Skip to content

Commit 48ef7f5

Browse files
AlvaroRausellAlvaroRausell
authored
Merge branch 'main' into rust_debian_trixie
2 parents 14f6008 + 5195424 commit 48ef7f5

File tree

30 files changed

+287
-18
lines changed

30 files changed

+287
-18
lines changed

‎src/anaconda/.devcontainer/apply_security_patches.sh‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
#!/bin/bash
22

33
# vulnerabilities:
4-
# werkzeug - [GHSA-f9vj-2wh5-fj8j]
4+
# werkzeug - [GHSA-f9vj-2wh5-fj8j]
55

6-
vulnerable_packages=( "mistune=3.0.1" "transformers=4.49.0" "cryptography=43.0.3" "jupyter-lsp=2.2.2" "scrapy=2.11.2" \
6+
vulnerable_packages=( "mistune=3.0.1" "aiohttp=3.10.11" "cryptography=44.0.1" "h11=0.16.0" "jinja2=3.1.6" "jupyter_core=5.8.1" "protobuf=4.25.8" "requests=2.32.4" "setuptools=78.1.1" "transformers=4.52.1" "urllib3=2.5.0" "Werkzeug=3.0.6" "jupyter-lsp=2.2.2" "scrapy=2.11.2" \
77
"zipp=3.19.1" "tornado=6.4.2")
88

99
# Define the number of rows (based on the length of vulnerable_packages)
@@ -26,8 +26,7 @@ done
2626

2727
# Add an array for packages that should always pin to the provided version,
2828
# even if higher version is available in conda channel
29-
pin_to_required_version=( "transformers" "cryptography" ) # Add package names as needed
30-
29+
pin_to_required_version=("jupyter_core" "cryptography" )
3130
# Function to check if a package is in the pin_to_required_version array
3231
function is_pin_to_required_version() {
3332
local pkg="$1"

‎src/anaconda/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.2.7",
2+
"version": "1.2.8",
33
"build": {
44
"latest": true,
55
"rootDistro": "debian",

‎src/anaconda/test-project/test.sh‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,16 @@ checkPythonPackageVersion "joblib" "1.2.0"
3333
checkPythonPackageVersion "cookiecutter" "2.1.1"
3434
checkPythonPackageVersion "mistune" "2.0.3"
3535
checkPythonPackageVersion "numpy" "1.22"
36-
checkPythonPackageVersion "setuptools" "70.0.0"
36+
checkPythonPackageVersion "setuptools" "78.1.1"
3737
checkPythonPackageVersion "wheel" "0.38.1"
3838
checkPythonPackageVersion "nbconvert" "6.5.1"
39-
checkPythonPackageVersion "werkzeug" "3.0.3"
39+
checkPythonPackageVersion "werkzeug" "3.0.6"
4040
checkPythonPackageVersion "certifi" "2022.12.07"
41-
checkPythonPackageVersion "cryptography" "43.0.1"
42-
checkPythonPackageVersion "transformers" "4.36.0"
41+
checkPythonPackageVersion "cryptography" "44.0.1"
42+
checkPythonPackageVersion "h11" "0.16.0"
43+
checkPythonPackageVersion "jupyter_core" "5.8.1"
44+
checkPythonPackageVersion "protobuf" "4.25.8"
45+
checkPythonPackageVersion "transformers" "4.52.1"
4346
checkPythonPackageVersion "mpmath" "1.3.0"
4447
checkPythonPackageVersion "aiohttp" "3.10.2"
4548
checkPythonPackageVersion "tornado" "6.4.2"
@@ -53,15 +56,15 @@ checkPythonPackageVersion "jupyter-lsp" "2.2.2"
5356
checkPythonPackageVersion "idna" "3.7"
5457
checkPythonPackageVersion "jinja2" "3.1.4"
5558
checkPythonPackageVersion "scrapy" "2.11.2"
56-
checkPythonPackageVersion "requests" "2.32.2"
59+
checkPythonPackageVersion "requests" "2.32.4"
5760
checkPythonPackageVersion "scikit-learn" "1.5.0"
5861
checkPythonPackageVersion "zipp" "3.19.1"
5962

6063
checkCondaPackageVersion "pyopenssl" "24.2.1"
61-
checkCondaPackageVersion "requests" "2.32.2"
64+
checkCondaPackageVersion "requests" "2.32.4"
6265
checkCondaPackageVersion "pygments" "2.15.1"
6366
checkCondaPackageVersion "mpmath" "1.3.0"
64-
checkCondaPackageVersion "urllib3" "2.2.2"
67+
checkCondaPackageVersion "urllib3" "2.5.0"
6568
checkCondaPackageVersion "pyarrow" "14.0.1"
6669
checkCondaPackageVersion "pydantic" "2.5.3"
6770
checkCondaPackageVersion "tqdm" "4.66.4"

‎src/go/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
ARG VARIANT=1.25-bookworm
22
FROM golang:${VARIANT}
33

4+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
5+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
6+
RUN chmod +x /tmp/install-subversion.sh
7+
RUN /tmp/install-subversion.sh \
8+
&& rm -f /tmp/install-subversion.sh
9+
410
# [Optional] Uncomment the next line to use go get to install anything else you need
511
# RUN go get -x <your-dependency-or-tool>
612

‎src/go/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/go/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.4.5",
2+
"version": "1.4.6",
33
"variants": [
44
"1.25-bookworm",
55
"1.24-bookworm",

‎src/go/test-project/test.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
2424

2525
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
2626

27+
# Testing vulnerability issue CVE-2024-46901 fix by upgrading svn to 1.14.5.
28+
svn_version=$(svn --version --quiet)
29+
check-version-ge "svn-requirement" "${svn_version}" "1.14.5"
30+
2731
check "Oh My Zsh! theme" test -e $HOME/.oh-my-zsh/custom/themes/devcontainers.zsh-theme
2832
check "zsh theme symlink" test -e $HOME/.oh-my-zsh/custom/themes/codespaces.zsh-theme
2933

‎src/javascript-node/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ RUN \
2222
&& su ${USERNAME} -c "umask 0002 && npm install -g eslint" \
2323
&& npm cache clean --force > /dev/null 2>&1
2424

25+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
26+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
27+
RUN chmod +x /tmp/install-subversion.sh
28+
RUN /tmp/install-subversion.sh \
29+
&& rm -f /tmp/install-subversion.sh
30+
2531
# [Optional] Uncomment this section to install additional OS packages.
2632
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
2733
# && apt-get -y install --no-install-recommends <your-package-list-here>

‎src/javascript-node/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/javascript-node/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "3.0.2",
2+
"version": "3.0.3",
33
"variants": [
44
"24-bookworm",
55
"22-bookworm",

0 commit comments

Comments
 (0)