From 80e079653fb6e5e683cc5e5f059f1408902a3710 Mon Sep 17 00:00:00 2001 From: ananzh Date: Thu, 14 Sep 2023 05:09:02 +0000 Subject: [PATCH 1/2] [1.3][CVE-2023-0842] Bump xml2js from 0.4.22 to 0.6.2 Signed-off-by: ananzh --- CHANGELOG.md | 1 + package.json | 2 +- packages/osd-test/package.json | 2 +- yarn.lock | 10 +++++++++- 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 83a60b15607f..ef3e42618dc3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,6 +36,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - [CVE-2022-1537] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) - [CVE-2022-0436] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) - [CVE-2023-26136] Resolve `tough-cookie` to `4.1.3` ([#4682](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/4682)) +- [CVE-2023-0842] Bump `xml2js` from `0.4.22` to `0.6.2` ([#5024](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5024)) ### 📈 Features/Enhancements diff --git a/package.json b/package.json index 7a28d6b555d2..3711b30fbfcc 100644 --- a/package.json +++ b/package.json @@ -498,7 +498,7 @@ "vega-schema-url-parser": "^2.1.0", "vega-tooltip": "^0.24.2", "vinyl-fs": "^3.0.3", - "xml2js": "^0.4.22", + "xml2js": "^0.6.2", "xmlbuilder": "13.0.2", "zlib": "^1.0.5" }, diff --git a/packages/osd-test/package.json b/packages/osd-test/package.json index 8efbba85bd63..7d8d80e52174 100644 --- a/packages/osd-test/package.json +++ b/packages/osd-test/package.json @@ -37,7 +37,7 @@ "rxjs": "^6.5.5", "strip-ansi": "^6.0.0", "tar-fs": "^2.1.0", - "xml2js": "^0.4.22", + "xml2js": "^0.6.2", "zlib": "^1.0.5" } } diff --git a/yarn.lock b/yarn.lock index 802017af8f21..268ef87ceddd 100644 --- a/yarn.lock +++ b/yarn.lock @@ -22297,7 +22297,7 @@ xml-parse-from-string@^1.0.0: resolved "https://registry.yarnpkg.com/xml-parse-from-string/-/xml-parse-from-string-1.0.1.tgz#a9029e929d3dbcded169f3c6e28238d95a5d5a28" integrity sha1-qQKekp09vN7RafPG4oI42VpdWig= -xml2js@^0.4.22, xml2js@^0.4.5: +xml2js@^0.4.5: version "0.4.22" resolved "https://registry.yarnpkg.com/xml2js/-/xml2js-0.4.22.tgz#4fa2d846ec803237de86f30aa9b5f70b6600de02" integrity sha512-MWTbxAQqclRSTnehWWe5nMKzI3VmJ8ltiJEco8akcC6j3miOhjjfzKum5sId+CWhfxdOs/1xauYr8/ZDBtQiRw== @@ -22306,6 +22306,14 @@ xml2js@^0.4.22, xml2js@^0.4.5: util.promisify "~1.0.0" xmlbuilder "~11.0.0" +xml2js@^0.6.2: + version "0.6.2" + resolved "https://registry.yarnpkg.com/xml2js/-/xml2js-0.6.2.tgz#dd0b630083aa09c161e25a4d0901e2b2a929b499" + integrity sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA== + dependencies: + sax ">=0.6.0" + xmlbuilder "~11.0.0" + xmlbuilder@13.0.2: version "13.0.2" resolved "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-13.0.2.tgz#02ae33614b6a047d1c32b5389c1fdacb2bce47a7" From 70930964df0ad57c646c21a6acbf1bf367d02cb2 Mon Sep 17 00:00:00 2001 From: ananzh Date: Thu, 14 Sep 2023 19:29:31 +0000 Subject: [PATCH 2/2] force xml2js to 0.6.2 and fix PR comment Signed-off-by: ananzh --- CHANGELOG.md | 2 +- package.json | 3 ++- yarn.lock | 19 +------------------ 3 files changed, 4 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ef3e42618dc3..3977724472a3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ### Deprecations ### 🛡 Security +- [CVE-2023-0842] Bump `xml2js` from `0.4.22` to `0.6.2` ([#5024](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5024)) ### 📈 Features/Enhancements @@ -36,7 +37,6 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - [CVE-2022-1537] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) - [CVE-2022-0436] Bump grunt from `1.4.1` to `1.5.3` ([#3723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3723)) - [CVE-2023-26136] Resolve `tough-cookie` to `4.1.3` ([#4682](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/4682)) -- [CVE-2023-0842] Bump `xml2js` from `0.4.22` to `0.6.2` ([#5024](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5024)) ### 📈 Features/Enhancements diff --git a/package.json b/package.json index 3711b30fbfcc..cdc1f137ad2a 100644 --- a/package.json +++ b/package.json @@ -128,7 +128,8 @@ "**/tough-cookie": "^4.1.3", "**/typescript": "4.0.2", "**/url-parse": "^1.5.8", - "**/unset-value": "^2.0.1" + "**/unset-value": "^2.0.1", + "**/xml2js": "^0.6.2" }, "workspaces": { "packages": [ diff --git a/yarn.lock b/yarn.lock index 268ef87ceddd..4a19073ffc14 100644 --- a/yarn.lock +++ b/yarn.lock @@ -21024,14 +21024,6 @@ util-extend@^1.0.1: resolved "https://registry.yarnpkg.com/util-extend/-/util-extend-1.0.3.tgz#a7c216d267545169637b3b6edc6ca9119e2ff93f" integrity sha1-p8IW0mdUUWljeztu3GypEZ4v+T8= -util.promisify@~1.0.0: - version "1.0.0" - resolved "https://registry.yarnpkg.com/util.promisify/-/util.promisify-1.0.0.tgz#440f7165a459c9a16dc145eb8e72f35687097030" - integrity sha512-i+6qA2MPhvoKLuxnJNpXAGhg7HphQOSUq2LKMZD0m15EiskXUkMvKdF4Uui0WYeCUGea+o2cw/ZuwehtfsrNkA== - dependencies: - define-properties "^1.1.2" - object.getownpropertydescriptors "^2.0.3" - util@0.10.3, util@^0.10.3: version "0.10.3" resolved "https://registry.yarnpkg.com/util/-/util-0.10.3.tgz#7afb1afe50805246489e3db7fe0ed379336ac0f9" @@ -22297,16 +22289,7 @@ xml-parse-from-string@^1.0.0: resolved "https://registry.yarnpkg.com/xml-parse-from-string/-/xml-parse-from-string-1.0.1.tgz#a9029e929d3dbcded169f3c6e28238d95a5d5a28" integrity sha1-qQKekp09vN7RafPG4oI42VpdWig= -xml2js@^0.4.5: - version "0.4.22" - resolved "https://registry.yarnpkg.com/xml2js/-/xml2js-0.4.22.tgz#4fa2d846ec803237de86f30aa9b5f70b6600de02" - integrity sha512-MWTbxAQqclRSTnehWWe5nMKzI3VmJ8ltiJEco8akcC6j3miOhjjfzKum5sId+CWhfxdOs/1xauYr8/ZDBtQiRw== - dependencies: - sax ">=0.6.0" - util.promisify "~1.0.0" - xmlbuilder "~11.0.0" - -xml2js@^0.6.2: +xml2js@^0.4.5, xml2js@^0.6.2: version "0.6.2" resolved "https://registry.yarnpkg.com/xml2js/-/xml2js-0.6.2.tgz#dd0b630083aa09c161e25a4d0901e2b2a929b499" integrity sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==