Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency azure.identity to 1.11.4 [security] - autoclosed #2538

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 6, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
Azure.Identity (source) 1.11.3 -> 1.11.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-35255

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.


Release Notes

Azure/azure-sdk-for-net (Azure.Identity)

v1.11.4

Compare Source

1.11.4 (2024-06-10)

Bugs Fixed
  • Managed identity bug fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies All issues related to dependencies & Renovate label Aug 6, 2024
@renovate renovate bot requested a review from tomkerkhove as a code owner August 6, 2024 07:50
Copy link

github-actions bot commented Aug 6, 2024

Thank you for your contribution! 🙏 We will review it as soon as possible.

@hkfgo
Copy link
Collaborator

hkfgo commented Aug 7, 2024

Hey Tom, we are in need of a release to address some CVEs. A major release will be tough to get to, since I need some time to extensively test my batch scraping PR. Is there any chance you can cut a minor release?

@renovate renovate bot changed the title chore(deps): update dependency azure.identity to v1.11.4 [security] chore(deps): update dependency azure.identity to 1.11.4 [security] Aug 28, 2024
@renovate renovate bot force-pushed the renovate-nuget-azure.identity-vulnerability branch 2 times, most recently from d2af3a3 to d60727a Compare September 24, 2024 06:27
@hkfgo
Copy link
Collaborator

hkfgo commented Sep 26, 2024

I think this should be mergable once you get the resource discovery test fix from master. It'd be great if you can cut a minor release with this and the .NET version bump: #2517

My thought is to create two releases. A minor one with just the version bumps, and a major one with this batch scraping PR: #2459 afterwards. Just in case things go wrong on the later :)

@renovate renovate bot force-pushed the renovate-nuget-azure.identity-vulnerability branch 5 times, most recently from 69cc1b5 to 9fc010b Compare October 7, 2024 06:35
@tomkerkhove
Copy link
Owner

My thought is to create two releases. A minor one with just the version bumps, and a major one with this batch scraping PR: #2459 afterwards. Just in case things go wrong on the later :)

Given Batch is already merged, this is going to be more painful to do a patch so let's just roll forward in case of an issue.

@tomkerkhove
Copy link
Owner

/azp run Promitor CI - Scraper Agent

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@hkfgo
Copy link
Collaborator

hkfgo commented Oct 27, 2024

@tomkerkhove you need to re-run these pipelines a few more times if you want to have them all passing. We got throttled on Resource Discovery Agent, and Scraper Agent is failing due to flaky OTEL Collector tests. Let me know if you want help on this.

@tomkerkhove
Copy link
Owner

@hkfgo Sadly they have been failing more than passing (did not get it to pass after 3-4 runs even) since we added batch support.

Can you please have a look what is up?

@renovate renovate bot force-pushed the renovate-nuget-azure.identity-vulnerability branch from 9fc010b to 7671614 Compare October 27, 2024 07:06
@hkfgo
Copy link
Collaborator

hkfgo commented Oct 28, 2024

/azp run Promitor CI - Scraper Agent

Copy link

Commenter does not have sufficient privileges for PR 2538 in repo tomkerkhove/promitor

@hkfgo
Copy link
Collaborator

hkfgo commented Oct 28, 2024

Well, I've filed an issue here already: #2553. I think collector tests became flaky recently. Unlikely due to how tests themselves are written I'm guessing, but rather how the underlying test components are set up? It'd definitely save a lot of headache to get that resolved, but for now I think we just have to re-run CI multiple times.

I don't think I have the privilege to re-run CI here; I'm guessing CI on someone else's PR can only re-run by that person or the maintainer? I'll try to open a separate PR then

@hkfgo
Copy link
Collaborator

hkfgo commented Oct 28, 2024

I seemed to get a clean PR here but that's because the Azure Devops steps never actually ran :/ I tried troubleshooting for a few hrs but no luck, those pipelines never got triggered even though they should based on config. (sorry about all those junk PRs for testing btw). I think there are a few options we can take right now:

  1. Hand me the privilege to re-run pipeline steps, if you don't mind.
  2. Alternatively, re-run the pipelines yourself; it'll take a few tries but they'll turn green I believe.
  3. Merge the code with that one broken CI step. Yuck I know but the flakiness should be fixable in the future.
Screenshot 2024-10-28 at 12 34 19 AM

Let me know what you think? Thanks!

@renovate renovate bot changed the title chore(deps): update dependency azure.identity to 1.11.4 [security] chore(deps): update dependency azure.identity to 1.11.4 [security] - autoclosed Oct 28, 2024
@renovate renovate bot closed this Oct 28, 2024
@renovate renovate bot deleted the renovate-nuget-azure.identity-vulnerability branch October 28, 2024 09:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies All issues related to dependencies & Renovate
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants