Skip to content

Conversation

alexander-smolyakov
Copy link
Contributor

Dev container name:

  • miniconda

Description:

This PR addresses the GHSA-j8r2-6x86-q33q and GHSA-5cpq-8wj7-hf2v vulnerabilities. These vulnerabilities come from the continuumio/anaconda3 image and are related to the cryptography and requests packages.

Changelog:

  • Updated Dockerfile to install the updated versions of pyopenssl, cryptography, and requests;
  • Added tests to verify the minimum version for the pyopenssl and cryptography packages:
    • cryptography: Minimum package version set to 41.0.2, which fixes GHSA-5cpq-8wj7-hf2v;
    • pyopenssl: Minimum package version set to 23.2.0 to be compatible with cryptography packages;
    • requests: Minimum package version set to 2.31.0, which fixes GHSA-j8r2-6x86-q33q;
  • Added tests to verify minimum package version via the conda list command.

Checklist:

  • Checked that applied changes work as expected

@alexander-smolyakov alexander-smolyakov requested a review from a team as a code owner July 27, 2023 12:00
@alexander-smolyakov alexander-smolyakov changed the title [anaconda] Update Conda packages due to Address GHSA-j8r2-6x86-q33q and GHSA-5cpq-8wj7-hf2v [anaconda] Update Conda packages due to GHSA-j8r2-6x86-q33q and GHSA-5cpq-8wj7-hf2v Jul 27, 2023
@samruddhikhandale samruddhikhandale merged commit bf5bd6a into devcontainers:main Jul 28, 2023
@samruddhikhandale samruddhikhandale mentioned this pull request Jul 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants