package: Upgrade dependencies to resolve security issues. #536

Henry8192 · 2024-09-12T20:04:21Z

Description

https://github.com/y-scope/clp/security/dependabot reports issue on webui and log-viewer-webui. This PR addresses these issues by simply either running npm i or npm audit fix.

Validation performed

In webui and log-viewer-webui folder, run npm i and observe 0 vulnerabilities.

Summary by CodeRabbit

New Features
- Updated dependencies for improved performance and stability.
Bug Fixes
- Upgraded webpack and webpack-dev-server to enhance build processes.
- Updated meteor-node-stubs for better compatibility.
Chores
- Modified version constraints for setuptools to allow newer versions.

kirkrodrigues · 2024-09-30T10:16:00Z

@Henry8192, can you address the security advisories that came in after this PR? We can try to get this merged today.

coderabbitai · 2024-09-30T19:57:05Z

Walkthrough

The pull request includes updates to several configuration files. The package.json for the log-viewer-webui-client and webui components has seen minor dependency version upgrades, specifically for webpack, webpack-dev-server, and meteor-node-stubs. Additionally, the requirements.txt file has modified the version constraint for setuptools, changing it from ~=69.0 to ~=75.2.0. Furthermore, the import statement for the msgpack library in the DbManager.js file has been updated from a default import to a named import for the encode function.

Changes

File	Change Summary
components/log-viewer-webui/client/package.json	Updated `webpack` from `^5.92.1` to `^5.95.0` and `webpack-dev-server` from `^5.0.4` to `^5.1.0`.
components/webui/package.json	Updated `meteor-node-stubs` from `^1.2.9` to `^1.2.10`.
requirements.txt	Updated `setuptools` version constraint from `~=69.0` to `~=75.2.0`.
components/log-viewer-webui/server/src/DbManager.js	Changed import from default to named for `msgpack` encoding function.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Files that changed from the base of the PR and between 0a4d001 and 74bc0bc.

📒 Files selected for processing (1)

components/log-viewer-webui/server/src/DbManager.js (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

components/log-viewer-webui/server/src/DbManager.js

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 0

🧹 Outside diff range and nitpick comments (1)

components/webui/package.json (1)
Line range hint 1-72: Consider a comprehensive dependency check.

While this update addresses one dependency, it might be beneficial to perform a comprehensive check of all dependencies. This aligns with kirkrodrigues' comment about tackling new security advisories.

Consider running the following commands to identify and address any other potential issues:
#!/bin/bash
# Description: Perform a comprehensive dependency check

# Test: Check for outdated dependencies
npm outdated

# Test: Check for known vulnerabilities
npm audit

# If vulnerabilities are found, consider running:
# npm audit fix
Review the results of these commands and update other dependencies if necessary. This proactive approach can help maintain the security and stability of the project.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Files that changed from the base of the PR and between a319661 and 7db2b7d.

⛔ Files ignored due to path filters (3)

components/log-viewer-webui/client/package-lock.json is excluded by !**/package-lock.json
components/log-viewer-webui/server/package-lock.json is excluded by !**/package-lock.json
components/webui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

components/log-viewer-webui/client/package.json (1 hunks)
components/webui/package.json (1 hunks)
requirements.txt (1 hunks)

🔇 Additional comments (3)

requirements.txt (1)
3-3: 🛠️ Refactor suggestion

Consider using a more conservative version constraint for setuptools.

The change from ~=69.0 to >=70.0.0 for setuptools significantly broadens the acceptable version range. While this allows for easier updates, it may introduce potential compatibility issues or security vulnerabilities in the future.

Consider using a more conservative approach, such as ~=70.0 or >=70.0,<71.0, which would allow for minor updates within the 70.x series while preventing unexpected major version jumps.

Let's verify if there are any known issues or vulnerabilities with setuptools versions >=70.0.0:

✅ Verification successful

No known vulnerabilities found for setuptools >=70.0.0

The verification indicates that there are currently no open security issues or CVEs associated with setuptools versions >=70.0.0. Therefore, the version constraint change is acceptable.
🏁 Scripts executed

The following scripts were executed for the analysis:

Script:
#!/bin/bash
# Description: Check for known vulnerabilities in setuptools >=70.0.0

# Use the GitHub CLI to search for open issues in the setuptools repository
gh issue list -R pypa/setuptools -S "in:title vulnerability OR security" -L 10 --json number,title,labels,url

# Search for CVEs related to setuptools
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=setuptools&keywordExactMatch=true&resultsPerPage=10" | jq '.vulnerabilities[] | {id: .cve.id, description: .cve.descriptions[0].value}'
Length of output: 324
components/log-viewer-webui/client/package.json (1)

27-29: Dependency updates look good, but let's verify a few things.

The updates to webpack (^5.94.0) and webpack-dev-server (^5.1.0) are appropriate and likely address the security issues reported by GitHub's Dependabot. Good job on keeping the dependencies up to date!

To ensure all vulnerabilities have been addressed and to check for any potential breaking changes, please run the following verification steps:

After running these commands, please confirm that:

No vulnerabilities are reported by npm audit.

There are no breaking changes in the new versions of webpack and webpack-dev-server that could affect your project.

If any issues are found, please address them before merging this PR.

components/webui/package.json (1)

28-28: Approved: Dependency update looks good.

The update of meteor-node-stubs from ^1.2.9 to ^1.2.10 is a minor version bump, which typically includes backwards-compatible bug fixes. This change aligns with the PR's objective of resolving dependency issues.

To ensure this update doesn't introduce any unexpected issues, please run the following verification steps:

If these steps complete without errors, it's likely safe to proceed with this update.

junhaoliao · 2024-10-21T17:36:01Z

For the PR title, how about:

Resolve dependency security issues.

junhaoliao · 2024-10-21T17:48:59Z

components/log-viewer-webui/client/package.json

@@ -24,9 +24,9 @@
    "mini-css-extract-plugin": "^2.9.0",
    "react-refresh": "^0.14.2",
    "style-loader": "^4.0.0",
-    "webpack": "^5.92.1",
+    "webpack": "^5.94.0",


There seems to be a newer version now.

Suggested change

"webpack": "^5.94.0",

"webpack": "^5.95.0",

junhaoliao · 2024-10-21T17:50:37Z

requirements.txt

@@ -1,3 +1,3 @@
 pip~=23.3
 poetry~=1.7
-setuptools~=69.0
+setuptools>=70.0.0


Is being more explicit better?

Suggested change

setuptools>=70.0.0

setuptools~=75.2.0

junhaoliao · 2024-10-21T18:09:31Z

Let's fix the code at https://github.com/y-scope/clp/blob/2c99375202b9f49991f13503c936854862bce8df/components/log-viewer-webui/server/src/DbManager.js

e.g.,
Line 5:

import {encode as msgpackEncode} from "@msgpack/msgpack";

...
Line 116:

                    Buffer.from(msgpackEncode(jobConfig)),

coderabbitai

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Files that changed from the base of the PR and between 7db2b7d and 0a4d001.

⛔ Files ignored due to path filters (3)

components/log-viewer-webui/client/package-lock.json is excluded by !**/package-lock.json
components/log-viewer-webui/server/package-lock.json is excluded by !**/package-lock.json
components/webui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

components/log-viewer-webui/client/package.json (1 hunks)
components/log-viewer-webui/server/src/DbManager.js (2 hunks)
requirements.txt (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

components/log-viewer-webui/client/package.json
requirements.txt

🧰 Additional context used

🔇 Additional comments (1)

components/log-viewer-webui/server/src/DbManager.js (1)

5-5: Excellent use of named import for msgpack library.

The change from a default import to a named import for the encode function improves code clarity and potentially reduces bundle size. This aligns well with modern JavaScript best practices.

components/log-viewer-webui/server/src/DbManager.js

Henry8192 · 2024-10-21T19:18:32Z

For the PR title, how about:
Resolve dependency security issues.

What do you think of this?
webui & log-viewer-webui: resolve security issues caused by dependencies

junhaoliao · 2024-10-21T19:20:53Z

For the PR title, how about:
Resolve dependency security issues.
What do you think of this? webui & log-viewer-webui: resolve security issues caused by dependencies

Since we also updated requirements.txt, it's no longer specific to webui & log-viewer-webui

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

components/log-viewer-webui/client/package-lock.json

kirkrodrigues

For the PR title, how about:

package: Upgrade dependencies to resolve security issues.

* ffi: Add support for serializing/deserializing auto-generated and user-generated schema tree node IDs. (y-scope#557) Co-authored-by: kirkrodrigues <[email protected]> * clp: Add missing C++ standard library includes in IR parsing files. (y-scope#561) Co-authored-by: kirkrodrigues <[email protected]> * log-viewer-webui: Update `yscope-log-viewer` to the latest version (which uses `clp-ffi-js`). (y-scope#562) * package: Upgrade dependencies to resolve security issues. (y-scope#536) * clp-s: Implement table packing (y-scope#466) Co-authored-by: wraymo <[email protected]> Co-authored-by: Kirk Rodrigues <[email protected]> Co-authored-by: wraymo <[email protected]> * log-viewer-webui: Update `yscope-log-viewer` to the latest version. (y-scope#565) * ci: Switch GitHub macOS build workflow to use macos-13 (x86) and macos-14 (ARM) runners. (y-scope#566) * core: Add support for user-defined HTTP headers in `NetworkReader`. (y-scope#568) Co-authored-by: Lin Zhihao <[email protected]> Co-authored-by: Xiaochong Wei <[email protected]> * chore: Update to the latest version of yscope-dev-utils. (y-scope#574) * build(core): Upgrade msgpack to v7.0.0. (y-scope#575) * feat(ffi): Update IR stream protocol version handling in preparation for releasing the kv-pair IR stream format: (y-scope#573) - Bump the IR stream protocol version to 0.1.0 for the kv-pair IR stream format. - Treat the previous IR stream format's versions as backwards compatible. - Differentiate between backwards-compatible and supported versions during validation. Co-authored-by: kirkrodrigues <[email protected]> * fix(taskfiles): Trim trailing slash from URL prefix in `download-and-extract-tar` (fixes y-scope#577). (y-scope#578) * fix(ffi): Correct `clp::ffi::ir_stream::Deserializer::deserialize_next_ir_unit`'s return value when failing to read the next IR unit's type tag. (y-scope#579) * fix(taskfiles): Update `yscope-log-viewer` sources in `log-viewer-webui-clients` sources list (fixes y-scope#576). (y-scope#580) * fix(cmake): Add Homebrew path detection for `mariadb-connector-c` to fix macOS build failure. (y-scope#582) Co-authored-by: kirkrodrigues <[email protected]> * refactor(ffi): Make `get_schema_subtree_bitmap` a public method of `KeyValuePairLogEvent`. (y-scope#581) * ci: Schedule GitHub workflows to daily run to detect failures due to upgraded dependencies or environments. (y-scope#583) * docs: Update the required version of task. (y-scope#567) * Add pr check workflow --------- Co-authored-by: kirkrodrigues <[email protected]> Co-authored-by: Junhao Liao <[email protected]> Co-authored-by: Henry8192 <[email protected]> Co-authored-by: Devin Gibson <[email protected]> Co-authored-by: wraymo <[email protected]> Co-authored-by: wraymo <[email protected]> Co-authored-by: Xiaochong(Eddy) Wei <[email protected]> Co-authored-by: Xiaochong Wei <[email protected]> Co-authored-by: haiqi96 <[email protected]>

Henry8192 added 5 commits September 12, 2024 15:36

fix webui vulnerabilities

a8d44bf

fix log-viewer-webui/client vulnerabilities

36086d4

fix setuptools command injection vulnerability

affc2ae

upgrade log-viewer-webui/client webpack version

e2a7321

upgrade log-viewer-webui/server micromatch version

5ae267c

Henry8192 requested review from junhaoliao and kirkrodrigues September 12, 2024 20:04

upgrade log-viewer-webui client & server vulnerabilities

7db2b7d

coderabbitai bot reviewed Sep 30, 2024

View reviewed changes

upgrade dependencies one more time

94901f9

junhaoliao reviewed Oct 21, 2024

View reviewed changes

address suggestions from code review

0a4d001

coderabbitai bot reviewed Oct 21, 2024

View reviewed changes

components/log-viewer-webui/server/src/DbManager.js Outdated Show resolved Hide resolved

Henry8192 changed the title ~~webui & log-viewer-webui: resolve dependency issues~~ Resolve security issues caused by dependencies Oct 21, 2024

Update components/log-viewer-webui/server/src/DbManager.js

74bc0bc

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

kirkrodrigues requested changes Oct 24, 2024

View reviewed changes

components/log-viewer-webui/client/package-lock.json Show resolved Hide resolved

kirkrodrigues approved these changes Oct 24, 2024

View reviewed changes

Henry8192 changed the title ~~Resolve security issues caused by dependencies~~ package: Upgrade dependencies to resolve security issues. Oct 24, 2024

Henry8192 merged commit 7043d04 into y-scope:main Oct 24, 2024
5 checks passed

Henry8192 deleted the package-fix branch October 24, 2024 19:15

jackluo923 pushed a commit to jackluo923/clp that referenced this pull request Dec 4, 2024

package: Upgrade dependencies to resolve security issues. (y-scope#536)

5ece291

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

package: Upgrade dependencies to resolve security issues. #536

package: Upgrade dependencies to resolve security issues. #536

Henry8192 commented Sep 12, 2024 •

edited by coderabbitai bot

Loading

kirkrodrigues commented Sep 30, 2024

coderabbitai bot commented Sep 30, 2024 •

edited

Loading

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

coderabbitai bot left a comment

junhaoliao commented Oct 21, 2024 •

edited

Loading

junhaoliao Oct 21, 2024

junhaoliao Oct 21, 2024

junhaoliao commented Oct 21, 2024 •

edited

Loading

coderabbitai bot left a comment

Henry8192 commented Oct 21, 2024

junhaoliao commented Oct 21, 2024

kirkrodrigues left a comment

package: Upgrade dependencies to resolve security issues. #536

package: Upgrade dependencies to resolve security issues. #536

Conversation

Henry8192 commented Sep 12, 2024 • edited by coderabbitai bot Loading

Description

Validation performed

Summary by CodeRabbit

kirkrodrigues commented Sep 30, 2024

coderabbitai bot commented Sep 30, 2024 • edited Loading

Walkthrough

Changes

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

coderabbitai bot left a comment

Choose a reason for hiding this comment

junhaoliao commented Oct 21, 2024 • edited Loading

junhaoliao Oct 21, 2024

Choose a reason for hiding this comment

junhaoliao Oct 21, 2024

Choose a reason for hiding this comment

junhaoliao commented Oct 21, 2024 • edited Loading

coderabbitai bot left a comment

Choose a reason for hiding this comment

Henry8192 commented Oct 21, 2024

junhaoliao commented Oct 21, 2024

kirkrodrigues left a comment

Choose a reason for hiding this comment

Henry8192 commented Sep 12, 2024 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Sep 30, 2024 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)

junhaoliao commented Oct 21, 2024 •

edited

Loading

junhaoliao commented Oct 21, 2024 •

edited

Loading