Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update parse-url dependency due to CVE-2022-2900 #2935

Merged
merged 1 commit into from
Sep 23, 2022

Conversation

akchinSTC
Copy link
Member

parse-url is a transitive dependency in our repository
lerna -> git-up -> parse-url
Lerna was bumped up to v5.5.0+ to pull in the latest version of git-up containing the fix, yarn lock regen'ed

What changes were proposed in this pull request?

How was this pull request tested?

Built and pipeline samples tested on main branch. lock files inspected for offending deps.

Developer's Certificate of Origin 1.1

   By making a contribution to this project, I certify that:

   (a) The contribution was created in whole or in part by me and I
       have the right to submit it under the Apache License 2.0; or

   (b) The contribution is based upon previous work that, to the best
       of my knowledge, is covered under an appropriate open source
       license and I have the right under that license to submit that
       work with modifications, whether created in whole or in part
       by me, under the same open source license (unless I am
       permitted to submit under a different license), as indicated
       in the file; or

   (c) The contribution was provided directly to me by some other
       person who certified (a), (b) or (c) and I have not modified
       it.

   (d) I understand and agree that this project and the contribution
       are public and that a record of the contribution (including all
       personal information I submit with it, including my sign-off) is
       maintained indefinitely and may be redistributed consistent with
       this project or the open source license(s) involved.

@elyra-bot
Copy link

elyra-bot bot commented Sep 23, 2022

Thanks for making a pull request to Elyra!

To try out this branch on binder, follow this link: Binder

@akchinSTC akchinSTC added the component:build build and build related issues(dependencies and docker) label Sep 23, 2022
@akchinSTC akchinSTC added this to the 3.12.0 milestone Sep 23, 2022
Copy link
Member

@ptitzler ptitzler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm

@akchinSTC akchinSTC merged commit 4889d60 into elyra-ai:main Sep 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component:build build and build related issues(dependencies and docker)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants