Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade ktlint to mitigate CVE-2023-6378 #1095

Merged
merged 2 commits into from
Feb 8, 2024

Conversation

r1walz
Copy link
Collaborator

@r1walz r1walz commented Feb 7, 2024

Issues: #1059 #1060

Description of changes:

Mitigating CVE-2023-6378.

CheckList:

  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@r1walz
Copy link
Collaborator Author

r1walz commented Feb 8, 2024

Build is failing as newly upgraded ktlint dep is failing due to lint violations. @bowenlan-amzn @vikasvb90 I think we should add lint rules and apply formatting here?

@vikasvb90
Copy link
Collaborator

@r1walz Yes, we will have to fix formattings but I am not sure if cli is the right dependency to be replaced with.

@r1walz
Copy link
Collaborator Author

r1walz commented Feb 8, 2024

Original artifact for ktlint was moved to ktlint-cli. Since, ktlint v0.51.0-FINAL has the required dependency upgrade, I switched over to the new artifact only. This is also aligned with their change log breaking changes suggestions.

@r1walz
Copy link
Collaborator Author

r1walz commented Feb 8, 2024

Removing backport labels as this is going to require manual backport.

@r1walz r1walz force-pushed the cve-2023-6378 branch 2 times, most recently from 1f4fde2 to 884fe42 Compare February 8, 2024 05:40
Copy link

codecov bot commented Feb 8, 2024

Codecov Report

Attention: 539 lines in your changes are missing coverage. Please review.

Comparison is base (027509e) 74.90% compared to head (884fe42) 75.37%.
Report is 1 commits behind head on main.

❗ Current head 884fe42 differs from pull request most recent head 5f8891b. Consider uploading reports for the commit 5f8891b to get more accurate results

Files Patch % Lines
...agement/indexstatemanagement/ManagedIndexRunner.kt 57.14% 30 Missing and 9 partials ⚠️
...xmanagement/snapshotmanagement/model/SMMetadata.kt 69.51% 17 Missing and 8 partials ⚠️
...atemanagement/step/rollover/AttemptRolloverStep.kt 75.00% 15 Missing and 7 partials ⚠️
...xmanagement/rollup/actionfilter/FieldCapsFilter.kt 31.03% 20 Missing ⚠️
...ndexmanagement/transform/TransformSearchService.kt 73.23% 12 Missing and 7 partials ⚠️
...nt/indexstatemanagement/ManagedIndexCoordinator.kt 58.13% 16 Missing and 2 partials ⚠️
...ndexstatemanagement/validation/ActionValidation.kt 5.26% 18 Missing ⚠️
...exstatemanagement/model/destination/Destination.kt 29.16% 16 Missing and 1 partial ⚠️
.../opensearch/indexmanagement/rollup/RollupRunner.kt 42.85% 8 Missing and 8 partials ⚠️
...atemanagement/step/shrink/AttemptMoveShardsStep.kt 79.45% 10 Missing and 5 partials ⚠️
... and 92 more
Additional details and impacted files
@@             Coverage Diff              @@
##               main    #1095      +/-   ##
============================================
+ Coverage     74.90%   75.37%   +0.47%     
- Complexity     2812     2815       +3     
============================================
  Files           367      367              
  Lines         16522    17038     +516     
  Branches       2363     2370       +7     
============================================
+ Hits          12375    12843     +468     
- Misses         2845     2894      +49     
+ Partials       1302     1301       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@r1walz r1walz requested a review from vikasvb90 February 8, 2024 18:45
@r1walz r1walz merged commit 4d8ef69 into opensearch-project:main Feb 8, 2024
28 of 29 checks passed
@r1walz r1walz deleted the cve-2023-6378 branch February 8, 2024 18:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants