Fix Dependabot Vulnerability #3269

Kalaiselvi84 · 2023-07-17T22:15:05Z

What type of PR is this?

Uncomment only one /kind <> line, press enter to put that in a new line, and remove leading whitespace from that line:

/kind breaking
/kind bug

/kind cleanup

/kind documentation
/kind feature
/kind hotfix
/kind release

What this PR does / Why we need it:

Which issue(s) this PR fixes:

Closes #

Special notes for your reviewer:

agones-bot · 2023-07-17T22:27:14Z

Build Failed 😱

Build Id: 1a87049f-5c02-4d88-a139-12afe1862660

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

markmandel · 2023-07-17T22:47:23Z

Found this error:

npm WARN tarball tarball data for protobufjs@https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.4.tgz (sha512-4ZPTPkXCdel3+L81yw3dG6+Kq3umdWKh7Dc7GW/CpNk4SX3hK58iPCWeCyhVTDrbkNeKrYNZ7EojM5WDaEWTLQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for protobufjs@https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.4.tgz (sha512-4ZPTPkXCdel3+L81yw3dG6+Kq3umdWKh7Dc7GW/CpNk4SX3hK58iPCWeCyhVTDrbkNeKrYNZ7EojM5WDaEWTLQ==) seems to be corrupted. Trying again.
npm ERR! code EINTEGRITY
npm ERR! sha512-4ZPTPkXCdel3+L81yw3dG6+Kq3umdWKh7Dc7GW/CpNk4SX3hK58iPCWeCyhVTDrbkNeKrYNZ7EojM5WDaEWTLQ== integrity checksum failed when using sha512: wanted sha512-4ZPTPkXCdel3+L81yw3dG6+Kq3umdWKh7Dc7GW/CpNk4SX3hK58iPCWeCyhVTDrbkNeKrYNZ7EojM5WDaEWTLQ== but got sha512-AT+RJgD2sH8phPmCf7OUZR8xGdcJRga4+1cOaXJ64hvcSkVhNcRHOwIxUatPH15+nj59WAGTDv3LSGZPEQbJaQ==. (574857 bytes)

@steven-supersolid you are our resident NodeJS expect -- is this the right approach to fix this?

steven-supersolid · 2023-07-18T10:42:44Z

This looks like a transitive dependency so would just try npm audit fix which is what I assumed was done but actually probably not if the SHA was not changed - was this just a manual update to package-lock.json and that is why?

To update all dependencies we could try npm update which in most cases will work, but should be sure to run tests

We may also want to do a more drastic dependency update using npm outdated and then update package.json as well but this could require code changes

steven-supersolid

Revoking approval until we clarify how the file was modified and resolve the build issue

Kalaiselvi84 · 2023-07-18T16:43:03Z

Revoking approval until we clarify how the file was modified and resolve the build issue

Initially, I tried with go get -u github.com/protobufjs/protobuf.js@latest. This command updated the go.mod and go.sum files with github.com/protobufjs/protobuf.js v6.11.3+incompatible. However, since the latest version of protobufjs is 7.2.4, I manually updated it.

markmandel · 2023-07-18T17:07:21Z

Revoking approval until we clarify how the file was modified and resolve the build issue

Initially, I tried with go get -u github.com/protobufjs/protobuf.js@latest. This command updated the go.mod and go.sum files with github.com/protobufjs/protobuf.js v6.11.3+incompatible. However, since the latest version of protobufjs is 7.2.4, I manually updated it.

Since this is a nodejs issue, Go tooling will not work here unfortunately.

If you want a quick node shell with npm tooling - make sdk-shell-node will give you one inside the SDK's build image.

steven-supersolid · 2023-07-18T18:16:52Z

package-lock.json

@@ -0,0 +1,6 @@
+{


This file may have been inadvertently added e.g. by running an npm command in the root directory of the project

After running npm update, the agones/package-lock.json file was generated, thought it was required but I have now deleted it. Thanks!

agones-bot · 2023-07-18T20:40:46Z

Build Succeeded 👏

Build Id: 56761bab-6f19-4443-8ae2-7b39d28a3503

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://803f953-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3269/head:pr_3269 && git checkout pr_3269
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.34.0-dev-803f953-amd64

markmandel · 2023-07-18T20:45:53Z

Yay passing. I think this should be better now?

Thanks @steven-supersolid for the review!

steven-supersolid · 2023-07-19T14:00:10Z

LGTM!

agones-bot · 2023-07-19T16:45:03Z

Build Succeeded 👏

Build Id: 70807425-e9ed-41a9-ae62-5dddd9f59e94

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://3c360cd-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3269/head:pr_3269 && git checkout pr_3269
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.34.0-dev-3c360cd-amd64

google-oss-prow · 2023-07-19T22:03:21Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kalaiselvi84, markmandel, steven-supersolid

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~sdks/nodejs/OWNERS~~ [markmandel,steven-supersolid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

google-oss-prow · 2023-07-19T22:03:37Z

New changes are detected. LGTM label has been removed.

agones-bot · 2023-07-19T23:20:04Z

Build Succeeded 👏

Build Id: 2ce212e0-a126-4afd-9084-64a3fb09290d

The following development artifacts have been built, and will exist for the next 30 days:

A preview of the website (the last 30 builds are retained):

https://ea1b06c-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/3269/head:pr_3269 && git checkout pr_3269
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.registry=us-docker.pkg.dev/agones-images/ci --set agones.image.tag=1.34.0-dev-ea1b06c-amd64

Kalaiselvi84 added 2 commits July 17, 2023 22:07

Fix Dependabot Vulnerability

230f0f4

protobufjs version upgrade

c54d5a3

Kalaiselvi84 requested a review from markmandel July 17, 2023 22:15

google-oss-prow bot added do-not-merge/work-in-progress size/XS labels Jul 17, 2023

github-actions bot added the kind/cleanup Refactoring code, fixing up documentation, etc label Jul 17, 2023

google-oss-prow bot requested review from EricFortin and steven-supersolid July 17, 2023 22:15

steven-supersolid approved these changes Jul 18, 2023

View reviewed changes

google-oss-prow bot assigned steven-supersolid Jul 18, 2023

google-oss-prow bot added lgtm approved labels Jul 18, 2023

steven-supersolid suggested changes Jul 18, 2023

View reviewed changes

google-oss-prow bot removed lgtm approved labels Jul 18, 2023

npm audit fix and npm update

33d64ed

google-oss-prow bot added size/M and removed size/XS labels Jul 18, 2023

steven-supersolid reviewed Jul 18, 2023

View reviewed changes

Kalaiselvi84 added 2 commits July 18, 2023 18:23

removed package-lock.json

472f618

Merge branch 'main' into issues/291645031

803f953

steven-supersolid approved these changes Jul 19, 2023

View reviewed changes

google-oss-prow bot added the lgtm label Jul 19, 2023

google-oss-prow bot added the approved label Jul 19, 2023

Kalaiselvi84 marked this pull request as ready for review July 19, 2023 15:26

google-oss-prow bot removed the do-not-merge/work-in-progress label Jul 19, 2023

Merge branch 'main' into issues/291645031

3c360cd

google-oss-prow bot removed the lgtm label Jul 19, 2023

google-oss-prow bot requested a review from steven-supersolid July 19, 2023 15:27

steven-supersolid approved these changes Jul 19, 2023

View reviewed changes

google-oss-prow bot added the lgtm label Jul 19, 2023

markmandel approved these changes Jul 19, 2023

View reviewed changes

google-oss-prow bot assigned markmandel Jul 19, 2023

markmandel enabled auto-merge (squash) July 19, 2023 22:03

Merge branch 'main' into issues/291645031

ea1b06c

google-oss-prow bot removed the lgtm label Jul 19, 2023

markmandel merged commit 5e6d45b into googleforgames:main Jul 19, 2023
2 checks passed

Kalaiselvi84 deleted the issues/291645031 branch March 15, 2024 01:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Dependabot Vulnerability #3269

Fix Dependabot Vulnerability #3269

Kalaiselvi84 commented Jul 17, 2023

agones-bot commented Jul 17, 2023

markmandel commented Jul 17, 2023

steven-supersolid commented Jul 18, 2023

steven-supersolid left a comment

Kalaiselvi84 commented Jul 18, 2023

markmandel commented Jul 18, 2023

steven-supersolid Jul 18, 2023

Kalaiselvi84 Jul 18, 2023

agones-bot commented Jul 18, 2023

markmandel commented Jul 18, 2023

steven-supersolid commented Jul 19, 2023

agones-bot commented Jul 19, 2023

google-oss-prow bot commented Jul 19, 2023

google-oss-prow bot commented Jul 19, 2023

agones-bot commented Jul 19, 2023

Fix Dependabot Vulnerability #3269

Fix Dependabot Vulnerability #3269

Conversation

Kalaiselvi84 commented Jul 17, 2023

agones-bot commented Jul 17, 2023

markmandel commented Jul 17, 2023

steven-supersolid commented Jul 18, 2023

steven-supersolid left a comment

Choose a reason for hiding this comment

Kalaiselvi84 commented Jul 18, 2023

markmandel commented Jul 18, 2023

steven-supersolid Jul 18, 2023

Choose a reason for hiding this comment

Kalaiselvi84 Jul 18, 2023

Choose a reason for hiding this comment

agones-bot commented Jul 18, 2023

markmandel commented Jul 18, 2023

steven-supersolid commented Jul 19, 2023

agones-bot commented Jul 19, 2023

google-oss-prow bot commented Jul 19, 2023

google-oss-prow bot commented Jul 19, 2023

agones-bot commented Jul 19, 2023