Skip to content

Commit 18ca164

Browse files
[anaconda]- fixing multiple vulnerabilities (devcontainers#1507)
* updating packages versions to fix anaconda vulnerabilities * patching requests package version * version update for requests and setuptools * version update for requests and setuptools * version update for requests and setuptools * modified file * fixing errors * cryptography, jupyter_core packages are pinned to the required version * change in packages list * fixing errors * version change
1 parent a035cf4 commit 18ca164

File tree

3 files changed

+14
-12
lines changed

3 files changed

+14
-12
lines changed

src/anaconda/.devcontainer/apply_security_patches.sh

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
#!/bin/bash
22

33
# vulnerabilities:
4-
# werkzeug - [GHSA-f9vj-2wh5-fj8j]
4+
# werkzeug - [GHSA-f9vj-2wh5-fj8j]
55

6-
vulnerable_packages=( "mistune=3.0.1" "transformers=4.49.0" "cryptography=43.0.3" "jupyter-lsp=2.2.2" "scrapy=2.11.2" \
6+
vulnerable_packages=( "mistune=3.0.1" "aiohttp=3.10.11" "cryptography=44.0.1" "h11=0.16.0" "jinja2=3.1.6" "jupyter_core=5.8.1" "protobuf=4.25.8" "requests=2.32.4" "setuptools=78.1.1" "transformers=4.52.1" "urllib3=2.5.0" "Werkzeug=3.0.6" "jupyter-lsp=2.2.2" "scrapy=2.11.2" \
77
"zipp=3.19.1" "tornado=6.4.2")
88

99
# Define the number of rows (based on the length of vulnerable_packages)
@@ -26,8 +26,7 @@ done
2626

2727
# Add an array for packages that should always pin to the provided version,
2828
# even if higher version is available in conda channel
29-
pin_to_required_version=( "transformers" "cryptography" ) # Add package names as needed
30-
29+
pin_to_required_version=("jupyter_core" "cryptography" )
3130
# Function to check if a package is in the pin_to_required_version array
3231
function is_pin_to_required_version() {
3332
local pkg="$1"

src/anaconda/manifest.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.2.7",
2+
"version": "1.2.8",
33
"build": {
44
"latest": true,
55
"rootDistro": "debian",

src/anaconda/test-project/test.sh

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,16 @@ checkPythonPackageVersion "joblib" "1.2.0"
3333
checkPythonPackageVersion "cookiecutter" "2.1.1"
3434
checkPythonPackageVersion "mistune" "2.0.3"
3535
checkPythonPackageVersion "numpy" "1.22"
36-
checkPythonPackageVersion "setuptools" "70.0.0"
36+
checkPythonPackageVersion "setuptools" "78.1.1"
3737
checkPythonPackageVersion "wheel" "0.38.1"
3838
checkPythonPackageVersion "nbconvert" "6.5.1"
39-
checkPythonPackageVersion "werkzeug" "3.0.3"
39+
checkPythonPackageVersion "werkzeug" "3.0.6"
4040
checkPythonPackageVersion "certifi" "2022.12.07"
41-
checkPythonPackageVersion "cryptography" "43.0.1"
42-
checkPythonPackageVersion "transformers" "4.36.0"
41+
checkPythonPackageVersion "cryptography" "44.0.1"
42+
checkPythonPackageVersion "h11" "0.16.0"
43+
checkPythonPackageVersion "jupyter_core" "5.8.1"
44+
checkPythonPackageVersion "protobuf" "4.25.8"
45+
checkPythonPackageVersion "transformers" "4.52.1"
4346
checkPythonPackageVersion "mpmath" "1.3.0"
4447
checkPythonPackageVersion "aiohttp" "3.10.2"
4548
checkPythonPackageVersion "tornado" "6.4.2"
@@ -53,15 +56,15 @@ checkPythonPackageVersion "jupyter-lsp" "2.2.2"
5356
checkPythonPackageVersion "idna" "3.7"
5457
checkPythonPackageVersion "jinja2" "3.1.4"
5558
checkPythonPackageVersion "scrapy" "2.11.2"
56-
checkPythonPackageVersion "requests" "2.32.2"
59+
checkPythonPackageVersion "requests" "2.32.4"
5760
checkPythonPackageVersion "scikit-learn" "1.5.0"
5861
checkPythonPackageVersion "zipp" "3.19.1"
5962

6063
checkCondaPackageVersion "pyopenssl" "24.2.1"
61-
checkCondaPackageVersion "requests" "2.32.2"
64+
checkCondaPackageVersion "requests" "2.32.4"
6265
checkCondaPackageVersion "pygments" "2.15.1"
6366
checkCondaPackageVersion "mpmath" "1.3.0"
64-
checkCondaPackageVersion "urllib3" "2.2.2"
67+
checkCondaPackageVersion "urllib3" "2.5.0"
6568
checkCondaPackageVersion "pyarrow" "14.0.1"
6669
checkCondaPackageVersion "pydantic" "2.5.3"
6770
checkCondaPackageVersion "tqdm" "4.66.4"

0 commit comments

Comments
 (0)