Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[1.3][CVE-2022-21670] Bump markdown-it from 10.0.0 to 12.3.2 #5016

Merged
merged 3 commits into from
Sep 14, 2023

Conversation

ananzh
Copy link
Member

@ananzh ananzh commented Sep 14, 2023

Backport from #1140.
With the SemVer philosophy, when releasing a patch version, it should not introduce breaking changes, which includes bumping a dependency to its major version. This markdown-it is a devDependency and the two major bump doesn't include breaking changes affecting OSD usages. Meanwhile, it is not included in release artifact.

Issues Resolved

CVE-2022-21670

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
    • yarn test:ftr
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

@codecov
Copy link

codecov bot commented Sep 14, 2023

Codecov Report

Merging #5016 (7633384) into 1.3 (7b922e8) will increase coverage by 0.04%.
The diff coverage is n/a.

❗ Current head 7633384 differs from pull request most recent head d06e7e8. Consider uploading reports for the commit d06e7e8 to get more accurate results

@@            Coverage Diff             @@
##              1.3    #5016      +/-   ##
==========================================
+ Coverage   67.46%   67.50%   +0.04%     
==========================================
  Files        3044     3044              
  Lines       58692    58692              
  Branches     8902     8902              
==========================================
+ Hits        39595    39619      +24     
+ Misses      16945    16925      -20     
+ Partials     2152     2148       -4     
Flag Coverage Δ
Linux 67.45% <ø> (-0.01%) ⬇️
Windows 67.45% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 5 files with indirect coverage changes

@ananzh ananzh added cve Security vulnerabilities detected by Dependabot or Mend v1.3.13 labels Sep 14, 2023
Signed-off-by: ananzh <ananzh@amazon.com>
joshuarrrr
joshuarrrr previously approved these changes Sep 14, 2023
Signed-off-by: ananzh <ananzh@amazon.com>
manasvinibs
manasvinibs previously approved these changes Sep 14, 2023
Signed-off-by: Anan Zhuang <ananzh@amazon.com>
@ananzh ananzh merged commit f1220d6 into opensearch-project:1.3 Sep 14, 2023
30 of 32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cve Security vulnerabilities detected by Dependabot or Mend v1.3.13
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants