From 549c422fc7b31a626b0637bf45950644793d8a6c Mon Sep 17 00:00:00 2001 From: mauricio-dc-chainguard Date: Wed, 24 Apr 2024 11:14:48 -0600 Subject: [PATCH] fix CVEs kubeflow-pipelines Signed-off-by: mauricio-dc-chainguard --- kubeflow-pipelines.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kubeflow-pipelines.yaml b/kubeflow-pipelines.yaml index 6b2d005835..dacef8cce5 100644 --- a/kubeflow-pipelines.yaml +++ b/kubeflow-pipelines.yaml @@ -46,6 +46,10 @@ pipeline: repository: https://github.com/kubeflow/pipelines tag: ${{package.version}} expected-commit: f328f0b588c35cdf1e5b31638fbe3596b2f38413 + + #Fix idna CVE + - runs: | + sed -i 's/idna==3\.4/idna==3.7/g' backend/requirements.txt - uses: go/bump with: @@ -83,7 +87,7 @@ subpackages: pipeline: - uses: go/bump with: - deps: golang.org/x/net@v0.17.0 golang.org/x/crypto@v0.17.0 + deps: golang.org/x/net@v0.23.0 golang.org/x/crypto@v0.21.0 k8s.io/kubernetes@v1.27.13 modroot: . - runs: | cd backend