Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(weaver): address vulnerability CVE-2020-28477 and many others #2362

Merged
merged 1 commit into from
Apr 6, 2023
Merged

fix(weaver): address vulnerability CVE-2020-28477 and many others #2362

merged 1 commit into from
Apr 6, 2023

Conversation

sandeepnRES
Copy link
Contributor

@sandeepnRES sandeepnRES commented Apr 3, 2023 •
edited
Loading

petermetz
petermetz requested changes Apr 4, 2023
View reviewed changes
Copy link
Contributor

@petermetz petermetz left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sandeepnRES

  1. Please squash the commits and
  2. Make the commit subject unique if possible.
    In situations when you are fixing multiple (potentially a long list of) vulnerabilities and there's no way all the CVEs fit into the subject with the 72 character limit, then I recommend identifying the most severe one(s) as a best effort (it will still make the commit subject unique and that's what I'm after).
  3. Also recommend to identifying the component where the fixes are being applied in the commit subject, something like: fix(weaver): address vulnerability CVE-2021-23436 and many others

As always, if you need any help with the git mechanics, just let me know I'm happy to give advice or just get it done for you if that helps.

@sandeepnRES sandeepnRES changed the title fix: multiple vulnerabilities in weaver code fix(weaver): address vulnerability CVE-2020-28477 and many others Apr 4, 2023
petermetz
petermetz approved these changes Apr 4, 2023
View reviewed changes
Copy link
Contributor

@petermetz petermetz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sandeepnRES Thank you, LGTM

@sandeepnRES
fix(weaver): address vulnerability CVE-2020-28477 and many others
95a2134 
    - https://github.com/hyperledger/cacti/security/dependabot/434
    - https://github.com/hyperledger/cacti/security/dependabot/435
    - https://github.com/hyperledger/cacti/security/dependabot/423
    - https://github.com/hyperledger/cacti/security/dependabot/499
    - https://github.com/hyperledger/cacti/security/dependabot/570
    - https://github.com/hyperledger/cacti/security/dependabot/594
    - https://github.com/hyperledger/cacti/security/dependabot/592
    - https://github.com/hyperledger/cacti/security/dependabot/590
    - https://github.com/hyperledger/cacti/security/dependabot/589
    - https://github.com/hyperledger/cacti/security/dependabot/588
    - https://github.com/hyperledger/cacti/security/dependabot/594
    - https://github.com/hyperledger/cacti/security/dependabot/591
    - Remove unwanted dependencies in `weaver-besu-sdk`

Signed-off-by: Sandeep Nishad <sandeep.nishad1@ibm.com>
@sandeepnRES sandeepnRES merged commit 5fcfea3 into hyperledger-cacti:main Apr 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@petermetz petermetz petermetz approved these changes

@takeutak takeutak takeutak approved these changes

@izuru0 izuru0 Awaiting requested review from izuru0 izuru0 is a code owner

@jagpreetsinghsasan jagpreetsinghsasan Awaiting requested review from jagpreetsinghsasan jagpreetsinghsasan is a code owner

@VRamakrishna VRamakrishna Awaiting requested review from VRamakrishna VRamakrishna is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sandeepnRES @petermetz @takeutak