search

uc-cdis / peregrine

GraphQL search API service
Apache License 2.0
11 stars 9 forks source link

chore(deps): [security] bump jinja2 from 2.7.3 to 2.10.1 #150

Closed dependabot-preview[bot] closed 4 years ago

dependabot-preview[bot] commented 4 years ago

Bumps jinja2 from 2.7.3 to 2.10.1. This update includes a security fix.

Vulnerabilities fixed *Sourced from The GitHub Security Advisory Database.* > **High severity vulnerability that affects Jinja2 and jinja2** > In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. > > Affected versions: < 2.10.1
Release notes *Sourced from [jinja2's releases](https://github.com/pallets/jinja/releases).* > ## 2.10.1 > * Changes: https://github.com/pallets/jinja/blob/master/CHANGES.rst#version-2101 > * Blog: https://palletsprojects.com/blog/jinja-2-10-1-released/ > * Twitter: https://twitter.com/PalletsTeam/status/1114605127308992513 > > ## 2.10 > ## Primary changes > > - A `NativeEnvironment` that renders Python types instead of strings. > http://jinja.pocoo.org/docs/2.10/nativetypes/ > - A `namespace` object that works with `{% set %}`. This replaces > previous hacks for storing state across iterations or scopes. > http://jinja.pocoo.org/docs/2.10/templates/#assignments > - The `loop` object now has `nextitem` and `previtem` attributes, as > well as a `changed` method, for the common case of outputting > something as a value in the loop changes. More complicated cases can > use the `namespace` object. > http://jinja.pocoo.org/docs/2.10/templates/#for > > ## Install or upgrade > > Install from [PyPI](https://pypi.python.org/pypi/Jinja2/2.10) with pip: > > ``` > pip install -U Jinja2 > ``` > > ## Changelog > > - Added a new extension node called `OverlayScope` which can be used to create an unoptimized scope that will look up all variables from a derived context. > - Added an `in` test that works like the in operator. This can be used in combination with `reject` and `select`. > - Added `previtem` and `nextitem` to loop contexts, providing access to the previous/next item in the loop. If such an item does not exist, the value is undefined. > - Added ``changed(*values)`` to loop contexts, providing an easy way of checking whether a value has changed since the last iteration (or rather since the last call of the method) > - Added a `namespace` function that creates a special object which allows attribute assignment using the `set` tag. This can be used to carry data across scopes, e.g. from a loop body to code that comes after the loop. > - Added a `trimmed` modifier to ``{% trans %}`` to strip linebreaks and surrounding whitespace. Also added a new policy to enable this for all `trans` blocks. > - The `random` filter is no longer incorrectly constant folded and will produce a new random choice each time the template is rendered. ([#478](https://github-redirect.dependabot.com/pallets/jinja/issues/478)) > - Added a `unique` filter. ([#469](https://github-redirect.dependabot.com/pallets/jinja/issues/469)) > - Added `min` and `max` filters. ([#475](https://github-redirect.dependabot.com/pallets/jinja/issues/475)) > - Added tests for all comparison operators: `eq`, `ne`, `lt`, `le`, `gt`, `ge`. ([#665](https://github-redirect.dependabot.com/pallets/jinja/issues/665)) > - `import` statement cannot end with a trailing comma. ([#617](https://github-redirect.dependabot.com/pallets/jinja/issues/617), [#618](https://github-redirect.dependabot.com/pallets/jinja/issues/618)) > - `indent` filter will not indent blank lines by default. ([#685](https://github-redirect.dependabot.com/pallets/jinja/issues/685)) > - Add `reverse` argument for `dictsort` filter. ([#692](https://github-redirect.dependabot.com/pallets/jinja/issues/692)) > - Add a `NativeEnvironment` that renders templates to native Python types instead of strings. ([#708](https://github-redirect.dependabot.com/pallets/jinja/issues/708)) > - Added filter support to the block `set` tag. ([#489](https://github-redirect.dependabot.com/pallets/jinja/issues/489)) > - `tojson` filter marks output as safe to match documented behavior. ([#718](https://github-redirect.dependabot.com/pallets/jinja/issues/718)) > - Resolved a bug where getting debug locals for tracebacks could modify template context. > - Fixed a bug where having many ``{% elif ... %}`` blocks resulted in a "too many levels of indentation" error. These blocks now compile to native ``elif ..:`` instead of ``else: if ..:`` ([#759](https://github-redirect.dependabot.com/pallets/jinja/issues/759))
Changelog *Sourced from [jinja2's changelog](https://github.com/pallets/jinja/blob/master/CHANGES.rst).* > Version 2.10.1 > ============== > > Released 2019-04-06 > > - `SandboxedEnvironment` securely handles `str.format_map` in order to prevent code execution through untrusted format strings. The sandbox already handled `str.format`. > > Version 2.10 > ============ > > Released 2017-11-08 > > - Added a new extension node called `OverlayScope` which can be used to create an unoptimized scope that will look up all variables from a derived context. > - Added an `in` test that works like the in operator. This can be used in combination with `reject` and `select`. > - Added `previtem` and `nextitem` to loop contexts, providing access to the previous/next item in the loop. If such an item does not exist, the value is undefined. > - Added `changed(*values)` to loop contexts, providing an easy way of checking whether a value has changed since the last iteration (or rather since the last call of the method) > - Added a `namespace` function that creates a special object which allows attribute assignment using the `set` tag. This can be used to carry data across scopes, e.g. from a loop body to code that comes after the loop. > - Added a `trimmed` modifier to `{% trans %}` to strip linebreaks and surrounding whitespace. Also added a new policy to enable this for all `trans` blocks. > - The `random` filter is no longer incorrectly constant folded and will produce a new random choice each time the template is rendered. 478 > - Added a `unique` filter. 469 > - Added `min` and `max` filters. 475 > - Added tests for all comparison operators: `eq`, `ne`, `lt`, `le`, `gt`, `ge`. 665 > - `import` statement cannot end with a trailing comma. 617, 618 > - `indent` filter will not indent blank lines by default. 685 > - Add `reverse` argument for `dictsort` filter. 692 > - Add a `NativeEnvironment` that renders templates to native Python types instead of strings. 708 > - Added filter support to the block `set` tag. 489 > - `tojson` filter marks output as safe to match documented behavior. 718 > - Resolved a bug where getting debug locals for tracebacks could modify template context. > - Fixed a bug where having many `{% elif ... %}` blocks resulted in a "too many levels of indentation" error. These blocks now compile to native `elif ..:` instead of `else: if ..:` 759 > > Version 2.9.6 > ============= > > Released 2017-04-03 > > - Fixed custom context behavior in fast resolve mode 675 > > Version 2.9.5 > ============= > > Released 2017-01-28 > > - Restored the original repr of the internal `_GroupTuple` because this caused issues with ansible and it was an unintended change. 654 > - Added back support for custom contexts that override the old `resolve` method since it was hard for people to spot that this could cause a regression. > - Correctly use the buffer for the else block of for loops. This caused invalid syntax errors to be caused on 2.x and completely wrong behavior on Python 3 669 > - Resolve an issue where the `{% extends %}` tag could not be used with async environments. 668 > - Reduce memory footprint slightly by reducing our unicode database dump we use for identifier matching on Python 3 666 > - Fixed autoescaping not working for macros in async compilation mode. 671 > > ... (truncated)
Commits - [`c4c4088`](https://github.com/pallets/jinja/commit/c4c4088945a2c12535f539be7f5453b9ca94666c) release 2.10.1 - [`a2a6c93`](https://github.com/pallets/jinja/commit/a2a6c930bcca591a25d2b316fcfd2d6793897b26) sandbox str.format_map - [`78d2f67`](https://github.com/pallets/jinja/commit/78d2f672149e5b9b7d539c575d2c1bfc12db67a9) Bump version number to 2.10 - [`d9d3fc3`](https://github.com/pallets/jinja/commit/d9d3fc32f0b7584af5c371639bc7882449bb6f6d) clean up MANIFEST.in - [`072cdf9`](https://github.com/pallets/jinja/commit/072cdf97fa2899efe1d12715edf19706b6425fb5) Support filters in set block - [`d17c7db`](https://github.com/pallets/jinja/commit/d17c7dbbf003c2561d2599383a77027089fe15fb) Merge pull request [#708](https://github-redirect.dependabot.com/pallets/jinja/issues/708) from jctanner/NATIVE_TYPES - [`6a7a263`](https://github.com/pallets/jinja/commit/6a7a263bc0ff6ea68ff3651d166f4077ed03c3c8) Merge branch 'master' into NATIVE_TYPES - [`31f92b5`](https://github.com/pallets/jinja/commit/31f92b5947e9dba8ba997dd93921cbf1538bb79f) Fix typo in docstring ([#779](https://github-redirect.dependabot.com/pallets/jinja/issues/779)) - [`c314761`](https://github.com/pallets/jinja/commit/c3147611ec6bbfd8b6e42637c73a68e29de1e2e7) codecov needs argparse on 2.6 - [`4750cf7`](https://github.com/pallets/jinja/commit/4750cf7c69c0ce2a0c44cc68c2fc06b984774e5e) Minor docstring grammar fix ([#772](https://github-redirect.dependabot.com/pallets/jinja/issues/772)) - Additional commits viewable in [compare view](https://github.com/pallets/jinja/compare/2.7.3...2.10.1)


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in the `.dependabot/config.yml` file in this repo: - Update frequency - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)
dependabot-preview[bot] commented 4 years ago

The following labels could not be found: dependencies.

PlanXCyborg commented 4 years ago

Jenkins Build 1 : time taken 1 hr 21 min Check the https://jenkins.planx-pla.net/job/Performance%20tests%20for%20uc-cdis/job/peregrine/job/PR-150/1/display/redirect

Test results: Passed: 109, Failed: 0, Skipped: 0

Test Time (PR) Time (master) Diff
@ExportPerformanceTests @Performance: Export all nodes of type: aliquot 0.425 0.245 0.18
@ExportPerformanceTests @Performance: Export all nodes of type: case 0.204 0.232 -0.03
@ExportPerformanceTests @Performance: Export all nodes of type: experiment 0.251 0.45 -0.20
@ExportPerformanceTests @Performance: Export all nodes of type: program 0.039 0.051 -0.01
@ExportPerformanceTests @Performance: Export all nodes of type: project 0.128 0.042 0.09
@ExportPerformanceTests @Performance: Export all nodes of type: read_group 0.408 0.524 -0.12
@ExportPerformanceTests @Performance: Export all nodes of type: read_group_qc 0.255 0.105 0.15
@ExportPerformanceTests @Performance: Export all nodes of type: sample 0.42 0.459 -0.04
@ExportPerformanceTests @Performance: Exporting a record by ID on nodes of type: case 0.485 0.665 -0.18
@ExportPerformanceTests @Performance: Exporting a record by ID on nodes of type: experiment 0.199 0.253 -0.05
@ExportPerformanceTests @Performance: Exporting a record by ID on nodes of type: read_group 0.175 0.068 0.11
@ExportPerformanceTests @Performance: Exporting a record by ID on nodes of type: sample 0.201 0.096 0.11
@QueryPerformanceTests @Performance: Executing bottomUp query # 1 0.589 0.642 -0.05
@QueryPerformanceTests @Performance: Executing bottomUp query # 2 0.534 0.578 -0.04
@QueryPerformanceTests @Performance: Executing bottomUp query # 3 0.465 0.504 -0.04
@QueryPerformanceTests @Performance: Executing bottomUp query # 4 0.449 0.344 0.10
@QueryPerformanceTests @Performance: Executing bottomUp query # 6 0.176 0.195 -0.02
@QueryPerformanceTests @Performance: Executing bottomUp query # 7 0.172 0.128 0.04
@QueryPerformanceTests @Performance: Executing topDown query # 0 0.1 0.145 -0.04
@QueryPerformanceTests @Performance: Executing topDown query # 3 0.205 0.268 -0.06
@QueryPerformanceTests @Performance: Executing topDown query # 4 0.382 0.27 0.11
@QueryPerformanceTests @Performance: Executing topDown query # 5 0.551 0.367 0.18
@QueryPerformanceTests @Performance: Executing topDown query # 6 0.65 0.472 0.18
@QueryPerformanceTests @Performance: Executing topDown query # 7 0.634 0.473 0.16
@SubmissionPerformanceTests @Performance: Submission acknowledgement 10 0.35 0.632 -0.28
@SubmissionPerformanceTests @Performance: Submission acknowledgement 100 2.897 3.153 -0.26
@SubmissionPerformanceTests @Performance: Submission acknowledgement 1000 24.279 31.701 -7.42
@SubmissionPerformanceTests @Performance: Submission aligned_reads_index 10 2.008 2.328 -0.32
@SubmissionPerformanceTests @Performance: Submission aliquot 10 0.39 0.536 -0.15
@SubmissionPerformanceTests @Performance: Submission aliquot 100 3.255 3.519 -0.26
@SubmissionPerformanceTests @Performance: Submission aliquot 1000 28.65 34.246 -5.60
@SubmissionPerformanceTests @Performance: Submission case 10 0.455 0.512 -0.06
@SubmissionPerformanceTests @Performance: Submission case 100 2.516 3.605 -1.09
@SubmissionPerformanceTests @Performance: Submission case 1000 25.555 34.49 -8.94
@SubmissionPerformanceTests @Performance: Submission clinical_test 10 0.456 0.624 -0.17
@SubmissionPerformanceTests @Performance: Submission clinical_test 100 3.038 3.993 -0.95
@SubmissionPerformanceTests @Performance: Submission clinical_test 1000 27.956 35.01 -7.05
@SubmissionPerformanceTests @Performance: Submission core_metadata_collection 10 1.005 0.722 0.28
@SubmissionPerformanceTests @Performance: Submission core_metadata_collection 100 2.81 3.415 -0.61
@SubmissionPerformanceTests @Performance: Submission core_metadata_collection 1000 26.367 33.904 -7.54
@SubmissionPerformanceTests @Performance: Submission demographic 100 2.845 3.785 -0.94
@SubmissionPerformanceTests @Performance: Submission demographic 1000 27.055 35.145 -8.09
@SubmissionPerformanceTests @Performance: Submission diagnosis 10 0.485 0.576 -0.09
@SubmissionPerformanceTests @Performance: Submission diagnosis 100 3.652 4.142 -0.49
@SubmissionPerformanceTests @Performance: Submission diagnosis 1000 32.529 39.099 -6.57
@SubmissionPerformanceTests @Performance: Submission experiment 100 2.882 3.46 -0.58
@SubmissionPerformanceTests @Performance: Submission experiment 1000 25.899 36.021 -10.12
@SubmissionPerformanceTests @Performance: Submission experimental_metadata 100 19.458 20.601 -1.14
@SubmissionPerformanceTests @Performance: Submission exposure 10 0.54 0.494 0.05
@SubmissionPerformanceTests @Performance: Submission exposure 100 2.638 4.281 -1.64
@SubmissionPerformanceTests @Performance: Submission exposure 1000 27.107 34.259 -7.15
@SubmissionPerformanceTests @Performance: Submission family_history 10 0.539 0.601 -0.06
@SubmissionPerformanceTests @Performance: Submission family_history 100 2.588 6.069 -3.48
@SubmissionPerformanceTests @Performance: Submission family_history 1000 26.645 32.981 -6.34
@SubmissionPerformanceTests @Performance: Submission keyword 10 0.346 0.484 -0.14
@SubmissionPerformanceTests @Performance: Submission keyword 100 2.907 3.94 -1.03
@SubmissionPerformanceTests @Performance: Submission keyword 1000 25.199 32.74 -7.54
@SubmissionPerformanceTests @Performance: Submission publication 10 0.398 0.689 -0.29
@SubmissionPerformanceTests @Performance: Submission publication 100 2.569 3.494 -0.92
@SubmissionPerformanceTests @Performance: Submission publication 1000 25.056 33.538 -8.48
@SubmissionPerformanceTests @Performance: Submission read_group 10 0.464 0.682 -0.22
@SubmissionPerformanceTests @Performance: Submission read_group 1000 29.256 36.152 -6.90
@SubmissionPerformanceTests @Performance: Submission read_group_qc 10 0.493 0.694 -0.20
@SubmissionPerformanceTests @Performance: Submission read_group_qc 100 4.316 5.54 -1.22
@SubmissionPerformanceTests @Performance: Submission read_group_qc 1000 29.742 37.147 -7.40
@SubmissionPerformanceTests @Performance: Submission sample 10 0.461 0.501 -0.04
@SubmissionPerformanceTests @Performance: Submission sample 100 2.8 3.809 -1.01
@SubmissionPerformanceTests @Performance: Submission sample 1000 29.265 36.202 -6.94
@SubmissionPerformanceTests @Performance: Submission slide 10 0.486 0.544 -0.06
@SubmissionPerformanceTests @Performance: Submission slide 100 3.043 3.419 -0.38
@SubmissionPerformanceTests @Performance: Submission slide 1000 30.981 35.347 -4.37
@SubmissionPerformanceTests @Performance: Submission slide_count 10 0.605 0.462 0.14
@SubmissionPerformanceTests @Performance: Submission slide_count 100 2.844 3.722 -0.88
@SubmissionPerformanceTests @Performance: Submission slide_count 1000 27.57 34.388 -6.82
@SubmissionPerformanceTests @Performance: Submission slide_image 10 1.993 2.171 -0.18
@SubmissionPerformanceTests @Performance: Submission slide_image 100 19.844 22.494 -2.65
@SubmissionPerformanceTests @Performance: Submission submitted_copy_number 100 18.496 20.35 -1.85
@SubmissionPerformanceTests @Performance: Submission submitted_somatic_mutation 10 2.056 2.294 -0.24
@SubmissionPerformanceTests @Performance: Submission submitted_somatic_mutation 100 19.121 20.341 -1.22
@SubmissionPerformanceTests @Performance: Submission submitted_unaligned_reads 10 1.97 2.131 -0.16
@SubmissionPerformanceTests @Performance: Submission submitted_unaligned_reads 100 19.384 20.639 -1.25
@SubmissionPerformanceTests @Performance: Submission treatment 10 0.436 0.472 -0.04
@SubmissionPerformanceTests @Performance: Submission treatment 100 3.301 3.506 -0.20
@SubmissionPerformanceTests @Performance: Submission treatment 1000 26.44 36.2 -9.76
dependabot-preview[bot] commented 4 years ago

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.