Chore: Update dompurify to fix CVE #614
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lucychen-grafana
changed the title
lucychen-grafana
requested review from
a team,
evictorero and
AgnesToulet
and removed request for
a team
evictorero
reviewed
Mar 19, 2025
Dockerfile
Outdated
| @@ -11,7 +11,7 @@ ENV XDG_CACHE_HOME=/tmp/.chromium | |||
| WORKDIR /usr/src/app | |||
|
|
|||
| RUN apk --no-cache upgrade && \ | |||
| apk add --no-cache udev ttf-opensans unifont chromium ca-certificates dumb-init && \ | |||
| apk add --no-cache udev ttf-opensans unifont chromium ca-certificates dumb-init libxslt libexpat libjxl && \ | |||
There was a problem hiding this comment.
These are dependencies included in chromium we shouldn't add them here explicitly. We install chromium as a dependency whenever we build this image so the vuln should be updated in the next release.
lucychen-grafana
changed the title
evictorero
approved these changes
Mar 19, 2025
Merged
lucychen-grafana
added a commit
that referenced
this pull request
Apr 18, 2025
* update cve * remove libraries chromium has
lucychen-grafana
added a commit
that referenced
this pull request
May 9, 2025
* Image Render: Support Tracing (#586) * Add tracing * changed url ingestion and tried to extract traceparent * removing unused code * remove unused packages and add logs * add tracing info to logs and tracing configuration * fix config override * fix argv.config * fix trace initialization and starting * remove custom log format * update json * change url to env * Apply suggestions from code review Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * fix yarn file * prettier lint * add custom trace for browser * propagate traces back to Grafana * Add tracing to plugin mode and improve config management (#602) * add tracing to plugin mode * update dev.json * update imports * add tracing in CSV endpoints * fix tests * fix and simplify config * fix test * update config for docker * add to readme * update readme * update readme * prettier * update tracing * change config and docs * Update src/plugin/v2/grpc_plugin.ts Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * create new docker-compose for tracing * add serviceName to config * update yarn * Apply suggestions from code review Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * remove env servicename --------- Co-authored-by: Ezequiel Victorero <ezequiel.victorero@grafana.com> Co-authored-by: AgnesToulet <35176601+AgnesToulet@users.noreply.github.com> * add CORS allow * propagate traceparent only if tracing is enabled * propagate traceparent only if tracing is enabled * Chore: Update dompurify to fix CVE (#614) * update cve * remove libraries chromium has * Chore: Downgrade to Node 20 (#619) * Release 3.12.4 (#620) * Bump axios from 1.7.4 to 1.8.2 (#610) Bumps [axios](https://github.com/axios/axios) from 1.7.4 to 1.8.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.4...v1.8.2) --- updated-dependencies: - dependency-name: axios dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Docker: Add chromium-swiftshader to support webGL (#623) * add swiftshader * add flag --------- Co-authored-by: Joshua Adkins <adkins@berkeley.edu> * Docker: Remove unused NPM files (#625) * Docker: Remove unused NPM files * cleanup * Docker: Fix typo in Debian Dockerfile (#624) * remove cors * yarn.lock * remove tracing headers for req to other hostnames * Reapply "Image Render: Support Tracing (#586)" (#609) This reverts commit 78f1d6e. * try catch block * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * swap order nest tracing in timinf * update yarn --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Ezequiel Victorero <ezequiel.victorero@grafana.com> Co-authored-by: AgnesToulet <35176601+AgnesToulet@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joshua Adkins <adkins@berkeley.edu> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CVE Dashboard
Bump dompurify 2.5.4 to 3.2.4 CVE-2025-26791
libxslt CVE-2025-24855 CVE-2024-55549, libexpat CVE-2024-8176, and libjxl CVE-2024-11403 will be updated in Chromium