Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to Spray-json 1.3.5 security fix release #4106

Merged
merged 2 commits into from
Nov 12, 2018

Conversation

chetanmeh
Copy link
Member

Spray Json released a new version 1.3.5 which has few security fixes

My changes affect the following components

  • API
  • Controller
  • Message Bus (e.g., Kafka)
  • Loadbalancer
  • Invoker
  • Intrinsic actions (e.g., sequences, conductors)
  • Data stores (e.g., CouchDB)
  • Tests
  • Deployment
  • CLI
  • General tooling
  • Documentation

Types of changes

  • Bug fix (generally a non-breaking change which closes an issue).
  • Enhancement or new feature (adds new functionality).
  • Breaking change (a bug fix or enhancement which changes existing behavior).

Checklist:

  • I signed an Apache CLA.
  • I reviewed the style guides and followed the recommendations (Travis CI will check :).
  • I added tests to cover my changes.
  • My changes require further changes to the documentation.
  • I updated the documentation where necessary.

Copy link
Contributor

@markusthoemmes markusthoemmes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@chetanmeh
Copy link
Member Author

PR is consistently ailing in system test (see #3246) which seems unrelated to this change (builds on master also failed for same test a day ago).

@codecov-io
Copy link

Codecov Report

Merging #4106 into master will decrease coverage by 3.51%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #4106      +/-   ##
==========================================
- Coverage   84.55%   81.04%   -3.52%     
==========================================
  Files         148      148              
  Lines        7122     7122              
  Branches      426      434       +8     
==========================================
- Hits         6022     5772     -250     
- Misses       1100     1350     +250
Impacted Files Coverage Δ
...core/database/cosmosdb/RxObservableImplicits.scala 0% <0%> (-100%) ⬇️
...core/database/cosmosdb/CosmosDBArtifactStore.scala 0% <0%> (-95.54%) ⬇️
...sk/core/database/cosmosdb/CosmosDBViewMapper.scala 0% <0%> (-92.6%) ⬇️
...whisk/core/database/cosmosdb/CosmosDBSupport.scala 0% <0%> (-83.34%) ⬇️
...abase/cosmosdb/CosmosDBArtifactStoreProvider.scala 0% <0%> (-62.5%) ⬇️
...penwhisk/core/database/cosmosdb/CosmosDBUtil.scala 92% <0%> (-4%) ⬇️
.../scala/org/apache/openwhisk/core/entity/Exec.scala 85% <0%> (-1.67%) ⬇️
...che/openwhisk/core/database/CouchDbRestStore.scala 73.23% <0%> (-0.51%) ⬇️
.../openwhisk/core/containerpool/ContainerProxy.scala 94.02% <0%> (+0.54%) ⬆️
...a/org/apache/openwhisk/core/controller/Rules.scala 89.93% <0%> (+0.67%) ⬆️
... and 21 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a800b5f...5a01895. Read the comment docs.

@chetanmeh
Copy link
Member Author

Finally its green after retrying build 3 times

@rabbah rabbah merged commit 33bb0e7 into apache:master Nov 12, 2018
Copy link
Member Author

@chetanmeh chetanmeh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FTR Changes in test cases were required as spray json switched to using TreeMap to avoid some of the hashing attacks. This change the ordering of field in string output hence switched to json object based comparison

BillZong pushed a commit to BillZong/openwhisk that referenced this pull request Nov 18, 2019
Adapt test to use json object comparison instead of string comparison
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants