dependabot-preview[bot]
commented
3 years ago We've just been alerted that this update fixes a security vulnerability:
Sourced from The GitHub Security Advisory Database.
Cross-site scripting in Apache airflow
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.14. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Affected versions: ["< 1.10.15"]
Bumps apache-airflow from 1.10.14 to 2.0.2.
Release notes
Sourced from apache-airflow's releases.
... (truncated)
Changelog
Sourced from apache-airflow's changelog.
... (truncated)
Commits
10023fdUpdate version in docs/start/docker*e494306Update version to 2.0.262b5835Add changelog for what will become 2.0.2 (#15380)a46e809Fixes pushing constraints (#15243)3369e2fDo not remove 'full-tests-needed' when approval missing (#15175)3e3e450Don't try to push the python build image when building on release branches (#...0e0dc73Bugfix:TypeErrorwhen Serializing & sorting iterables (#15395)2221e71Avoids error on pushing PROD image as cache (#15321)39593f9Fix "leaking" log driver in tests1366d65Remove unused JS packages (#15383)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)