chore: bump vm2 due to CVE #15268
Merged
chore: bump vm2 due to CVE #15268
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hey @fuziontech! 👋 |
mariusandra
approved these changes
Apr 26, 2023
fuziontech
added a commit
that referenced
this pull request
Apr 27, 2023
* master: (37 commits) fix: fix sprint planning issue template (#15271) fix: player skip buttons only ever showed right (#15269) chore: bump vm2 due to CVE (#15268) fix(person-query): don't query persons twice if we don't need to (#15265) fix(ch): stop running delete jobs while clickhouse is on an older version (#15239) chore(recordings): use cooperative-sticky rebalance strategy (#15260) fix: SESSION_RECORDING_BLOB_PROCESSING_TEAMS config handling (#15247) fix(flags): Some UX inconsistencies (#15255) fix: Recording share button (#15256) chore(deps): Update posthog-js to 1.54.0 (#15257) style(3000): Support keyboard navigation in sidebar (#15237) feat: Add support for opening bug report via URL (#15251) feat: Hedgebar (#14934) Fixed undefined default for window select (#15249) fix(data-exploration): prevent leave confirmation safeguard (#15250) chore: remove readonly setting defaults for hogql (#15246) feat(hogql): refactor macros and asterisks into "resolver" (#15175) feat(hogql): swap out toDateTime function (#15226) fix(insight-timeout-state): centralize query ID (#15240) Fix/forgot ingestion fixes (#15238) ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
CVE affecting VM2 version we are using
https://nvd.nist.gov/vuln/detail/CVE-2023-29017
Changes
Bump to version 3.9.17 which has mitigated CVE
This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
👉 Stay up-to-date with PostHog coding conventions for a smoother review.
How did you test this code?