Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sqlint: update deps to eliminate vulnerable dependency #351942

Merged
merged 1 commit into from
Nov 2, 2024
Merged

sqlint: update deps to eliminate vulnerable dependency #351942

merged 1 commit into from
Nov 2, 2024

Conversation

purcell
Copy link
Member

@purcell purcell commented Oct 28, 2024

See #351833, in which the following issue with this package was flagged:

Gemfile: ./pkgs/development/tools/sqlint/Gemfile.lock
Name: google-protobuf
Version: 3.25.0
CVE: CVE-2024-7254
GHSA: GHSA-735f-pc8j-v9w8
Criticality: High
URL: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8
Title: protobuf-java has potential Denial of Service issue
Solution: upgrade to '~> 3.25.5', '~> 4.27.5', '>= 4.28.2'

Things done

Updated dependency in Gemfile.lock, re-ran bundix to update gemset.nix.

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@purcell
sqlint: update deps to eliminate vulnerable dependency
da2a5cf 
See NixOS#351833

Gemfile: ./pkgs/development/tools/sqlint/Gemfile.lock
Name: google-protobuf
Version: 3.25.0
CVE: CVE-2024-7254
GHSA: GHSA-735f-pc8j-v9w8
Criticality: High
URL: GHSA-735f-pc8j-v9w8
Title: protobuf-java has potential Denial of Service issue
Solution: upgrade to '~> 3.25.5', '~> 4.27.5', '>= 4.28.2'
@purcell purcell added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Oct 28, 2024
@FliegendeWurst FliegendeWurst mentioned this pull request Oct 28, 2024
Open
63 tasks
@wegank wegank added the 12.approvals: 1 This PR was reviewed and approved by one reputable person label Oct 28, 2024
risicle
risicle approved these changes Nov 2, 2024
View reviewed changes
Copy link
Contributor

@risicle risicle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nixpkgs-review happy, macos 12 x86_64 & nixos x86_64

@SuperSandro2000 SuperSandro2000 merged commit 2d27f52 into NixOS:master Nov 2, 2024
34 checks passed
@purcell purcell deleted the sqlint-fix-protobuf-vuln branch November 3, 2024 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FliegendeWurst FliegendeWurst FliegendeWurst approved these changes

@risicle risicle risicle approved these changes

Assignees
No one assigned
Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 10.rebuild-darwin: 1-10 10.rebuild-darwin: 1 10.rebuild-linux: 1-10 10.rebuild-linux: 1 12.approvals: 1 This PR was reviewed and approved by one reputable person
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@purcell @risicle @FliegendeWurst @SuperSandro2000 @wegank