Skip to content

Commit 29a924a

Browse files
AlvaroRausellAlvaroRausell
authored
Merge branch 'main' into python-trixie-update
2 parents 38f844f + 7c16165 commit 29a924a

File tree

37 files changed

+367
-54
lines changed

37 files changed

+367
-54
lines changed

‎src/anaconda/.devcontainer/apply_security_patches.sh‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
#!/bin/bash
22

33
# vulnerabilities:
4-
# werkzeug - [GHSA-f9vj-2wh5-fj8j]
4+
# werkzeug - [GHSA-f9vj-2wh5-fj8j]
55

6-
vulnerable_packages=( "mistune=3.0.1" "transformers=4.49.0" "cryptography=43.0.3" "jupyter-lsp=2.2.2" "scrapy=2.11.2" \
6+
vulnerable_packages=( "mistune=3.0.1" "aiohttp=3.10.11" "cryptography=44.0.1" "h11=0.16.0" "jinja2=3.1.6" "jupyter_core=5.8.1" "protobuf=4.25.8" "requests=2.32.4" "setuptools=78.1.1" "transformers=4.52.1" "urllib3=2.5.0" "Werkzeug=3.0.6" "jupyter-lsp=2.2.2" "scrapy=2.11.2" \
77
"zipp=3.19.1" "tornado=6.4.2")
88

99
# Define the number of rows (based on the length of vulnerable_packages)
@@ -26,8 +26,7 @@ done
2626

2727
# Add an array for packages that should always pin to the provided version,
2828
# even if higher version is available in conda channel
29-
pin_to_required_version=( "transformers" "cryptography" ) # Add package names as needed
30-
29+
pin_to_required_version=("jupyter_core" "cryptography" )
3130
# Function to check if a package is in the pin_to_required_version array
3231
function is_pin_to_required_version() {
3332
local pkg="$1"

‎src/anaconda/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.2.7",
2+
"version": "1.2.8",
33
"build": {
44
"latest": true,
55
"rootDistro": "debian",

‎src/anaconda/test-project/test.sh‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,16 @@ checkPythonPackageVersion "joblib" "1.2.0"
3333
checkPythonPackageVersion "cookiecutter" "2.1.1"
3434
checkPythonPackageVersion "mistune" "2.0.3"
3535
checkPythonPackageVersion "numpy" "1.22"
36-
checkPythonPackageVersion "setuptools" "70.0.0"
36+
checkPythonPackageVersion "setuptools" "78.1.1"
3737
checkPythonPackageVersion "wheel" "0.38.1"
3838
checkPythonPackageVersion "nbconvert" "6.5.1"
39-
checkPythonPackageVersion "werkzeug" "3.0.3"
39+
checkPythonPackageVersion "werkzeug" "3.0.6"
4040
checkPythonPackageVersion "certifi" "2022.12.07"
41-
checkPythonPackageVersion "cryptography" "43.0.1"
42-
checkPythonPackageVersion "transformers" "4.36.0"
41+
checkPythonPackageVersion "cryptography" "44.0.1"
42+
checkPythonPackageVersion "h11" "0.16.0"
43+
checkPythonPackageVersion "jupyter_core" "5.8.1"
44+
checkPythonPackageVersion "protobuf" "4.25.8"
45+
checkPythonPackageVersion "transformers" "4.52.1"
4346
checkPythonPackageVersion "mpmath" "1.3.0"
4447
checkPythonPackageVersion "aiohttp" "3.10.2"
4548
checkPythonPackageVersion "tornado" "6.4.2"
@@ -53,15 +56,15 @@ checkPythonPackageVersion "jupyter-lsp" "2.2.2"
5356
checkPythonPackageVersion "idna" "3.7"
5457
checkPythonPackageVersion "jinja2" "3.1.4"
5558
checkPythonPackageVersion "scrapy" "2.11.2"
56-
checkPythonPackageVersion "requests" "2.32.2"
59+
checkPythonPackageVersion "requests" "2.32.4"
5760
checkPythonPackageVersion "scikit-learn" "1.5.0"
5861
checkPythonPackageVersion "zipp" "3.19.1"
5962

6063
checkCondaPackageVersion "pyopenssl" "24.2.1"
61-
checkCondaPackageVersion "requests" "2.32.2"
64+
checkCondaPackageVersion "requests" "2.32.4"
6265
checkCondaPackageVersion "pygments" "2.15.1"
6366
checkCondaPackageVersion "mpmath" "1.3.0"
64-
checkCondaPackageVersion "urllib3" "2.2.2"
67+
checkCondaPackageVersion "urllib3" "2.5.0"
6568
checkCondaPackageVersion "pyarrow" "14.0.1"
6669
checkCondaPackageVersion "pydantic" "2.5.3"
6770
checkCondaPackageVersion "tqdm" "4.66.4"

‎src/base-debian/.devcontainer/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# [Choice] Debian version (use bullseye on local arm64/Apple Silicon): bookworm, bullseye, buster
2-
ARG VARIANT="bookworm"
1+
# [Choice] Debian version (use bullseye on local arm64/Apple Silicon): trixie, bookworm, bullseye, buster
2+
ARG VARIANT="trixie"
33
FROM buildpack-deps:${VARIANT}-curl
44

55
# [Optional] Uncomment this section to install additional OS packages.

‎src/base-debian/README.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
| *Categories* | Core, Other |
1010
| *Image type* | Dockerfile |
1111
| *Published images* | mcr.microsoft.com/devcontainers/base:debian |
12-
| *Available image variants* | bookworm, bullseye ([full list](https://mcr.microsoft.com/v2/devcontainers/base/tags/list)) |
13-
| *Published image architecture(s)* | x86-64, aarch64/arm64 for `bookworm`, and `bullseye` variant |
12+
| *Available image variants* | trixie, bookworm, bullseye ([full list](https://mcr.microsoft.com/v2/devcontainers/base/tags/list)) |
13+
| *Published image architecture(s)* | x86-64, aarch64/arm64 for `trixie`, `bookworm`, and `bullseye` variant |
1414
| *Container host OS support* | Linux, macOS, Windows |
1515
| *Container OS* | Debian |
1616
| *Languages, platforms* | Any |
@@ -22,16 +22,17 @@ See **[history](history)** for information on the contents of published images.
2222
You can directly reference pre-built versions of `Dockerfile` by using the `image` property in `.devcontainer/devcontainer.json` or updating the `FROM` statement in your own `Dockerfile` to one of the following. An example `Dockerfile` is included in this repository.
2323

2424
- `mcr.microsoft.com/devcontainers/base:debian` (latest)
25+
- `mcr.microsoft.com/devcontainers/base:trixie` (or `debian-13`)
2526
- `mcr.microsoft.com/devcontainers/base:bookworm` (or `debian-12`)
2627
- `mcr.microsoft.com/devcontainers/base:bullseye` (or `debian-11`)
2728

2829
Refer to [this guide](https://containers.dev/guide/dockerfile) for more details.
2930

3031
You can decide how often you want updates by referencing a [semantic version](https://semver.org/) of each image. For example:
3132

32-
- `mcr.microsoft.com/devcontainers/base:1-bookworm`
33-
- `mcr.microsoft.com/devcontainers/base:1.0-bookworm`
34-
- `mcr.microsoft.com/devcontainers/base:1.0.0-bookworm`
33+
- `mcr.microsoft.com/devcontainers/base:1-trixie`
34+
- `mcr.microsoft.com/devcontainers/base:1.0-trixie`
35+
- `mcr.microsoft.com/devcontainers/base:1.0.0-trixie`
3536

3637
See [history](history) for information on the contents of each version and [here for a complete list of available tags](https://mcr.microsoft.com/v2/devcontainers/base/tags/list).
3738

‎src/base-debian/manifest.json‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
2-
"version": "1.0.25",
2+
"version": "2.0.0",
33
"variants": [
4+
"trixie",
45
"bookworm",
56
"bullseye"
67
],
78
"build": {
8-
"latest": "bookworm",
9+
"latest": "trixie",
910
"rootDistro": "debian",
1011
"architectures": {
12+
"trixie": [
13+
"linux/amd64",
14+
"linux/arm64"
15+
],
1116
"bookworm": [
1217
"linux/amd64",
1318
"linux/arm64"
@@ -21,12 +26,16 @@
2126
"base:${VERSION}-${VARIANT}"
2227
],
2328
"variantTags": {
24-
"bookworm": [
25-
"base:${VERSION}-debian-12",
26-
"base:${VERSION}-debian12",
29+
"trixie": [
30+
"base:${VERSION}-debian-13",
31+
"base:${VERSION}-debian13",
2732
"base:${VERSION}-debian",
2833
"base:${VERSION}"
2934
],
35+
"bookworm": [
36+
"base:${VERSION}-debian-12",
37+
"base:${VERSION}-debian12"
38+
],
3039
"bullseye": [
3140
"base:${VERSION}-debian-11",
3241
"base:${VERSION}-debian11"

‎src/go/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
ARG VARIANT=1.25-bookworm
22
FROM golang:${VARIANT}
33

4+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
5+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
6+
RUN chmod +x /tmp/install-subversion.sh
7+
RUN /tmp/install-subversion.sh \
8+
&& rm -f /tmp/install-subversion.sh
9+
410
# [Optional] Uncomment the next line to use go get to install anything else you need
511
# RUN go get -x <your-dependency-or-tool>
612

‎src/go/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/go/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.4.5",
2+
"version": "1.4.6",
33
"variants": [
44
"1.25-bookworm",
55
"1.24-bookworm",

‎src/go/test-project/test.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
2424

2525
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
2626

27+
# Testing vulnerability issue CVE-2024-46901 fix by upgrading svn to 1.14.5.
28+
svn_version=$(svn --version --quiet)
29+
check-version-ge "svn-requirement" "${svn_version}" "1.14.5"
30+
2731
check "Oh My Zsh! theme" test -e $HOME/.oh-my-zsh/custom/themes/devcontainers.zsh-theme
2832
check "zsh theme symlink" test -e $HOME/.oh-my-zsh/custom/themes/codespaces.zsh-theme
2933

0 commit comments

Comments
 (0)