Skip to content

Conversation

nathanielc
Copy link
Contributor

@nathanielc nathanielc commented Nov 14, 2022

This reverts commit cced93e. The commit broke nightlies.

Checklist

Dear Author 👋, the following checks should be completed (or explicitly dismissed) before merging.

  • ✏️ Write a PR description, regardless of triviality, to include the value of this PR
  • 🔗 Reference related issues
  • 🏃 Test cases are included to exercise the new code
  • 🧪 If new packages are being introduced to stdlib, link to Working Group discussion notes and ensure it lands under experimental/
  • 📖 If language features are changing, ensure docs/Spec.md has been updated

Dear Reviewer(s) 👋, you are responsible (among others) for ensuring the completeness and quality of the above before approval.

…lsa query (#5324)"

This reverts commit cced93e.
The commit broke nightlies.
@nathanielc nathanielc requested a review from a team as a code owner November 14, 2022 19:58
@nathanielc nathanielc requested review from onelson and removed request for a team November 14, 2022 19:58
@nathanielc nathanielc merged commit b9d6eb6 into master Nov 14, 2022
@jdstrand
Copy link
Contributor

Fyi, this issue fixed the following in passing before an issue could be filed:

 - type: dependabot
   dependency: hyper
   detectedIn: libflux/Cargo.lock
   severity: medium
   advisory: https://github.com/advisories/GHSA-5h46-h7hh-c6x9
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/13
 - type: dependabot
   dependency: hyper
   detectedIn: libflux/Cargo.lock
   severity: low
   advisory: https://github.com/advisories/GHSA-f3pg-qwvg-p99c
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/14
 - type: dependabot
   dependency: tiny_http
   detectedIn: libflux/Cargo.lock
   severity: medium
   advisory: https://github.com/advisories/GHSA-7v2r-wxmg-mgvc
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/15
 - type: dependabot
   dependency: traitobject  
   detectedIn: libflux/Cargo.lock
   severity: critical
   advisory: https://github.com/advisories/GHSA-j79j-cx3h-g27h
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/16
 - type: dependabot
   dependency: hyper
   detectedIn: libflux/Cargo.lock
   severity: high
   advisory: https://github.com/advisories/GHSA-f67m-9j94-qv9j
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/17
 - type: dependabot
   dependency: traitobject
   detectedIn: libflux/Cargo.lock
   severity: critical
   advisory: https://github.com/advisories/GHSA-pp8r-vv2j-9j5v
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/17
 - type: dependabot
   dependency: traitobject
   detectedIn: libflux/Cargo.lock
   severity: critical
   advisory: https://github.com/advisories/GHSA-pp8r-vv2j-9j5v
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/18
 - type: dependabot
   dependency: typemap
   detectedIn: libflux/Cargo.lock
   severity: critical
   advisory: https://github.com/advisories/GHSA-vfv3-9w6v-23jp
   status: released
   url: https://github.com/influxdata/flux/security/dependabot/19

This was noted in https://github.com/influxdata/influx-security-tools-cve-data/blob/main/retired/CVE-2022-GH5342%23flux: "PR 5342 wasn't for this, but the regenerated Cargo.lock had all the fixes. Marking as 'medium' for now. The deps were removed and don't know the actual priority matches the upstream severity. Could investigate more fully, but since they're resolved, don't worry about it and treat it like a normal issue."

@jacobmarble jacobmarble deleted the revert branch January 4, 2024 17:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants