You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@beam.apache.org by "bvolpato (via GitHub)" <gi...@apache.org> on 2023/10/12 13:37:13 UTC
[PR] [Security] Bump org.json:json due to CVE-2022-45688 [beam]
bvolpato opened a new pull request, #28962:
URL: https://github.com/apache/beam/pull/28962
Comments suggested that org.json was in sync with libraries-bom, but when analyzing through
```
cd /tmp; wget https://repo1.maven.org/maven2/com/google/cloud/libraries-bom/26.22.0/libraries-bom-26.22.0.pom -O base.pom && mvn help:effective-pom -f base.pom -Doutput=effective.pom && cat effective.pom | grep -v 'dependencyManagement' > cleanup.pom && mvn dependency:tree -f cleanup.pom
```
We can see that it brings a much newer (and not in the CVE range) version:
```
[INFO] --- dependency:3.6.0:tree (default-cli) @ libraries-bom ---
[INFO] com.google.cloud:libraries-bom:pom:26.22.0
[INFO] +- com.google.cloud:google-cloud-bigquery:jar:2.31.1:compile
[INFO] | +- org.json:json:jar:20230618:compile
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Security] Bump org.json:json due to CVE-2022-45688 [beam]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #28962:
URL: https://github.com/apache/beam/pull/28962#issuecomment-1759865591
Assigning reviewers. If you would like to opt out of this review, comment `assign to next reviewer`:
R: @robertwb for label java.
R: @Abacn for label build.
Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)
The PR bot will only process comments in the main thread (not review comments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Security] Bump org.json:json due to CVE-2022-45688 [beam]
Posted by "bvolpato (via GitHub)" <gi...@apache.org>.
bvolpato commented on PR #28962:
URL: https://github.com/apache/beam/pull/28962#issuecomment-1759749688
Run Java_GCP_IO_Direct PreCommit
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Security] Bump org.json:json due to CVE-2022-45688 [beam]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #28962:
URL: https://github.com/apache/beam/pull/28962#issuecomment-1759696833
## [Codecov](https://app.codecov.io/gh/apache/beam/pull/28962?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
> Merging [#28962](https://app.codecov.io/gh/apache/beam/pull/28962?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (87cf1b2) into [master](https://app.codecov.io/gh/apache/beam/commit/4a7c4842aceb6786040d5cd699b7916c4509bb7b?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (4a7c484) will **increase** coverage by `0.01%`.
> Report is 3 commits behind head on master.
> The diff coverage is `n/a`.
```diff
@@ Coverage Diff @@
## master #28962 +/- ##
==========================================
+ Coverage 72.15% 72.17% +0.01%
==========================================
Files 686 686
Lines 101629 101629
==========================================
+ Hits 73329 73348 +19
+ Misses 26724 26705 -19
Partials 1576 1576
```
| [Flag](https://app.codecov.io/gh/apache/beam/pull/28962/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [python](https://app.codecov.io/gh/apache/beam/pull/28962/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `82.62% <ø> (+0.02%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
| [Files](https://app.codecov.io/gh/apache/beam/pull/28962?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [sdks/python/apache\_beam/ml/inference/base.py](https://app.codecov.io/gh/apache/beam/pull/28962?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c2Rrcy9weXRob24vYXBhY2hlX2JlYW0vbWwvaW5mZXJlbmNlL2Jhc2UucHk=) | `93.51% <ø> (ø)` | |
... and [13 files with indirect coverage changes](https://app.codecov.io/gh/apache/beam/pull/28962/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Security] Bump org.json:json due to CVE-2022-45688 [beam]
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn merged PR #28962:
URL: https://github.com/apache/beam/pull/28962
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org