[release 1.13] security: up deps in release branch #3463

sicoyle · 2024-06-25T17:42:05Z

Description

I had issues cherry picking my merged commit directly from the main branch as it was bringing in a lot of other changes, so manually copy/pasted. For the cloudflare worker stuff I did up the dep and then recompile everything so that should be g2g.

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

Code compiles correctly
Created/updated tests
Extended the documentation / Created issue in the https://github.com/dapr/docs/ repo: dapr/docs#[issue number]

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-25T17:59:25Z

will revert the go version bump in a bit. Didn't realize that was in my changes as well, but already switched to dapr/dapr updates for this

ItalyPaleAle

Ideally in a release branch we should never update dependencies unless they contain security issues or critical bug fixes. I am concerned with the fact that this PR updates A LOT of dependencies, including SDKs for cloud services.

.build-tools/go.mod

go.mod

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-25T20:58:39Z

Ideally in a release branch we should never update dependencies unless they contain security issues or critical bug fixes. I am concerned with the fact that this PR updates A LOT of dependencies, including SDKs for cloud services.

These are all for security vulnerabilities based on my PR desc here: #3390

ItalyPaleAle · 2024-06-25T21:06:20Z

Ideally in a release branch we should never update dependencies unless they contain security issues or critical bug fixes. I am concerned with the fact that this PR updates A LOT of dependencies, including SDKs for cloud services.

These are all for security vulnerabilities based on my PR desc here: #3390

I see the go.mod contains a lot more deps updated than the ones you list in #3390, including SDKs for all cloud providers.

sicoyle · 2024-06-25T21:09:29Z

I see the go.mod contains a lot more deps updated than the ones you list in #3390, including SDKs for all cloud providers.

I def did not do a go get -u ... on everything. Let me see what I can do. Part of this could also be that I had to copy/paste based on my other PR, so maybe just need to not grab less changes. I'm working on it 😁

Signed-off-by: Samantha Coyle <[email protected]>

ItalyPaleAle · 2024-06-25T21:44:07Z

I see the go.mod contains a lot more deps updated than the ones you list in #3390, including SDKs for all cloud providers.

I def did not do a go get -u ... on everything. Let me see what I can do. Part of this could also be that I had to copy/paste based on my other PR, so maybe just need to not grab less changes. I'm working on it 😁

Here's my tip:

Reset to main: git fetch --all && get reset --hard origin/main
Open the go.mod file (the main one) and update the deps that you listed in the table, and only those
make modtidy-all

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-26T16:08:17Z

flaky failure?

--- FAIL: Test_EndToEnd (0.19s)
    --- FAIL: Test_EndToEnd/local (0.06s)
        --- FAIL: Test_EndToEnd/local/consoleLog_multiple_requests (0.02s)
            e2e_test.go:118: 
                	Error Trace:	/home/runner/work/components-contrib/components-contrib/middleware/http/wasm/internal/e2e_test.go:118
                	            				/home/runner/work/components-contrib/components-contrib/middleware/http/wasm/internal/e2e_test.go:173
                	Error:      	"time=\"2024-06-26T16:07:13.331155155Z\" level=info msg=\"main ConsoleLog\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.33158788Z\" level=info msg=\"main ConsoleLog\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331608729Z\" level=info msg=\"request[0] ConsoleLog\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331616583Z\" level=debug msg=\"wasm stdout: main Stdout\\nmain Stdout\\nrequest[0] Stdout\\n\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331621553Z\" level=debug msg=\"wasm stderr: main Stderr\\nmain Stderr\\nrequest[0] Stderr\\n\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331631812Z\" level=info msg=\"request[1] ConsoleLog\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.33163606Z\" level=debug msg=\"wasm stdout: request[1] Stdout\\n\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331639516Z\" level=debug msg=\"wasm stderr: request[1] Stderr\\n\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331648322Z\" level=info msg=\"request[2] ConsoleLog\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.33165221Z\" level=debug msg=\"wasm stdout: request[2] Stdout\\n\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\ntime=\"2024-06-26T16:07:13.331655425Z\" level=debug msg=\"wasm stderr: request[2] Stderr\\n\" instance=fv-az1215-760 scope=Test_EndToEnd type=log ver=unknown\n" does not contain "level=debug msg=\"wasm stdout: main Stdout\\nrequest[0] Stdout\\n\""
                	Test:       	Test_EndToEnd/local/consoleLog_multiple_requests
FAIL

go.mod

ItalyPaleAle · 2024-06-26T16:10:16Z

go.mod

-	cloud.google.com/go/pubsub v1.33.0
-	cloud.google.com/go/secretmanager v1.11.2
-	cloud.google.com/go/storage v1.33.0
+	cloud.google.com/go/pubsub v1.36.1


Why was the Google Cloud SDK updated? This was not in the table with the list of vulnerabilities

this is required due to bumping the grpc package to the version without a security vulnerability. I just tried downgrading it back and it bumps us down for grpc pkg unfortunately

See if using 1.60.1 requires bumping too, see other thread

i think i got it now

go.mod

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-26T19:44:05Z

@ItalyPaleAle are these transient failures in the build..? I think it's ready ready ready, but yeah need help knowing if these failures are flaky or not 🚀 🤓 ⭐

tests/e2e/pubsub/jetstream/go.mod

tests/certification/state/azure/cosmosdb/cosmosdb_test.go

tests/certification/secretstores/hashicorp/vault/metadata_helpers.go

tests/certification/go.mod

tests/certification/configuration/redis/redis_test.go

tests/certification/configuration/postgres/postgres_test.go

state/azure/cosmosdb/cosmosdb_query.go

go.mod

ItalyPaleAle · 2024-06-26T20:10:48Z

common/component/cloudflare/worker-src/package.json

@@ -2,7 +2,7 @@
    "private": true,
    "name": "dapr-cfworkers-client",
    "description": "Client code for Dapr to interact with Cloudflare Workers",
-    "version": "20230517",
+    "version": "20230625",


Suggested change

"version": "20230625",

"version": "20240625",

:)

This has not been resolved. The date is 1 year off...

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-26T21:58:53Z

pls note that make modtidy-all with specifying my go version for go 1.21 creates two require blocks in the tests/certification go mod. That needs to stay to keep linter happy. I think I've addressed everything :)

Signed-off-by: Alessandro (Ale) Segala <[email protected]>

Signed-off-by: Samantha Coyle <[email protected]>

…mponents-contrib into release-branch-sec-vul-fixing

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-27T13:50:43Z

anything else @ItalyPaleAle or g2g? :)

ItalyPaleAle · 2024-06-27T15:17:17Z

There's one comment left PTAL

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle · 2024-06-27T16:35:49Z

done addressing feedback. Anything else?

security: up deps in release branch

000fcb4

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle requested review from a team as code owners June 25, 2024 17:42

ItalyPaleAle suggested changes Jun 25, 2024

View reviewed changes

.build-tools/go.mod Outdated Show resolved Hide resolved

go.mod Outdated Show resolved Hide resolved

go.mod Outdated Show resolved Hide resolved

sicoyle added 2 commits June 25, 2024 15:38

fix: address feedback

eb7d579

Signed-off-by: Samantha Coyle <[email protected]>

fix: update field name

c6feaaa

Signed-off-by: Samantha Coyle <[email protected]>

fix: bump down a few things i added from main

c301c10

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle added 9 commits June 25, 2024 17:04

fix: this for sure is needed by runtime

ff74136

Signed-off-by: Samantha Coyle <[email protected]>

fix: redo go mod bumps

3adcc20

Signed-off-by: Samantha Coyle <[email protected]>

fix: use kit new release

adc0473

Signed-off-by: Samantha Coyle <[email protected]>

fix: more fixing on kit versions

cb91685

Signed-off-by: Samantha Coyle <[email protected]>

style: making linter happy

207d072

Signed-off-by: Samantha Coyle <[email protected]>

fix: see if this makes things happy

d5785b2

Signed-off-by: Samantha Coyle <[email protected]>

fix: update test func sigs

f9c6189

Signed-off-by: Samantha Coyle <[email protected]>

fix: mod tidy all

3d079ab

Signed-off-by: Samantha Coyle <[email protected]>

fix(tests): update func sig too

2de07a6

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle requested a review from ItalyPaleAle June 26, 2024 15:58

fix: mod tidy

a18e5a1

Signed-off-by: Samantha Coyle <[email protected]>

ItalyPaleAle suggested changes Jun 26, 2024

View reviewed changes

sicoyle added 2 commits June 26, 2024 11:21

fix: up sarama version

39de17d

Signed-off-by: Samantha Coyle <[email protected]>

fix: use avro version previously used

0a02139

Signed-off-by: Samantha Coyle <[email protected]>

berndverst changed the title ~~security: up deps in release branch~~ [release 1.13] security: up deps in release branch Jun 26, 2024

sicoyle added 2 commits June 26, 2024 14:26

fix: use kit latest to get grpc version correct

429d923

Signed-off-by: Samantha Coyle <[email protected]>

fix: use kit latest elsewhere

5fadbbd

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle requested a review from ItalyPaleAle June 26, 2024 19:36

ItalyPaleAle suggested changes Jun 26, 2024

View reviewed changes

sicoyle added 3 commits June 26, 2024 16:22

fix: address feedback

3fdf254

Signed-off-by: Samantha Coyle <[email protected]>

style: one require block

5e2e5a7

Signed-off-by: Samantha Coyle <[email protected]>

fix: update date

788bc84

Signed-off-by: Samantha Coyle <[email protected]>

sicoyle requested a review from ItalyPaleAle June 26, 2024 21:25

sicoyle added 2 commits June 26, 2024 16:30

fix: last bits of feedback

60e054a

Signed-off-by: Samantha Coyle <[email protected]>

fix: go mod tidy

b02a988

Signed-off-by: Samantha Coyle <[email protected]>

ItalyPaleAle and others added 4 commits June 26, 2024 15:12

Update state/azure/cosmosdb/cosmosdb_query.go

9e0b47e

Signed-off-by: Alessandro (Ale) Segala <[email protected]>

fix(build): revert an old change based on version change

e919d31

Signed-off-by: Samantha Coyle <[email protected]>

Merge branch 'release-branch-sec-vul-fixing' of github.com:sicoyle/co…

bfdfa92

…mponents-contrib into release-branch-sec-vul-fixing

fix: mod tidy

7c24253

Signed-off-by: Samantha Coyle <[email protected]>

fix: update date

84b5503

Signed-off-by: Samantha Coyle <[email protected]>

ItalyPaleAle approved these changes Jun 27, 2024

View reviewed changes

ItalyPaleAle merged commit af98674 into dapr:release-1.13 Jun 27, 2024
87 of 93 checks passed

ItalyPaleAle mentioned this pull request Jun 27, 2024

Fix ptr for Dapr to compile #3468

Closed

berndverst added this to the v1.14 milestone Jul 23, 2024

artursouza removed this from the v1.14 milestone Aug 2, 2024

[release 1.13] security: up deps in release branch #3463

[release 1.13] security: up deps in release branch #3463

Uh oh!

Conversation

sicoyle commented Jun 25, 2024

Description

Issue reference

Checklist

Uh oh!

sicoyle commented Jun 25, 2024

Uh oh!

ItalyPaleAle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sicoyle commented Jun 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ItalyPaleAle commented Jun 25, 2024

Uh oh!

sicoyle commented Jun 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ItalyPaleAle commented Jun 25, 2024

Uh oh!

sicoyle commented Jun 26, 2024

Uh oh!

Uh oh!

ItalyPaleAle Jun 26, 2024

Choose a reason for hiding this comment

Uh oh!

sicoyle Jun 26, 2024

Choose a reason for hiding this comment

Uh oh!

ItalyPaleAle Jun 26, 2024

Choose a reason for hiding this comment

Uh oh!

sicoyle Jun 26, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sicoyle commented Jun 26, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ItalyPaleAle Jun 26, 2024

Choose a reason for hiding this comment

Uh oh!

ItalyPaleAle Jun 27, 2024

Choose a reason for hiding this comment

Uh oh!

sicoyle Jun 27, 2024

Choose a reason for hiding this comment

Uh oh!

sicoyle commented Jun 26, 2024

Uh oh!

sicoyle commented Jun 27, 2024

Uh oh!

ItalyPaleAle commented Jun 27, 2024

Uh oh!

sicoyle commented Jun 27, 2024

Uh oh!

Uh oh!

Uh oh!

sicoyle commented Jun 25, 2024 •

edited

Loading

sicoyle commented Jun 25, 2024 •

edited

Loading