Merge branch 'main' into marrobi/issue3761

CHANGELOG.md

@@ -1,21 +1,66 @@
 <!-- markdownlint-disable MD041 -->
-## 0.16.0 (Unreleased)
+## 0.17.0 (Unreleased)
 
 **BREAKING CHANGES & MIGRATIONS**:
-To resolve the Airlock import issue described in ([#3767](https://github.com/microsoft/AzureTRE/pull/3767)), the new airlock import review tempalte will need to be registered using `make workspace_bundle BUNDLE=airlock-import-review`. Any existing airlock import review workspaces will need to be upgraded. After upgrading, run `make deploy-core` to reinstate any deleted DNS records.
 
 FEATURES:
 
 ENHANCEMENTS:
 
+BUG FIXES:
+
+COMPONENTS:
+
+
+## 0.16.0 (December 1, 2023)
+
+**BREAKING CHANGES & MIGRATIONS**:
+To resolve the Airlock import issue described in ([#3767](https://github.com/microsoft/AzureTRE/pull/3767)), the new airlock import review template will need to be registered using `make workspace_bundle BUNDLE=airlock-import-review`. Any existing airlock import review workspaces will need to be upgraded.
+
+Once you have upgraded the import review workspaces, delete the private endpoint, named `pe-stg-import-inprogress-blob-*` in the core resource group, and then run `make deploy-core` to reinstate the private endpoint and DNS records.
+
+ENHANCEMENTS:
+* Security updates aligning to Dependabot, MS Defender for Cloud and Synk ([#3796](https://github.com/microsoft/AzureTRE/issues/3796))
+
 BUG FIXES:
 * Fix issue where updates fail as read only is not configured consistently on schema fields ([#3691](https://github.com/microsoft/AzureTRE/issues/3691))
-* When geting avaialble address spaces allow those allocated to deleted workspaces to be reassigned ([#3691](https://github.com/microsoft/AzureTRE/issues/3691))
+* When getting available address spaces allow those allocated to deleted workspaces to be reassigned ([#3691](https://github.com/microsoft/AzureTRE/issues/3691))
 * Update Python packages, and fix breaking changes ([#3764](https://github.com/microsoft/AzureTRE/issues/3764))
 * Enabling support for more than 20 users/groups in Workspace API ([#3759](https://github.com/microsoft/AzureTRE/pull/3759  ))
 * Airlock Import Review workspace uses dedicated DNS zone to prevent conflict with core ([#3767](https://github.com/microsoft/AzureTRE/pull/3767))
 
 COMPONENTS:
+| name | version |
+| ----- | ----- |
+| devops | 0.5.1 |
+| core | 0.9.0 |
+| ui | 0.5.17 |
+| tre-workspace-base | 1.5.3 |
+| tre-workspace-unrestricted | 0.11.4 |
+| tre-workspace-airlock-import-review | 0.12.16 |
+| tre-service-mlflow | 0.7.7 |
+| tre-workspace-service-health | 0.2.5 |
+| tre-service-databricks | 1.0.3 |
+| tre-service-innereye | 0.6.4 |
+| tre-workspace-service-gitea | 0.8.7 |
+| tre-workspace-service-mysql | 0.4.5 |
+| tre-workspace-service-ohdsi | 0.2.4 |
+| tre-service-guacamole-linuxvm | 0.6.9 |
+| tre-service-guacamole-export-reviewvm | 0.1.8 |
+| tre-service-guacamole-windowsvm | 0.7.9 |
+| tre-service-guacamole-import-reviewvm | 0.2.8 |
+| tre-service-guacamole | 0.10.6 |
+| tre-user-resource-aml-compute-instance | 0.5.7 |
+| tre-service-azureml | 0.8.10 |
+| tre-shared-service-cyclecloud | 0.5.5 |
+| tre-shared-service-databricks-private-auth | 0.1.5 |
+| tre-shared-service-gitea | 0.6.10 |
+| tre-shared-service-airlock-notifier | 0.9.0 |
+| tre-shared-service-admin-vm | 0.4.3 |
+| tre-shared-service-certs | 0.5.1 |
+| tre-shared-service-sonatype-nexus | 2.8.13 |
+| tre-shared-service-firewall | 1.1.5 |
+
 
 ## 0.15.2 (October 24, 2023)
 

api_app/_version.py

@@ -1 +1 @@
-__version__ = "0.17.0"
+__version__ = "0.17.1"

api_app/requirements.txt

@@ -1,4 +1,4 @@
-aiohttp==3.8.6
+aiohttp==3.9.0
 azure-core==1.29.5
 azure-cosmos==4.5.1
 azure-eventgrid==4.15.0

cli/requirements.txt

@@ -8,4 +8,4 @@ pygments==2.16.1
 PyJWT==2.8.0
 azure-cli-core==2.50.0
 azure-identity==1.14.1
-aiohttp==3.8.6
+aiohttp==3.9.0

cli/setup.py

@@ -49,7 +49,7 @@
         "PyJWT==2.8.0",
         "azure-cli-core==2.50.0",
         "azure-identity==1.14.1",
-        "aiohttp==3.8.6"
+        "aiohttp==3.9.0"
     ],
 
     namespace_packages=[],

docs/tre-admins/upgrading-tre.md

@@ -33,3 +33,12 @@ If you wish to upgrade or deploy a specific version, or unreleased version of Az
 - `"OSS_VERSION": "v0.9.0"` (to use the specified tag; be sure to specify the complete tag name (prefixed with `v` and not the release name)
 - `"OSS_VERSION": "main"` (to use the latest code in the "main" branch)
 - `"OSS_VERSION": "1c6ff35ec9246e53b86e93b9da5b97911edc71c1"` (to use the code at the time of the commit identified by the hash)
+
+## Deploying a fork of Azure TRE
+
+If you wish to deploy the Azure TRE from a forked repository you can change the value of `OSS_REPO` in `.devcontainer/devcontainer.json`, for example:
+
+- `"OSS_REPO": "microsoft/AzureTRE"` (the default)
+- `"OSS_REPO": "myorg/AzureTRE"` (to point to fork of the Azure TRE in your GitHub organisation)
+
+When changing `OSS_REPO` ensure the `OSS_VERSION` variable refers to a GitHub ref on the repository fork.

resource_processor/_version.py

@@ -1 +1 @@
-__version__ = "0.8.0"
+__version__ = "0.8.1

resource_processor/vmss_porter/requirements.txt

@@ -1,5 +1,4 @@
-aiohttp==3.8.6
-azure-servicebus==7.11.3
+aiohttp==3.9.0
 azure-cli-core==2.50.0
 azure-identity==1.14.1
 azure-monitor-opentelemetry==1.1.0

templates/shared_services/certs/terraform/staticweb.tf

@@ -1,13 +1,14 @@
 # See https://microsoft.github.io/AzureTRE/tre-developers/letsencrypt/
 resource "azurerm_storage_account" "staticweb" {
-  name                      = local.staticweb_storage_name
-  resource_group_name       = data.azurerm_resource_group.rg.name
-  location                  = data.azurerm_resource_group.rg.location
-  account_kind              = "StorageV2"
-  account_tier              = "Standard"
-  account_replication_type  = "LRS"
-  enable_https_traffic_only = true
-  tags                      = local.tre_shared_service_tags
+  name                            = local.staticweb_storage_name
+  resource_group_name             = data.azurerm_resource_group.rg.name
+  location                        = data.azurerm_resource_group.rg.location
+  account_kind                    = "StorageV2"
+  account_tier                    = "Standard"
+  account_replication_type        = "LRS"
+  enable_https_traffic_only       = true
+  allow_nested_items_to_be_public = false
+  tags                            = local.tre_shared_service_tags
 
   static_website {
     index_document     = "index.html"

templates/workspace_services/guacamole/guacamole-server/docker/version.txt

@@ -1 +1 @@
-__version__ = "0.8.1"
+__version__ = "0.8.2"

templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/pom.xml

@@ -48,7 +48,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-security-keyvault-secrets</artifactId>
-            <version>4.6.3</version>
+            <version>4.7.2</version>
         </dependency>
         <dependency>
             <groupId>com.azure</groupId>

templates/workspaces/base/terraform/storage.tf

@@ -1,11 +1,12 @@
 resource "azurerm_storage_account" "stg" {
-  name                     = local.storage_name
-  resource_group_name      = azurerm_resource_group.ws.name
-  location                 = azurerm_resource_group.ws.location
-  account_tier             = "Standard"
-  account_replication_type = "GRS"
-  is_hns_enabled           = true
-  tags                     = local.tre_workspace_tags
+  name                            = local.storage_name
+  resource_group_name             = azurerm_resource_group.ws.name
+  location                        = azurerm_resource_group.ws.location
+  account_tier                    = "Standard"
+  account_replication_type        = "GRS"
+  allow_nested_items_to_be_public = false
+  is_hns_enabled                  = true
+  tags                            = local.tre_workspace_tags
 
   lifecycle { ignore_changes = [tags] }
 }

ui/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tre-ui",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "private": true,
   "dependencies": {
     "@azure/msal-browser": "^2.35.0",