[CVE-2017-16100] Use a patched version of dns-sync

[AMoo-Miki]

Description

[CVE-2017-16100] Use a patched version of dns-sync

dns-sync

The library hasn't been updated in years. Even though an upstream PR was created, due to the criticality of the CVE, until upstream package is updated a patched version is employed.

Changelog

• security: [CVE-2017-16100] Use a patched version for the dns-sync dependency

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[ruanyl]

@AMoo-Miki I have been thinking why not publishing under @opensearch-project? Or do we have the plan to move these forked packages to @opensearch-project?

[AMoo-Miki]

While we could, publishing them under the project name would create an expectation of ownership and support which we don't have the bandwidth for.

[seraphjiang]

the only concern is it might not be scale to put on personal repo just for one fix. but it should be ok if we don't have other option.

[seraphjiang]

the only concern is it might not be scale to put on personal repo just for one fix. but it should be ok if we don't have other option.

[seraphjiang]

not related to this PR.
in 2.14 we proved we could generate release note without changelog file. the maintainers should consider deprecate the needs of this file and simplify the contribution process

[AMoo-Miki]

This is the auto-generated one.

[AMoo-Miki]

the only concern is it might not be scale to put on personal repo just for one fix. but it should be ok if we don't have other option.

There are many [abandoned] packages that use my patched releases :)

[opensearch-trigger-bot]

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-1.3 1.3
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-1.3
# Create a new branch
git switch --create backport/backport-7811-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 dcd170aa7d6ee0d09bbd0f8d397a93e5a73d8f67
# Push it to GitHub
git push --set-upstream origin backport/backport-7811-to-1.3
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-7811-to-1.3.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-7811-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 dcd170aa7d6ee0d09bbd0f8d397a93e5a73d8f67
# Push it to GitHub
git push --set-upstream origin backport/backport-7811-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-7811-to-2.x.

[opensearch-trigger-bot]

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-1.3 1.3
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-1.3
# Create a new branch
git switch --create backport/backport-7811-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 dcd170aa7d6ee0d09bbd0f8d397a93e5a73d8f67
# Push it to GitHub
git push --set-upstream origin backport/backport-7811-to-1.3
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-7811-to-1.3.

[AMoo-Miki]

Manually backported to 1.3.