commits into from
Oct 4, 2022

Conversation

Angie-Zhang
Copy link
Contributor

@Angie-Zhang Angie-Zhang commented Oct 3, 2022

Signed-off-by: Angie Zhang [email protected]

Issue #, if available:
#493
#525

Description of changes:

CheckList:

  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@Angie-Zhang Angie-Zhang requested a review from a team October 3, 2022 20:22
praveensameneni
praveensameneni previously approved these changes Oct 3, 2022
khushbr
khushbr previously approved these changes Oct 3, 2022
Copy link
Contributor

@khushbr khushbr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add the issue number to the PR description ?

The build is failing Execution failed for task ':compileKotlin'. Did the local gradle build pass?

https://github.com/opensearch-project/index-management/actions/runs/3177382514/jobs/5177755735

@khushbr khushbr self-requested a review October 3, 2022 20:58
@Angie-Zhang Angie-Zhang dismissed stale reviews from khushbr and praveensameneni via 851f832 October 3, 2022 21:11
Angie Zhang added 4 commits October 3, 2022 17:44
Signed-off-by: Angie Zhang <[email protected]>
Signed-off-by: Angie Zhang <[email protected]>
Signed-off-by: Angie Zhang <[email protected]>
@deshsidd deshsidd self-requested a review October 4, 2022 02:18
deshsidd
deshsidd previously approved these changes Oct 4, 2022
praveensameneni
praveensameneni previously approved these changes Oct 4, 2022
Signed-off-by: Angie Zhang <[email protected]>
@Angie-Zhang Angie-Zhang dismissed stale reviews from praveensameneni and deshsidd via f93ee3c October 4, 2022 15:55
Signed-off-by: Angie Zhang <[email protected]>
bowenlan-amzn
bowenlan-amzn previously approved these changes Oct 4, 2022
praveensameneni
praveensameneni previously approved these changes Oct 4, 2022
deshsidd
deshsidd previously approved these changes Oct 4, 2022
Signed-off-by: Angie Zhang <[email protected]>
@Angie-Zhang Angie-Zhang merged commit b72eeaa into opensearch-project:1.3 Oct 4, 2022
@opensearch-trigger-bot
Copy link
Contributor

The backport to 1.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.x 1.x
# Navigate to the new working tree
cd .worktrees/backport-1.x
# Create a new branch
git switch --create backport/backport-535-to-1.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 b72eeaa7c54c1a55d167a8a29d3f4bef18df9ca8
# Push it to GitHub
git push --set-upstream origin backport/backport-535-to-1.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.x

Then, create a pull request where the base branch is 1.x and the compare/head branch is backport/backport-535-to-1.x.

deshsidd pushed a commit to deshsidd/index-management that referenced this pull request Oct 4, 2022
…ct#535)

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Kotlin version upgrade compatibility and jackson version upgrade

Signed-off-by: Angie Zhang <[email protected]>

* Kotlin version upgrade compatibility

Signed-off-by: Angie Zhang <[email protected]>

* detekt error fixing

Signed-off-by: Angie Zhang <[email protected]>

* Update detekt setting

Signed-off-by: Angie Zhang <[email protected]>

* Update detekt setting

Signed-off-by: Angie Zhang <[email protected]>

* Update gradle typo

Signed-off-by: Angie Zhang <[email protected]>

* Fix ktlint

Signed-off-by: Angie Zhang <[email protected]>

* Update gradle

Signed-off-by: Angie Zhang <[email protected]>

* Update gradle

Signed-off-by: Angie Zhang <[email protected]>

* Fix build.gradle

Signed-off-by: Angie Zhang <[email protected]>

* Fix jacoco tool version

Signed-off-by: Angie Zhang <[email protected]>

Signed-off-by: Angie Zhang <[email protected]>
(cherry picked from commit b72eeaa)

Signed-off-by: Siddhant Deshmukh [email protected]
Angie-Zhang pushed a commit that referenced this pull request Oct 4, 2022
)

* Force using snakeyaml version 1.32 to fix CVE issue (#535)

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Force using snakeyaml version 1.32 to fix CVE issue

Signed-off-by: Angie Zhang <[email protected]>

* Kotlin version upgrade compatibility and jackson version upgrade

Signed-off-by: Angie Zhang <[email protected]>

* Kotlin version upgrade compatibility

Signed-off-by: Angie Zhang <[email protected]>

* detekt error fixing

Signed-off-by: Angie Zhang <[email protected]>

* Update detekt setting

Signed-off-by: Angie Zhang <[email protected]>

* Update detekt setting

Signed-off-by: Angie Zhang <[email protected]>

* Update gradle typo

Signed-off-by: Angie Zhang <[email protected]>

* Fix ktlint

Signed-off-by: Angie Zhang <[email protected]>

* Update gradle

Signed-off-by: Angie Zhang <[email protected]>

* Update gradle

Signed-off-by: Angie Zhang <[email protected]>

* Fix build.gradle

Signed-off-by: Angie Zhang <[email protected]>

* Fix jacoco tool version

Signed-off-by: Angie Zhang <[email protected]>

Signed-off-by: Angie Zhang <[email protected]>
(cherry picked from commit b72eeaa)

Signed-off-by: Siddhant Deshmukh [email protected]

* Force snakeyml 1.32 in spi/build

Signed-off-by: Siddhant Deshmukh <[email protected]>

* Fix typo

Signed-off-by: Siddhant Deshmukh <[email protected]>

Signed-off-by: Siddhant Deshmukh [email protected]
Signed-off-by: Siddhant Deshmukh <[email protected]>
Co-authored-by: Angie Zhang <[email protected]>
@Angie-Zhang Angie-Zhang deleted the 1.3.6-CVE-fix branch December 9, 2022 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants