Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sync kserve/rest-proxy with odh/rest-proxy #26

Merged
merged 9 commits into from
Jan 10, 2024
Merged

sync kserve/rest-proxy with odh/rest-proxy #26

merged 9 commits into from
Jan 10, 2024

Commits on Jan 10, 2024

  1. [RHODS-12555] - CVE-2023-44487 

    Plus:

Fixes lint issues:

- Can't run linter goanalysis_metalinter: goanalysis_metalinter: buildir: package "netip" (isInitialPkg: false, needAnalyzeSource: true): in net/netip.AddrFromSlice: cannot convert Load <[]byte> t0 ([]byte) to [4]byte

Warnings:

WARN [runner] The linter 'structcheck' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter.  Replaced by unused.
WARN [runner] The linter 'deadcode' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter.  Replaced by unused.
WARN [runner] The linter 'varcheck' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter.  Replaced by unused.

Signed-off-by: Spolti <[email protected]>
    @spolti
    spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    918f79c View commit details
    Browse the repository at this point in the history

  2. fix: Specify Python 3.8 in Dockerfile (opendatahub-io#34) 

    Specify and link python38 to fix build/test failures due to
the wrong Python version (3.6) being used from base image.

---------

Signed-off-by: Rafael Vasquez <[email protected]>
Signed-off-by: Spolti <[email protected]>
    @rafvasq @spolti
    rafvasq authored and spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    da70aa6 View commit details
    Browse the repository at this point in the history

  3. Fix github.com/elazarl/goproxy Denial of Service 

    Signed-off-by: Spolti <[email protected]>
    @spolti
    spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    a485071 View commit details
    Browse the repository at this point in the history

  4. chore: Add CodeQL configuration (opendatahub-io#29) 

    Add configuration file for CodeQL vulnerability scanning.

Signed-off-by: Christian Kadner <[email protected]>
Signed-off-by: Spolti <[email protected]>
    @ckadner @spolti
    ckadner authored and spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    c750c98 View commit details
    Browse the repository at this point in the history

  5. chore(deps): Upgrade golang.org/x/net and golang.org/grpc (opendatahu… 

    …b-io#30)

Issues addressed:
- https://github.com/kserve/rest-proxy/security/dependabot/1
- https://github.com/kserve/rest-proxy/security/dependabot/2
- https://github.com/kserve/rest-proxy/security/dependabot/3
- https://github.com/kserve/rest-proxy/security/dependabot/4
- https://github.com/kserve/rest-proxy/security/dependabot/5
- https://www.cve.org/CVERecord?id=CVE-2023-37788

---------

Signed-off-by: Spolti <[email protected]>
    @spolti
    spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    11c52d0 View commit details
    Browse the repository at this point in the history

  6. chore: Upgrade Golang version from 1.18 to 1.19 (opendatahub-io#28) 

    - Remove the linters for "deadcode", "structcheck", "varcheck"
- Use "os" packages instead of deprecated "io/ioutil" (SA1019)
- Capture pre-commit output in a local log file

---------

Signed-off-by: Spolti <[email protected]>
    @spolti
    spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    2884d60 View commit details
    Browse the repository at this point in the history

  7. chore: Upgrade google.golang.org/protobuf 

    chore: Fixes google.golang.org/protobuf Stack-based Buffer Overflow

https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFENCODINGPROTOJSON-6137908

Signed-off-by: Spolti <[email protected]>
    @spolti
    spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    bd494fe View commit details
    Browse the repository at this point in the history

  8. chore: Upgrade golang.org/x/crypto (opendatahub-io#36) 

    chore:	address the following CVE:
- [CVE-2023-48795](https://www.cve.org/CVERecord?id=CVE-2023-48795):
golang.org/x/crypto Authentication Bypass by Capture-replay

---------

Signed-off-by: Spolti <[email protected]>
    @spolti
    spolti committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    51ba6d1 View commit details
    Browse the repository at this point in the history

  9. Merge branch 'main' into sync 

    Signed-off-by: Filippe Spolti <[email protected]>
    @spolti
    spolti authored Jan 10, 2024
    Configuration menu
    Copy the full SHA
    6d147f8 View commit details
    Browse the repository at this point in the history