Skip to content

Bump tar from 6.1.13 to 6.2.1#6492

Merged
AMoo-Miki merged 6 commits intoopensearch-project:mainfrom
LDrago27:remoteMain
Jun 5, 2024
Merged

Bump tar from 6.1.13 to 6.2.1#6492
AMoo-Miki merged 6 commits intoopensearch-project:mainfrom
LDrago27:remoteMain

Conversation

@LDrago27
Copy link
Copy Markdown
Collaborator

@LDrago27 LDrago27 commented Apr 16, 2024 •
edited
Loading

Description

Bumps the tar package from 6.1.13 to 6.2.1. It is a complete version of #6397 which is linked to CVE(#6488) mentioned here.

Changelog

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

@LDrago27 LDrago27 marked this pull request as ready for review April 16, 2024 20:12
ananzh
ananzh previously approved these changes Apr 16, 2024
View reviewed changes
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 16, 2024

❌ Invalid Changelog Heading

The '## Changelog' heading in your PR description is either missing or malformed. Please make sure that your PR description includes a '## Changelog' heading with proper spelling, capitalization, spacing, and Markdown syntax.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 16, 2024

❌ Changelog Entry Missing Hyphen

Changelog entries must begin with a hyphen (-).

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 16, 2024

❌ Invalid Prefix For Manual Changeset Creation

Invalid description prefix. Found "Bump tar package from 6.1.13 to 6.2.1". Only "skip" entry option is permitted for manual commit of changeset files.

If you were trying to skip the changelog entry, please use the "skip" entry option in the ##Changelog section of your PR description.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 16, 2024

❌ Invalid Prefix For Manual Changeset Creation

Invalid description prefix. Found "chore". Only "skip" entry option is permitted for manual commit of changeset files.

If you were trying to skip the changelog entry, please use the "skip" entry option in the ##Changelog section of your PR description.

opensearch-changeset-bot bot added a commit to LDrago27/OpenSearch-Dashboards that referenced this pull request Apr 16, 2024
@opensearch-changeset-bot
Changeset file for PR opensearch-project#6492 created/updated
ebf0012
@manasvinibs manasvinibs linked an issue Jun 4, 2024 that may be closed by this pull request
CVE-2024-28863 (Medium) detected in tar-6.1.11.tgz, tar-6.1.13.tgz #6488
Closed
1 task
@ananzh
Copy link
Copy Markdown
Member

ananzh commented Jun 4, 2024 •
edited
Loading

Changelog should be security not chore.
Can use this one #6770 as a reference.
It will create a changelog file automatically in the changelogs/fragments. You could just remove your changelog.md changes.

@LDrago27
[CVE-2024-28863] Bump tar from 6.1.11 to 6.2.1
94b4fb2 
Signed-off-by: Suchit Sahoo <suchsah@amazon.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jun 5, 2024

❌ Entry Too Long

Entry is 104 characters long, which is 4 characters longer than the maximum allowed length of 100 characters. Please revise your entry to be within the maximum length.

@LDrago27
Copy link
Copy Markdown
Collaborator Author

LDrago27 commented Jun 5, 2024

Changelog should be security not chore. Can use this one #6770 as a reference. It will create a changelog file automatically in the changelogs/fragments. You could just remove your changelog.md changes.

Updated the change log

@ananzh ananzh added the cve Security vulnerabilities detected by Dependabot or Mend label Jun 5, 2024
@AMoo-Miki AMoo-Miki merged commit 2b8600d into opensearch-project:main Jun 5, 2024
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jun 5, 2024
@github-actions @opensearch-changeset-bot
Bump tar from 6.1.13 to 6.2.1 (#6492)
3607325 
* [CVE-2024-28863] Bump tar from 6.1.11 to 6.2.1

Signed-off-by: Suchit Sahoo <suchsah@amazon.com>

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

---------

Signed-off-by: Suchit Sahoo <suchsah@amazon.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
(cherry picked from commit 2b8600d)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Jun 5, 2024
Merged
@virajsanghvi virajsanghvi mentioned this pull request Jun 5, 2024
Closed
7 tasks
BionIT pushed a commit that referenced this pull request Jun 5, 2024
@opensearch-trigger-bot @github-actions @opensearch-changeset-bot
Bump tar from 6.1.13 to 6.2.1 (#6492) (#6914)
3fa2501 
* [CVE-2024-28863] Bump tar from 6.1.11 to 6.2.1



* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

* Changeset file for PR #6492 created/updated

---------



(cherry picked from commit 2b8600d)

Signed-off-by: Suchit Sahoo <suchsah@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
@AMoo-Miki AMoo-Miki mentioned this pull request Jun 5, 2024
Merged
7 tasks
@ananzh ananzh mentioned this pull request Jun 7, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AMoo-Miki AMoo-Miki AMoo-Miki approved these changes

@ananzh ananzh ananzh approved these changes

@kavilla kavilla Awaiting requested review from kavilla kavilla is a code owner

@ashwin-pc ashwin-pc Awaiting requested review from ashwin-pc ashwin-pc is a code owner

@joshuarrrr joshuarrrr Awaiting requested review from joshuarrrr

@abbyhu2000 abbyhu2000 Awaiting requested review from abbyhu2000 abbyhu2000 is a code owner

@zengyan-amazon zengyan-amazon Awaiting requested review from zengyan-amazon zengyan-amazon is a code owner

@zhongnansu zhongnansu Awaiting requested review from zhongnansu zhongnansu is a code owner

@manasvinibs manasvinibs Awaiting requested review from manasvinibs

@ZilongX ZilongX Awaiting requested review from ZilongX ZilongX is a code owner

@Flyingliuhub Flyingliuhub Awaiting requested review from Flyingliuhub Flyingliuhub is a code owner

@curq curq Awaiting requested review from curq

@bandinib-amzn bandinib-amzn Awaiting requested review from bandinib-amzn bandinib-amzn is a code owner

@SuZhou-Joe SuZhou-Joe Awaiting requested review from SuZhou-Joe SuZhou-Joe is a code owner

@ruanyl ruanyl Awaiting requested review from ruanyl ruanyl is a code owner

@BionIT BionIT Awaiting requested review from BionIT

@xinruiba xinruiba Awaiting requested review from xinruiba xinruiba is a code owner

@zhyuanqi zhyuanqi Awaiting requested review from zhyuanqi zhyuanqi is a code owner

@mengweieric mengweieric Awaiting requested review from mengweieric mengweieric is a code owner

Assignees

@AMoo-Miki AMoo-Miki

@ananzh ananzh

Labels

backport 2.x cve Security vulnerabilities detected by Dependabot or Mend repeat-contributor v2.15.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CVE-2024-28863 (Medium) detected in tar-6.1.11.tgz, tar-6.1.13.tgz

3 participants

@LDrago27 @AMoo-Miki @ananzh
⚡