search

e-mission / em-public-dashboard

A simple and stupid public dashboard prototype.
BSD 3-Clause "New" or "Revised" License
1 stars 23 forks source link

Latest vulnerability fixes #127

Closed MukuFlash03 closed 5 months ago

MukuFlash03 commented 5 months ago

Summary

  1. Frontend dashboard container
    • 1 CRITICAL - ip

Details about how this was handled present in this PR for join repo.

  1. Notebook viz_scripts container
    • 5 HIGH level : 4 (cryptography, libgnutls(2), bash) + 1 (pillow)

Details about how the first four vulnerabilties are handled present in this PR for e-mission-server repo.

Pillow fixed by updating package version manually in viz_scripts/docker/environment36.dashboard.additions.yml.

shankari commented 5 months ago

This needs to be updated to be consistent with https://github.com/e-mission/nrel-openpath-join-page/pull/30 Also, the server changes don't (yet) get propagated to the dashboard PRs - you will need to bump up the base server image tag after it is built.

shankari commented 5 months ago

@Abby-Wheelis for visibility into DevOps changes

MukuFlash03 commented 5 months ago

Addressed review comments for related Node image used in join repo here.

Added a commit to update Docker image tag to build from latest server image.

shankari commented 5 months ago

@MukuFlash03 there are now whitespace changes in viz_scripts/docker/environment36.dashboard.additions.yml Can you make sure to revert the file properly to avoid messing up the commit history?

MukuFlash03 commented 5 months ago

@MukuFlash03 there are now whitespace changes in viz_scripts/docker/environment36.dashboard.additions.yml Can you make sure to revert the file properly to avoid messing up the commit history?

Changes reverted correctly. For some reason, whitespaces get added when one directly copies contents of a file and git marks them as changes.

To avoid this, fixed correctly by restoring the version of the file to its version before commit that changed it using a git command. Refer to this stackoverflow post for more details.

shankari commented 5 months ago

@MukuFlash03 @nataliejschultz I am squash-merging the changes to avoid commit churn. Please take into account when pulling.