Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SDL security fixes #32

Merged
merged 7 commits into from
Jun 17, 2024
Merged

SDL security fixes #32

merged 7 commits into from
Jun 17, 2024

Conversation

Maxim-Doronin
Copy link
Contributor

Summary

Incorporation of
#30
#29
#28
#27
#26
#25
#24

JIRA ticket

  • SDL report

Related PR in NPU Compiler and/or OpenVINO repository with sub-module update

  • PR-xxx

Other related tickets

List tickets for additional work, eg, something was found during review but you agreed to address it in another Jira

  • E-xxxxx

dependabot bot added 7 commits June 14, 2024 16:14
@dependabot @Maxim-Doronin
Bump the llvm-docs-requirements group in /llvm/docs with 23 updates
e9a20fe 
Bumps the llvm-docs-requirements group in /llvm/docs with 23 updates:

| Package | From | To |
| --- | --- | --- |
| [alabaster](https://github.com/sphinx-doc/alabaster) | `0.7.13` | `0.7.16` |
| [babel](https://github.com/python-babel/babel) | `2.14.0` | `2.15.0` |
| [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) | `4.12.2` | `4.12.3` |
| [certifi](https://github.com/certifi/python-certifi) | `2023.11.17` | `2024.6.2` |
| [docutils](https://docutils.sourceforge.io) | `0.20.1` | `0.21.2` |
| [furo](https://github.com/pradyunsg/furo) | `2023.8.19` | `2024.5.6` |
| [idna](https://github.com/kjd/idna) | `3.6` | `3.7` |
| [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.4` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.5.1` | `3.6` |
| [markupsafe](https://github.com/pallets/markupsafe) | `2.1.3` | `2.1.5` |
| [mdit-py-plugins](https://github.com/executablebooks/mdit-py-plugins) | `0.4.0` | `0.4.1` |
| [myst-parser](https://github.com/executablebooks/MyST-Parser) | `2.0.0` | `3.0.1` |
| [packaging](https://github.com/pypa/packaging) | `23.2` | `24.0` |
| [pygments](https://github.com/pygments/pygments) | `2.17.2` | `2.18.0` |
| [requests](https://github.com/psf/requests) | `2.31.0` | `2.32.3` |
| [sphinx](https://github.com/sphinx-doc/sphinx) | `7.1.2` | `7.3.7` |
| [sphinx-automodapi](https://github.com/astropy/sphinx-automodapi) | `0.16.0` | `0.17.0` |
| [sphinxcontrib-applehelp](https://github.com/sphinx-doc/sphinxcontrib-applehelp) | `1.0.4` | `1.0.8` |
| [sphinxcontrib-devhelp](https://github.com/sphinx-doc/sphinxcontrib-devhelp) | `1.0.5` | `1.0.6` |
| [sphinxcontrib-htmlhelp](https://github.com/sphinx-doc/sphinxcontrib-htmlhelp) | `2.0.4` | `2.0.5` |
| [sphinxcontrib-qthelp](https://github.com/sphinx-doc/sphinxcontrib-qthelp) | `1.0.6` | `1.0.7` |
| [sphinxcontrib-serializinghtml](https://github.com/sphinx-doc/sphinxcontrib-serializinghtml) | `1.1.9` | `1.1.10` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.1.0` | `2.2.1` |


Updates `alabaster` from 0.7.13 to 0.7.16
- [Release notes](https://github.com/sphinx-doc/alabaster/releases)
- [Changelog](https://github.com/sphinx-doc/alabaster/blob/master/docs/changelog.rst)
- [Commits](sphinx-doc/alabaster@0.7.13...0.7.16)

Updates `babel` from 2.14.0 to 2.15.0
- [Release notes](https://github.com/python-babel/babel/releases)
- [Changelog](https://github.com/python-babel/babel/blob/master/CHANGES.rst)
- [Commits](python-babel/babel@v2.14.0...v2.15.0)

Updates `beautifulsoup4` from 4.12.2 to 4.12.3

Updates `certifi` from 2023.11.17 to 2024.6.2
- [Commits](certifi/python-certifi@2023.11.17...2024.06.02)

Updates `docutils` from 0.20.1 to 0.21.2

Updates `furo` from 2023.8.19 to 2024.5.6
- [Release notes](https://github.com/pradyunsg/furo/releases)
- [Changelog](https://github.com/pradyunsg/furo/blob/main/docs/changelog.md)
- [Commits](pradyunsg/furo@2023.08.19...2024.05.06)

Updates `idna` from 3.6 to 3.7
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst)
- [Commits](kjd/idna@v3.6...v3.7)

Updates `jinja2` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@3.1.2...3.1.4)

Updates `markdown` from 3.5.1 to 3.6
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.5.1...3.6)

Updates `markupsafe` from 2.1.3 to 2.1.5
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@2.1.3...2.1.5)

Updates `mdit-py-plugins` from 0.4.0 to 0.4.1
- [Release notes](https://github.com/executablebooks/mdit-py-plugins/releases)
- [Changelog](https://github.com/executablebooks/mdit-py-plugins/blob/master/CHANGELOG.md)
- [Commits](executablebooks/mdit-py-plugins@v0.4.0...v0.4.1)

Updates `myst-parser` from 2.0.0 to 3.0.1
- [Release notes](https://github.com/executablebooks/MyST-Parser/releases)
- [Changelog](https://github.com/executablebooks/MyST-Parser/blob/master/CHANGELOG.md)
- [Commits](executablebooks/MyST-Parser@v2.0.0...v3.0.1)

Updates `packaging` from 23.2 to 24.0
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@23.2...24.0)

Updates `pygments` from 2.17.2 to 2.18.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.17.2...2.18.0)

Updates `requests` from 2.31.0 to 2.32.3
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.31.0...v2.32.3)

Updates `sphinx` from 7.1.2 to 7.3.7
- [Release notes](https://github.com/sphinx-doc/sphinx/releases)
- [Changelog](https://github.com/sphinx-doc/sphinx/blob/master/CHANGES.rst)
- [Commits](sphinx-doc/sphinx@v7.1.2...v7.3.7)

Updates `sphinx-automodapi` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/astropy/sphinx-automodapi/releases)
- [Changelog](https://github.com/astropy/sphinx-automodapi/blob/main/CHANGES.rst)
- [Commits](astropy/sphinx-automodapi@v0.16.0...v0.17.0)

Updates `sphinxcontrib-applehelp` from 1.0.4 to 1.0.8
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-applehelp/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-applehelp/blob/master/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-applehelp@1.0.4...1.0.8)

Updates `sphinxcontrib-devhelp` from 1.0.5 to 1.0.6
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-devhelp/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-devhelp/blob/1.0.6/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-devhelp@1.0.5...1.0.6)

Updates `sphinxcontrib-htmlhelp` from 2.0.4 to 2.0.5
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-htmlhelp/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-htmlhelp/blob/2.0.5/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-htmlhelp@2.0.4...2.0.5)

Updates `sphinxcontrib-qthelp` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-qthelp/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-qthelp/blob/1.0.7/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-qthelp@1.0.6...1.0.7)

Updates `sphinxcontrib-serializinghtml` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-serializinghtml/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-serializinghtml/blob/master/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-serializinghtml@1.1.9...1.1.10)

Updates `urllib3` from 2.1.0 to 2.2.1
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.1.0...2.2.1)

---
updated-dependencies:
- dependency-name: alabaster
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: babel
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: beautifulsoup4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: certifi
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: llvm-docs-requirements
- dependency-name: docutils
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: furo
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: llvm-docs-requirements
- dependency-name: idna
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: jinja2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: markdown
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: markupsafe
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: mdit-py-plugins
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: myst-parser
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: llvm-docs-requirements
- dependency-name: packaging
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: llvm-docs-requirements
- dependency-name: pygments
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: requests
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: sphinx
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: sphinx-automodapi
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
- dependency-name: sphinxcontrib-applehelp
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: sphinxcontrib-devhelp
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: sphinxcontrib-htmlhelp
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: sphinxcontrib-qthelp
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: sphinxcontrib-serializinghtml
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: llvm-docs-requirements
- dependency-name: urllib3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: llvm-docs-requirements
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @Maxim-Doronin
Bump the github-actions group with 8 updates
01852cf 
Bumps the github-actions group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `39` | `44` |
| [actions/setup-python](https://github.com/actions/setup-python) | `4` | `5` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `3` | `4` |
| [actions/setup-node](https://github.com/actions/setup-node) | `3` | `4` |
| [actions/github-script](https://github.com/actions/github-script) | `6` | `7` |
| [actions/labeler](https://github.com/actions/labeler) | `4` | `5` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.1.2` | `2.3.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `2.2.4` | `3.25.8` |


Updates `tj-actions/changed-files` from 39 to 44
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](tj-actions/changed-files@v39...v44)

Updates `actions/setup-python` from 4 to 5
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v4...v5)

Updates `actions/download-artifact` from 3 to 4
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v3...v4)

Updates `actions/setup-node` from 3 to 4
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v3...v4)

Updates `actions/github-script` from 6 to 7
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v6...v7)

Updates `actions/labeler` from 4 to 5
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@v4...v5)

Updates `ossf/scorecard-action` from 2.1.2 to 2.3.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@e38b190...dc50aa9)

Updates `github/codeql-action` from 2.2.4 to 3.25.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@17573ee...2e230e8)

---
updated-dependencies:
- dependency-name: tj-actions/changed-files
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/labeler
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @Maxim-Doronin
Bump black from 23.9.1 to 24.3.0 in /llvm/utils/git
cad74c3 
Bumps [black](https://github.com/psf/black) from 23.9.1 to 24.3.0.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@23.9.1...24.3.0)

---
updated-dependencies:
- dependency-name: black
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @Maxim-Doronin
Bump requests from 2.31.0 to 2.32.2 in /llvm/utils/git
7875960 
Bumps [requests](https://github.com/psf/requests) from 2.31.0 to 2.32.2.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.31.0...v2.32.2)

---
updated-dependencies:
- dependency-name: requests
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @Maxim-Doronin
Bump cryptography from 41.0.3 to 42.0.4 in /llvm/utils/git
588ab49 
Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.3 to 42.0.4.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@41.0.3...42.0.4)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @Maxim-Doronin
Bump urllib3 from 2.0.4 to 2.0.7 in /llvm/utils/git
dc680ff 
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.0.4 to 2.0.7.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.0.4...2.0.7)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @Maxim-Doronin
Bump idna from 3.4 to 3.7 in /llvm/utils/git
c89ac21 
Bumps [idna](https://github.com/kjd/idna) from 3.4 to 3.7.
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst)
- [Commits](kjd/idna@v3.4...v3.7)

---
updated-dependencies:
- dependency-name: idna
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@Maxim-Doronin Maxim-Doronin changed the title Md/security fixes SDL security fixes Jun 14, 2024
AlexandruLorinti
AlexandruLorinti reviewed Jun 14, 2024
View reviewed changes
Copy link

@AlexandruLorinti AlexandruLorinti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

andrey-golubev
andrey-golubev approved these changes Jun 17, 2024
View reviewed changes
Copy link
Contributor

@andrey-golubev andrey-golubev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM as well. I'd be slightly concerned about python requirements changes (in case our compiler infra uses something from main llvm - e.g. lit.py?) but I don't think it should really break anything.

@Maxim-Doronin Maxim-Doronin merged commit ee2d72d into intel:npu/release/18.x Jun 17, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AlexandruLorinti AlexandruLorinti AlexandruLorinti left review comments

@nikita-kud nikita-kud nikita-kud approved these changes

@andrey-golubev andrey-golubev andrey-golubev approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@Maxim-Doronin @andrey-golubev @AlexandruLorinti @nikita-kud