[CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2640

himsgupta1122 · 2022-10-21T00:54:06Z

Signed-off-by: himsgupta1122 hmsgupt@gmail.com

Description

IBM X-Force ID: 220063

Unset Value: Image contains unset value package version 1.0.1 and this has been resolved with version 2.0.1

CVE 2022-3517

Minimatch Package : Image contains 3.0.4 which has an issue and has been fixed with version 3.0.5

Issues Resolved

[List any issues this PR will resolve]

Check List

codecov-commenter · 2022-10-21T01:39:19Z

Codecov Report

❗ No coverage uploaded for pull request base (main@8d5e504). Click here to learn what that means.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #2640   +/-   ##
=======================================
  Coverage        ?   66.81%           
=======================================
  Files           ?     3207           
  Lines           ?    61148           
  Branches        ?     9315           
=======================================
  Hits            ?    40856           
  Misses          ?    18060           
  Partials        ?     2232

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

package.json

CHANGELOG.md

package.json

ananzh

LGTM. Thanks for fixing CVEs for customer!

ananzh · 2022-10-21T17:43:17Z

I think you might need to add tags for backport. Does these CVEs affect 1.x? Do we need to backport to 1.x? Do we have any conflicts there?

himsgupta1122 · 2022-10-22T00:38:15Z

PR looks good. Thanks for the fix. @himsgupta1122 Does it need to be backport to 2.x? If so, please add a label backport 2.x so it will trigger the auto backport PR

yes, but I dont see the option. Please add the label. Thanks

Signed-off-by: himsgupta1122 <hmsgupt@gmail.com>

…unset-value to 2.0.1 (#2640) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> (cherry picked from commit 68baac1)

…unset-value to 2.0.1 (#2640) (#2654) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> (cherry picked from commit 68baac1) Co-authored-by: himsgupta1122 <115103225+himsgupta1122@users.noreply.github.com> Co-authored-by: Zhongnan Su <szhongna@amazon.com>

opensearch-trigger-bot · 2022-11-28T23:18:54Z

The backport to 1.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/backport-1.x 1.x
# Navigate to the new working tree
pushd ../.worktrees/backport-1.x
# Create a new branch
git switch --create backport/backport-2640-to-1.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 68baac19664decd8b1cb0a35fa82ba0e9af4f658
# Push it to GitHub
git push --set-upstream origin backport/backport-2640-to-1.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/backport-1.x

Then, create a pull request where the base branch is 1.x and the compare/head branch is backport/backport-2640-to-1.x.

…unset-value to 2.0.1 (opensearch-project#2640) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> (cherry picked from commit 68baac1)

…unset-value to 2.0.1 (#2640) (#2946) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> (cherry picked from commit 68baac1) Co-authored-by: himsgupta1122 <115103225+himsgupta1122@users.noreply.github.com>

…unset-value to 2.0.1 (opensearch-project#2640) (opensearch-project#2946) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> (cherry picked from commit 68baac1) Co-authored-by: himsgupta1122 <115103225+himsgupta1122@users.noreply.github.com> (cherry picked from commit 21a9e7f)

…unset-value to 2.0.1 (#2640) (#2946) (#2972) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> (cherry picked from commit 68baac1) Co-authored-by: himsgupta1122 <115103225+himsgupta1122@users.noreply.github.com> (cherry picked from commit 21a9e7f)

…unset-value to 2.0.1 (opensearch-project#2640) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> Signed-off-by: Sergey V. Osipov <sipopo@yandex.ru>

…unset-value to 2.0.1 (opensearch-project#2640) * Update CVE 2022-3517 minimatch to 3.0.5 * enforce unset-value to 2.0.1 * version semver update and combining changelogs * adding minimatch sub-dep resolution Signed-off-by: himsgupta1122 <hmsgupt@gmail.com> Signed-off-by: Arpit Bandejiya <abandeji@amazon.com>

himsgupta1122 requested a review from a team as a code owner October 21, 2022 00:54

himsgupta1122 force-pushed the 2.3.1 branch 2 times, most recently from 8b29d41 to 841b00e Compare October 21, 2022 00:56

himsgupta1122 changed the title ~~[CVE 2022-3517] Update minimatch to 3.0.5~~ [CVE 2022-3517] Update minimatch to 3.0.5 and unset-value to 2.0.1 Oct 21, 2022

himsgupta1122 changed the title ~~[CVE 2022-3517] Update minimatch to 3.0.5 and unset-value to 2.0.1~~ [CVE 2022-3517] Bump minimatch to 3.0.5 and unset-value to 2.0.1 Oct 21, 2022

himsgupta1122 changed the title ~~[CVE 2022-3517] Bump minimatch to 3.0.5 and unset-value to 2.0.1~~ [CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 Oct 21, 2022

himsgupta1122 force-pushed the 2.3.1 branch from 93c4f31 to 1caa934 Compare October 21, 2022 16:44

seraphjiang requested review from ananzh, kristenTian, zhongnansu and ZilongX October 21, 2022 16:47

seraphjiang assigned himsgupta1122 Oct 21, 2022

seraphjiang added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Oct 21, 2022

ZilongX reviewed Oct 21, 2022

View reviewed changes

package.json Outdated Show resolved Hide resolved

ananzh requested changes Oct 21, 2022

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

package.json Outdated Show resolved Hide resolved

himsgupta1122 force-pushed the 2.3.1 branch from 8498f15 to 1caa934 Compare October 21, 2022 17:13

ZilongX previously approved these changes Oct 21, 2022

View reviewed changes

himsgupta1122 requested review from ZilongX and ananzh and removed request for zhongnansu, kristenTian and ZilongX October 21, 2022 17:26

ananzh previously approved these changes Oct 21, 2022

View reviewed changes

himsgupta1122 dismissed stale reviews from ananzh and ZilongX via 371828f October 21, 2022 17:56

himsgupta1122 force-pushed the 2.3.1 branch from fa3b77a to 371828f Compare October 21, 2022 17:56

himsgupta1122 requested review from ananzh and removed request for ananzh October 21, 2022 18:00

joshuarrrr approved these changes Oct 22, 2022

View reviewed changes

himsgupta1122 added 5 commits October 21, 2022 17:39

Update CVE 2022-3517 minimatch to 3.0.5

9298cdd

Signed-off-by: himsgupta1122 <hmsgupt@gmail.com>

enforce unset-value to 2.0.1

b4a4432

Signed-off-by: himsgupta1122 <hmsgupt@gmail.com>

edit CHANGELOG.md

26b78ae

Signed-off-by: himsgupta1122 <hmsgupt@gmail.com>

version semver update and combining changelogs

17a35b2

Signed-off-by: himsgupta1122 <hmsgupt@gmail.com>

adding minimatch sub-dep resolution

dd3a7a7

Signed-off-by: himsgupta1122 <hmsgupt@gmail.com>

himsgupta1122 force-pushed the 2.3.1 branch from ebad86f to dd3a7a7 Compare October 22, 2022 00:39

AMoo-Miki approved these changes Oct 22, 2022

View reviewed changes

ananzh added the cve Security vulnerabilities detected by Dependabot or Mend label Oct 22, 2022

zhongnansu merged commit 68baac1 into opensearch-project:main Oct 22, 2022

opensearch-trigger-bot bot mentioned this pull request Oct 22, 2022

[Backport 2.x] [CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2654

Merged

zhongnansu mentioned this pull request Oct 22, 2022

[CVE] Bump follow-redirects to 1.15.2 to fix CVE-2022-0155 and CVE-20… #2653

Merged

7 tasks

ananzh added the v2.4.0 'Issues and PRs related to version v2.4.0' label Oct 23, 2022

kavilla linked an issue Oct 24, 2022 that may be closed by this pull request

IBM X-Force ID: 220063 Unset-value HIGH Severity Vulnerability #2641

Closed

1 task

joshuarrrr added backport 1.x v1.3.7 labels Nov 28, 2022

joshuarrrr mentioned this pull request Nov 29, 2022

[Manual] [Backport 1.x] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2946

Merged

tmarkley mentioned this pull request Dec 2, 2022

[Discuss] Concerns about CVEs/dependencies, technical debt, and overall project prioritization #3008

Open

tmarkley mentioned this pull request Dec 15, 2022

[Maintenance] Removes mimimatch manual resolution #3019

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2640

[CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2640

himsgupta1122 commented Oct 21, 2022 •

edited

Loading

codecov-commenter commented Oct 21, 2022 •

edited

Loading

ananzh left a comment

ananzh commented Oct 21, 2022

himsgupta1122 commented Oct 22, 2022

opensearch-trigger-bot bot commented Nov 28, 2022

[CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2640

[CVE 2022-3517] Bump minimatch to 3.0.5 and [IBM X-Force ID: 220063] unset-value to 2.0.1 #2640

Conversation

himsgupta1122 commented Oct 21, 2022 • edited Loading

Description

Issues Resolved

Check List

codecov-commenter commented Oct 21, 2022 • edited Loading

Codecov Report

ananzh left a comment

Choose a reason for hiding this comment

ananzh commented Oct 21, 2022

himsgupta1122 commented Oct 22, 2022

opensearch-trigger-bot bot commented Nov 28, 2022

himsgupta1122 commented Oct 21, 2022 •

edited

Loading

codecov-commenter commented Oct 21, 2022 •

edited

Loading