Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CVE-2021-23807] Bump jsonpointer from 4.1.0 to 5.0.1 #3535

Merged

Conversation

joshuarrrr
Copy link
Member

@joshuarrrr joshuarrrr commented Mar 6, 2023

Description

Bump jsonpointer from 4.1.0 to 5.0.1

Does not appear to be a breaking change

Issues Resolved

https://nvd.nist.gov/vuln/detail/CVE-2021-23807

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
    • yarn test:ftr
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

Signed-off-by: Josh Romero <rmerqg@amazon.com>
@codecov-commenter
Copy link

codecov-commenter commented Mar 6, 2023

Codecov Report

Merging #3535 (8c6854c) into 1.x (ba11c44) will decrease coverage by 0.05%.
The diff coverage is n/a.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@            Coverage Diff             @@
##              1.x    #3535      +/-   ##
==========================================
- Coverage   67.49%   67.45%   -0.05%     
==========================================
  Files        3044     3044              
  Lines       58696    58696              
  Branches     8902     8902              
==========================================
- Hits        39615    39591      -24     
- Misses      16932    16952      +20     
- Partials     2149     2153       +4     
Flag Coverage Δ
Linux 67.45% <ø> (+<0.01%) ⬆️
Windows ?

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
src/dev/build/lib/get_build_number.ts 57.14% <0.00%> (-42.86%) ⬇️
packages/osd-cross-platform/src/path.ts 48.83% <0.00%> (-37.21%) ⬇️
...ges/osd-apm-config-loader/src/config.test.mocks.ts 91.30% <0.00%> (-8.70%) ⬇️
src/dev/build/lib/config.ts 79.41% <0.00%> (-5.89%) ⬇️
src/setup_node_env/harden/child_process.js 84.61% <0.00%> (-3.85%) ⬇️
...ic/application/models/sense_editor/sense_editor.ts 64.88% <0.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

Copy link
Member

@zhongnansu zhongnansu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Np: Would it be better if we add the github issues, or CVE links to the PR description?

@joshuarrrr
Copy link
Member Author

Np: Would it be better if we add the github issues, or CVE links to the PR description?

updated

@joshuarrrr joshuarrrr merged commit 3f6b696 into opensearch-project:1.x Mar 7, 2023
opensearch-trigger-bot bot pushed a commit that referenced this pull request Mar 7, 2023
* [CVE-2021-23807] Bump jsonpointer from 4.1.0 to 5.0.1

Signed-off-by: Josh Romero <rmerqg@amazon.com>
(cherry picked from commit 3f6b696)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md
@joshuarrrr joshuarrrr deleted the cve/update-jsonpointer branch March 7, 2023 01:19
joshuarrrr pushed a commit that referenced this pull request Mar 7, 2023
* [CVE-2021-23807] Bump jsonpointer from 4.1.0 to 5.0.1

Signed-off-by: Josh Romero <rmerqg@amazon.com>
(cherry picked from commit 3f6b696)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants