fix(opensearch-3): GHSA-84h7-rjj3-6jx4 #76359
Conversation
Version bump to most recent tag 3.4.0 Relates: chainguard-dev/CVE-Dashboard#51553 <!--ci-cve-scan:fail-any-->
octo-sts
bot
added
the
bincapz/pass
catmsred
force-pushed
the
opensearch-3/GHSA-84h7-rjj3-6jx4
branch
from
8a4514d to
fb9048c
Compare
|
Better but not fixed: CVE Scan Results (mode: fail-any) aarch64/opensearch-3-3.4.0-r0.apk aarch64/opensearch-3-neural-search-3.4.0-r0.apk aarch64/opensearch-3-observability-3.4.0-r0.apk aarch64/opensearch-3-reporting-3.4.0-r0.apk aarch64/opensearch-3-security-analytics-3.4.0-r0.apk aarch64/opensearch-3-sql-3.4.0-r0.apk x86_64/opensearch-3-neural-search-3.4.0-r0.apk x86_64/opensearch-3-observability-3.4.0-r0.apk x86_64/opensearch-3-reporting-3.4.0-r0.apk x86_64/opensearch-3-security-analytics-3.4.0-r0.apk x86_64/opensearch-3-sql-3.4.0-r0.apk |
catmsred
force-pushed
the
opensearch-3/GHSA-84h7-rjj3-6jx4
branch
from
fb9048c to
f3b8434
Compare
🩹 Build Failed: Patch Application Failed
Build Details
Root Cause Analysis 🔍The patch 'netty-bump.patch' appears to have already been applied to the gradle/libs.versions.toml file, or the patch is reversed. The patch system detected this and failed to apply the patch, resulting in a rejected hunk that was saved to gradle/libs.versions.toml.rej. 🔍 Build failure fix suggestionsFound similar build failures that have been fixed in the past and analyzed them to suggest a fix: Similar PRs with fixes
Suggested ChangesFile: opensearch-3.yaml
Replacement: Content:
Replacement: Content:
Content:
Content: File: opensearch-3/netty-bump.patch
Click to expand fix analysisAnalysisThe similar fixes show a consistent pattern: when patches fail to apply due to being "reversed or previously applied", the solution is to update the package version and remove the problematic patch files. All three examples follow this pattern:
The root cause is that newer upstream versions already include the fixes that were previously applied via patches, making the patches redundant and causing conflicts. Click to expand fix explanationExplanationThis fix addresses the root cause of the patch failure by updating to a newer OpenSearch version that already includes the netty version bump. The error occurs because the netty-bump.patch is trying to apply changes that are already present in the source code of version 3.4.0, or the patch format doesn't match the current file structure. By updating to version 3.5.0 (following the pattern from similar fixes), we ensure:
The removal of both patch steps (main pipeline and subpackage pipeline) ensures the build won't attempt to apply the problematic patch anywhere in the process. This follows the exact pattern seen in all three similar fixes where version updates resolved patch conflicts. Click to expand alternative approachesAlternative Approaches
Was this comment helpful? Please use 👍 or 👎 reactions on this comment. |
catmsred
force-pushed
the
opensearch-3/GHSA-84h7-rjj3-6jx4
branch
from
f3b8434 to
86a43d6
Compare
Bump netty version to 4.2.9.Final Relates: chainguard-dev/CVE-Dashboard#51553 <!--ci-cve-scan:fail-any-->
catmsred
force-pushed
the
opensearch-3/GHSA-84h7-rjj3-6jx4
branch
from
86a43d6 to
6b76625
Compare
Bump netty-codec-http to 4.2.9.Final with upstream patch [1] [1] opensearch-project/OpenSearch@f9a1f0d Relates: chainguard-dev/CVE-Dashboard#51553 <!--ci-cve-scan:fail-any-->
1 participant
Version bump to most recent tag 3.4.0
Relates: https://github.com/chainguard-dev/CVE-Dashboard/issues/51553