Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use latest json-smart lib #1223

Conversation

martin-gaievski
Copy link
Member

@martin-gaievski martin-gaievski commented Mar 11, 2025

Description

json-path 2.9.0 has been flagged in CVE-2024-57699. They do not have fix yet, and their devs suggest to switch to json-smart json-path/JsonPath#1031.

We need to have this library for ml-commons, follow their strategy: keep json-path, but excluding json-smart part of it, and include json-mart of the proper version separately.

Picking up version of json-smart from the OS core, they added in the recent PR opensearch-project/OpenSearch#17569

Related Issues

#1222

Check List

  • [ ] New functionality includes testing.
  • [ ] New functionality has been documented.
  • [ ] API changes companion pull request created.
  • Commits are signed per the DCO using --signoff.
  • [ ] Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@martin-gaievski martin-gaievski added skip-changelog Maintenance Add support for new versions of OpenSearch/Dashboards from upstream v3.0.0 v3.0.0 labels Mar 11, 2025
@martin-gaievski martin-gaievski force-pushed the fixed_cve_for_jayway_json_lib branch from c14ee89 to 55d2acc Compare March 11, 2025 16:44
Signed-off-by: Martin Gaievski <gaievski@amazon.com>
@martin-gaievski martin-gaievski force-pushed the fixed_cve_for_jayway_json_lib branch from 55d2acc to cb6f59a Compare March 11, 2025 16:49
Copy link

codecov bot commented Mar 11, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.79%. Comparing base (5f25d6c) to head (0a20b75).
Report is 1 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff              @@
##               main    #1223      +/-   ##
============================================
- Coverage     81.80%   81.79%   -0.02%     
+ Complexity     2606     1303    -1303     
============================================
  Files           190       95      -95     
  Lines          8922     4461    -4461     
  Branches       1520      760     -760     
============================================
- Hits           7299     3649    -3650     
+ Misses         1032      517     -515     
+ Partials        591      295     -296     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: Martin Gaievski <gaievski@amazon.com>
@martin-gaievski martin-gaievski marked this pull request as ready for review March 11, 2025 17:27
@martin-gaievski martin-gaievski changed the title Switch from json-path 2.9.0 to latest json-smart Use latest json-smart lib Mar 11, 2025
@martin-gaievski martin-gaievski merged commit 57124dd into opensearch-project:main Mar 11, 2025
74 checks passed
@martin-gaievski martin-gaievski deleted the fixed_cve_for_jayway_json_lib branch March 11, 2025 23:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Maintenance Add support for new versions of OpenSearch/Dashboards from upstream skip-changelog v3.0.0 v3.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants