Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: correct security vulnerability #1498

Merged
merged 1 commit into from
Jan 18, 2024
Merged

fix: correct security vulnerability #1498

merged 1 commit into from
Jan 18, 2024

Conversation

AleJo2995
Copy link
Collaborator

Types of changes

  • Hot fix (emergency fix and release)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Documentation (change which affects the documentation site)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Release (develop -> main)

Quality assurance (all should be covered).

  • My code follows the code style of this project.
  • Documentation for my change is up to date?
  • My PR meets testing requirements.
  • All new and existing tests passed.
  • All commits are signed-off.

Summary

Key links:

Before you merge

  • Ensure it is a 'squash commit' if not a release.
  • Ensure CI is currently passing
  • Check sonar. If you are working for a fork a maintainer will reach out, if required.

Signed-off-by: Alejandro Jose Leiva Palomo <alejandro.leiva.palomo@ibm.com>
@AleJo2995
Copy link
Collaborator Author

I already tested out the change in the repo that is using trestle and the vulnerability has been resolved successfully

image

Copy link
Collaborator

@mrgadgil mrgadgil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like a major version upgrade. Can you look at the change log to verify nothing breaks for us

@AleJo2995
Copy link
Collaborator Author

AleJo2995 commented Jan 17, 2024

To me there's not actually something to be worried about in terms of any breaking changes so far. Here's the link for the 3.1.0 change coming from 3.0.1 version we had https://github.com/pallets/jinja/releases/tag/3.1.0. I don't see anything in particular to be worried about. for 3.1.3 they fix the vuln and that's pretty much it. One good signal of it is that all tests are passing correctly :)

Copy link
Collaborator

@mrgadgil mrgadgil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you for verifying.

@AleJo2995 AleJo2995 merged commit e23792c into develop Jan 18, 2024
15 checks passed
@AleJo2995 AleJo2995 deleted the fix/fix-vuln branch January 18, 2024 16:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants