Dependabot/moderate-high-critical-severity version bumps#4915
Dependabot/moderate-high-critical-severity version bumps#4915ChrisChapman-gh wants to merge 16 commits into
Conversation
Update direct aiohttp pins in api_app, resource_processor/vmss_porter, and the CLI requirements/setup metadata from 3.13.3 to 3.13.4. This addresses the open moderate Dependabot alerts for aiohttp: #333, #332, #331, #330, #313, #312, #311, #310, #309, #308, #307, #306, #296, #295, #294, and #293. These alerts are fixed by aiohttp 3.13.4.
… addressing security alerts
ChrisChapman-gh
added
api
Unit Test Results943 tests 943 ✅ 36s ⏱️ Results for commit 1030f42. ♻️ This comment has been updated with latest results. |
Update direct aiohttp pins in api_app, resource_processor/vmss_porter, and the CLI requirements/setup metadata from 3.13.3 to 3.13.4. This addresses the open moderate Dependabot alerts for aiohttp: #333, #332, #331, #330, #313, #312, #311, #310, #309, #308, #307, #306, #296, #295, #294, and #293. These alerts are fixed by aiohttp 3.13.4.
… addressing security alerts
…github.com/microsoft/AzureTRE into dependabot/moderate-severity-version-bumps
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/28656861726 (with refid (in response to this comment from @ChrisChapman-gh) |
…iohttp and pytest
…moderate severity alerts
…kens when mixed families are allowed
ChrisChapman-gh
changed the title
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/28663591304 (with refid (in response to this comment from @ChrisChapman-gh) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/28664830515 (with refid (in response to this comment from @ChrisChapman-gh) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/28665092962 (with refid (in response to this comment from @ChrisChapman-gh) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/28665303017 (with refid (in response to this comment from @ChrisChapman-gh) |
ChrisChapman-gh
force-pushed
the
dependabot/moderate-severity-version-bumps
branch
from
ad2cd6f to
8132b36
Compare
ChrisChapman-gh
changed the title
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/28667451230 (with refid (in response to this comment from @ChrisChapman-gh) |
ChrisChapman-gh
changed the title
There was a problem hiding this comment.
Pull request overview
Updates JavaScript and Python dependencies across Azure TRE components to address Dependabot moderate/high/critical security alerts, alongside patch-level version bumps for affected services.
Changes:
- Pin/bump UI tooling dependencies (Vite/Vitest) and update the npm lockfile accordingly.
- Bump Python dependencies (e.g.,
aiohttp,PyJWT,pytest,pytest-asyncio) across API/CLI/processors and update component versions. - Add changelog entry describing the Dependabot alert remediation.
Reviewed changes
Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| ui/app/package.json | Pins/bump UI build/test tool versions (Vite/Vitest). |
| ui/app/package-lock.json | Updates resolved npm dependency graph to match the new UI dependency versions. |
| resource_processor/vmss_porter/requirements.txt | Bumps aiohttp for the resource processor VMSS porter runner. |
| resource_processor/_version.py | Patch bump for resource processor version reflecting dependency change. |
| e2e_tests/requirements.txt | Bumps pytest tooling used by e2e tests. |
| cli/setup.py | Updates packaged CLI dependency pins (PyJWT/aiohttp). |
| cli/requirements.txt | Updates CLI runtime dependency pins (PyJWT/aiohttp). |
| CHANGELOG.md | Notes Dependabot alert remediation in Unreleased BUG FIXES. |
| api_app/requirements.txt | Bumps API runtime dependencies (aiohttp/PyJWT). |
| api_app/requirements-dev.txt | Bumps API dev/test dependencies (pytest/pytest-asyncio). |
| api_app/_version.py | Patch bump for API version reflecting dependency updates. |
| airlock_processor/requirements-dev.txt | Bumps airlock processor dev/test pytest version. |
| airlock_processor/_version.py | Patch bump for airlock processor version reflecting dependency updates. |
Files not reviewed (1)
- ui/app/package-lock.json: Generated file
Resolves
https://github.com/microsoft/AzureTRE/security/dependabot/351
https://github.com/microsoft/AzureTRE/security/dependabot/352
https://github.com/microsoft/AzureTRE/security/dependabot/353
https://github.com/microsoft/AzureTRE/security/dependabot/375
https://github.com/microsoft/AzureTRE/security/dependabot/442