[EAUX-1241] Kong Pongo Update #12
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
(cherry picked from commit 0946396)
(cherry picked from commit 951a202)
(cherry picked from commit 84483ed)
(cherry picked from commit 00ef1fb)
(cherry picked from commit ce1d655)
(cherry picked from commit 6e83979)
(cherry picked from commit 1cec92d)
(cherry picked from commit 5df4121)
(cherry picked from commit d0b53c7)
(cherry picked from commit 3e22953)
(cherry picked from commit 9ffccbd)
(cherry picked from commit 09349cb)
(cherry picked from commit c303e2c)
(cherry picked from commit 627c91d)
(cherry picked from commit 14faa2a)
(cherry picked from commit e5b9732)
(cherry picked from commit 27d70dd)
(cherry picked from commit 33a50aa)
(cherry picked from commit 0e7bc94)
(cherry picked from commit f817310)
(cherry picked from commit cafc73c)
(cherry picked from commit 773ca69)
(cherry picked from commit 63ba8a6)
(cherry picked from commit 0697a37)
(cherry picked from commit 7ff9b38)
(cherry picked from commit db730e2)
(cherry picked from commit d33f43e)
(cherry picked from commit c7658bd)
Speeds up build and reduces image size. (cherry picked from commit 8409030)
Speeds up build and reduces image size. (cherry picked from commit b2380fc)
(cherry picked from commit e1a57c7)
(cherry picked from commit 07e16a4)
(cherry picked from commit ec49714)
(cherry picked from commit 6c90361)
(cherry picked from commit e2f312e)
(cherry picked from commit 5d658c5)
(cherry picked from commit af563c4)
(cherry picked from commit 779b50a)
… for busted tests KAG-5187 (cherry picked from commit 63fb02b)
(cherry picked from commit 4040563)
(cherry picked from commit ccb677a)
(cherry picked from commit 65b8de0)
(cherry picked from commit 77c4125)
eg. using 3.4.x.x would resolve to 3.4.3.2 instead of 3.4.3.12 due to the double digit patch version. (cherry picked from commit 7c5916a)
(cherry picked from commit d769c74)
(cherry picked from commit b10fea7)
(cherry picked from commit d9f36cd)
… for busted tests KAG-5187 (cherry picked from commit 893a851)
(cherry picked from commit 6ce752c)
(cherry picked from commit fb9d5b8)
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
Comment on lines
+46
to
47
| image: ${POSTGRES_IMAGE:-postgres:13} | ||
| environment: |
There was a problem hiding this comment.
Use of non-harbor in base image is not allowed
🔴 Fix or ignore this finding to merge your pull request.
Ignore this finding from custom-docker-base-image-check-docker-compose.
|
Semgrep found 63
Risk: Affected versions of google.golang.org/grpc are vulnerable to Uncontrolled Resource Consumption. An attacker can force the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit by executing a combination of sending, canceling, and re-sending HTTP/2 requests. Fix: Upgrade this library to at least version 1.56.3 at kong-pongo/kong-versions/3.6.1.6/kong/spec/fixtures/grpc/target/go.mod:8. Reference(s): GHSA-m425-mq94-257g, CVE-2023-44487 ⚪️ This finding does not block your pull request. Semgrep found 6
Risk: Affected version of get-func-name is vulnerable to Uncontrolled Resource Consumption / Inefficient Regular Expression Complexity. The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. Fix: Upgrade this library to at least version 2.0.1 at kong-pongo/kong-versions/3.3.1.1/kong/spec-ee/kong-api-tests/package-lock.json:4566. Reference(s): GHSA-4q6p-r6v2-jvc5, CVE-2023-43646 ⚪️ This finding does not block your pull request. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added Support for Kong Pongo Update