Skip to content

[universal] Update npm due to GHSA-c2qf-rxjj-qqgw #700

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samruddhikhandale merged 17 commits into from
Aug 15, 2023
Merged

[universal] Update npm due to GHSA-c2qf-rxjj-qqgw #700

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
6323606
Lock `dotnet` version to resolve issue with Oryx
alexander-smolyakov Aug 10, 2023
067f004
Update `patch-python` feature
alexander-smolyakov Aug 10, 2023
3de9207
Add patch for GHSA-c2qf-rxjj-qqgw
alexander-smolyakov Aug 10, 2023
cacc9bc
Fix tests
alexander-smolyakov Aug 10, 2023
2432c4a
Update manifest.json
alexander-smolyakov Aug 10, 2023
907b285
Update tests
alexander-smolyakov Aug 10, 2023
0d0c6dd
Resolve review comment: Lock `setuptools` package version for Python …
alexander-smolyakov Aug 11, 2023
a19202c
Reworked patch
alexander-smolyakov Aug 11, 2023
6ddb26b
Test: Update PIP for Python 3.10
alexander-smolyakov Aug 11, 2023
4556bab
Revert "Test: Update PIP for Python 3.10"
alexander-smolyakov Aug 11, 2023
eb2d238
Test: Update Python
alexander-smolyakov Aug 11, 2023
2a6d9b5
Revert "Test: Update Python"
alexander-smolyakov Aug 11, 2023
b8923a4
Restart checks
alexander-smolyakov Aug 14, 2023
9447967
test: Add trace commands
alexander-smolyakov Aug 15, 2023
059fa06
Revert "test: Add trace commands"
alexander-smolyakov Aug 15, 2023
8147ad2
Merge remote-tracking branch 'upstream/main' into GHSA-c2qf-rxjj-qqgw…
alexander-smolyakov Aug 15, 2023
be073a8
Explicitly set `useOryxIfAvailable` to `false`
alexander-smolyakov Aug 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions src/universal/.devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"userGid": "1000"
},
"ghcr.io/devcontainers/features/dotnet:1": {
"version": "7",
"version": "7.0.306",
Comment thread
alexander-smolyakov marked this conversation as resolved.
"installUsingApt": "false",
"additionalVersions": "6"
},
Expand All @@ -26,7 +26,8 @@
"version": "3.10.8",
"additionalVersions": "3.9.16",
"installJupyterlab": "true",
"configureJupyterlabAllowOrigin": "*"
"configureJupyterlabAllowOrigin": "*",
"useOryxIfAvailable": "false",
},
"./local-features/machine-learning-packages": "latest",
"ghcr.io/devcontainers/features/php:1": {
Expand Down
6 changes: 3 additions & 3 deletions src/universal/.devcontainer/local-features/patch-python/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@ update_package() {
# They are installed by the base image (python) which does not have the patch.

# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897
update_package /usr/local/python/3.9.*/bin/python setuptools
update_package /usr/local/python/3.10.*/bin/python setuptools
update_package /usr/local/python/3.9.*/bin/python setuptools==65.5.1
Comment thread
samruddhikhandale marked this conversation as resolved.
update_package /usr/local/python/3.10.*/bin/python setuptools==68.0.0

# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681
update_package /usr/local/python/3.10.*/bin/python requests
update_package /usr/local/python/3.10.*/bin/python requests==2.31.0
5 changes: 5 additions & 0 deletions src/universal/.devcontainer/local-features/setup-user/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,9 @@ find "${OPT_DIR}" -type d | xargs -n 1 chmod g+s

echo "Defaults secure_path=\"${DOTNET_PATH}:${NODE_PATH}/bin:${PHP_PATH}/bin:${PYTHON_PATH}/bin:${JAVA_PATH}/bin:${RUBY_PATH}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin:/usr/local/share:/home/${USERNAME}/.local/bin:${PATH}\"" >> /etc/sudoers.d/$USERNAME

# Temporary: Due to GHSA-c2qf-rxjj-qqgw
bash -c ". /usr/local/share/nvm/nvm.sh && nvm use 18"
bash -c "npm -g install -g npm@9.8.1"
bash -c ". /usr/local/share/nvm/nvm.sh && nvm use stable"

echo "Done!"
2 changes: 1 addition & 1 deletion src/universal/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@
"torch",
"requests",
"plotly",
"jupyterlab-git",
"jupyterlab_git",
"certifi",
"setuptools",
"wheel"
Expand Down
15 changes: 15 additions & 0 deletions src/universal/test-project/test-utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,3 +235,18 @@ checkCondaPackageVersion()
current_version=$(conda list "${PACKAGE}" | grep -E "^${PACKAGE}\s" | awk '{print $2}')
check-version-ge "conda-${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
}

checkBundledNpmVersion()
{
NODE_VERSION=$1
REQUIRED_NPM_VERSION=$2
bash -c ". /usr/local/share/nvm/nvm.sh && nvm use ${NODE_VERSION}"

current_npm_version=$(npm --version)

if [[ "$NODE_VERSION" != "default" ]]; then
bash -c ". /usr/local/share/nvm/nvm.sh && nvm use default"
fi

check-version-ge "node-${NODE_VERSION}-requirement" "${current_npm_version}" "${REQUIRED_NPM_VERSION}"
}
4 changes: 3 additions & 1 deletion src/universal/test-project/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ check "seaborn" python -c "import seaborn; print(seaborn.__version__)"
check "scikit-learn" python -c "import sklearn; print(sklearn.__version__)"
check "torch" python -c "import torch; print(torch.__version__)"
check "requests" python -c "import requests; print(requests.__version__)"
check "jupyterlab-git" bash -c "python3 -m pip list | grep jupyterlab-git"
check "jupyterlab-git" python -c "import jupyterlab_git; print(jupyterlab_git.__version__)"
Comment thread
samruddhikhandale marked this conversation as resolved.

# Check JupyterLab
check "jupyter-lab" jupyter-lab --version
Expand Down Expand Up @@ -95,6 +95,8 @@ count=$(ls /usr/local/share/nvm/versions/node | wc -l)
expectedCount=2
checkVersionCount "two versions of node are present" $count $expectedCount
echo $(echo "node versions" && ls -a /usr/local/share/nvm/versions/node)
checkBundledNpmVersion "default" "9.8.0"
checkBundledNpmVersion "18" "9.8.1"

# PHP
check "php" php --version
Expand Down