Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade Jinja2 to address docs-only vulnerability #4607

Closed
benjsmi opened this issue Jan 16, 2024 · 3 comments
Closed

Upgrade Jinja2 to address docs-only vulnerability #4607

benjsmi opened this issue Jan 16, 2024 · 3 comments
Labels
workitem

Comments

@benjsmi
Copy link
Contributor

benjsmi commented Jan 16, 2024

Current Status

Jinja2 is vulnerable again and needs to be upgraded to v3.1.3.

As per https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22195.

fabric/docs/requirements.txt

Line 10 in 713ece2

Jinja2==3.0.3
shows that we are using v3.0.3 of Jinja. The CVE indicates we must move to v3.1.3. Looks like dependabot made an automatic PR already: #4604 but it broke the documentation build.

Goal

Upgrade to version v3.1.3 of Jinja2 for docs build that doesn't break the docs build.

Solution

I will be providing a PR.
benjsmi added a commit to benjsmi/fabric that referenced this issue Jan 17, 2024
@benjsmi
Upgrade Jinja2 to v3.1.3 as per hyperledger#4607.
24be0b1 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.
benjsmi added a commit to benjsmi/fabric that referenced this issue Jan 17, 2024
@benjsmi
Upgrade Jinja2 to v3.1.3 as per hyperledger#4607.
af34e93 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
@benjsmi benjsmi mentioned this issue Jan 17, 2024
Merged
denyeart pushed a commit that referenced this issue Jan 17, 2024
@benjsmi @denyeart
Upgrade Jinja2 to v3.1.3 as per #4607.
145815c 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
mergify bot pushed a commit that referenced this issue Jan 17, 2024
@benjsmi @mergify
Upgrade Jinja2 to v3.1.3 as per #4607.
85fad88 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
(cherry picked from commit 145815c)

# Conflicts:
#	docs/requirements.txt
@benjsmi
Copy link
Contributor Author

benjsmi commented Jan 17, 2024 •
edited
Loading

#4613 has been approved and merged.

@benjsmi benjsmi closed this as completed Jan 17, 2024
@benjsmi benjsmi reopened this Jan 17, 2024
@benjsmi
Copy link
Contributor Author

benjsmi commented Jan 17, 2024

Sorry, I forgot that I need to do this for the release branches as well.

benjsmi added a commit to benjsmi/fabric that referenced this issue Jan 17, 2024
@benjsmi
Upgrade Jinja2 to v3.1.3 as per hyperledger#4607.
e20b18d 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
@benjsmi benjsmi mentioned this issue Jan 17, 2024
Merged
@benjsmi
Copy link
Contributor Author

benjsmi commented Jan 17, 2024 •
edited
Loading

benjsmi added a commit to benjsmi/fabric that referenced this issue Jan 17, 2024
@benjsmi
Upgrade Jinja2 to v3.1.3 as per hyperledger#4607.
86dc8e1 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
denyeart pushed a commit that referenced this issue Jan 17, 2024
@benjsmi @denyeart
Upgrade Jinja2 to v3.1.3 as per #4607.
4b26694 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
benjsmi added a commit to benjsmi/fabric that referenced this issue Jan 17, 2024
@benjsmi
Upgrade Jinja2 to v3.1.3 as per hyperledger#4607.
8e55cbf 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
@benjsmi benjsmi mentioned this issue Jan 17, 2024
Merged
denyeart pushed a commit that referenced this issue Jan 17, 2024
@benjsmi @denyeart
Upgrade Jinja2 to v3.1.3 as per #4607.
f738488 
The version of Sphinx we were using is simply not compatible
with Jinja2 > v3.0.3, so given that we had to upset the delicate
balance of requirements anyway, the goal of this PR is now to
bring all docs infrastructure for CI/CD as well as dependencies
and indeed the docs themselves to the latest version.

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
@benjsmi benjsmi closed this as completed Jan 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
workitem
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@benjsmi