Skip to content

[universal] - Fixing multiple vulnerability issues#1509

Merged
AlvaroRausell merged 7 commits into
devcontainers:mainfrom
Kaniska244:universal-vulnerability-issues-fix
Sep 1, 2025
Merged

[universal] - Fixing multiple vulnerability issues#1509
AlvaroRausell merged 7 commits into
devcontainers:mainfrom
Kaniska244:universal-vulnerability-issues-fix

Conversation

@Kaniska244

@Kaniska244 Kaniska244 commented Aug 21, 2025

Copy link
Copy Markdown
Contributor

Ref: https://github.com/devcontainers/internal/issues/300

Devcontainer Image:

  • Universal

Description of Changes: Following vulnerabilities are fixed as part of this PR.

GHSA ID Vulnerability ID Action Package Installed Version Required Version Language Install Path/ Note
Dotnet Core 106233 Y Dotnet core app 7 EOL Dotnet core App version Dotnet 7 runtime is indeed available in universal image but as a secondary version. The primary SDK version is 8
GHSA-h4gh-qq45-vh27: cryptography 5000874 Y cryptography 41.0.4 43.0.1 python Path is /opt/conda/lib/python3.12/site-packages/cryptography-41.0.4.dist-info/METADATA.
GHSA-9hjg-9r4m-mvj7: requests 5004358 Y requests 2.31.0 2.32.4 python Path is opt/conda/lib/python3.12/site-packages/requests-2.31.0.dist-info/METADATA.
GHSA-5rjg-fvgr-3xxf: setuptools 5004129 Y setuptools 69.5.1 78.1.1 python Path is usr/local/python/3.11.9/lib/python3.11/site-packages/setuptools-65.5.0.dist-info/METADATA.
GHSA-g7vv-2v7x-gj9p: tqdm 998612 Y tqdm 4.66.2 4.66.3 python Path is opt/conda/lib/python3.12/site-packages/tqdm-4.66.2.dist-info/METADATA.
GHSA-34jh-p97f-mpxf: urllib3 5000214 Y urllib3 1.26.18 1.26.19 python Path is opt/conda/lib/python3.12/site-packages/urllib3-1.26.18.dist-info/METADATA.

Changelog:

  • Changes in devcontainer.json to update additional dotnet version to 9.
  • Changes in patch-conda local feature

Checklist:

  • All checks are passed.

@Kaniska244
Kaniska244 marked this pull request as ready for review August 21, 2025 16:47
@Kaniska244
Kaniska244 requested a review from a team as a code owner August 21, 2025 16:47
@Mathiyarasy
Mathiyarasy self-requested a review August 25, 2025 11:45
Mathiyarasy
Mathiyarasy previously approved these changes Aug 25, 2025
Comment thread src/universal/manifest.json
@networkblackhawk44-alt

Copy link
Copy Markdown

Ref: https://github.com/devcontainers/internal/issues/300

Devcontainer Image:

  • Universal

Description of Changes: Following vulnerabilities are fixed as part of this PR.

GHSA ID Vulnerability ID Action Package Installed Version Required Version Language Install Path/ Note
Dotnet Core 106233 Y Dotnet core app 7 EOL Dotnet core App version Dotnet 7 runtime is indeed available in universal image but as a secondary version. The primary SDK version is 8
GHSA-h4gh-qq45-vh27: cryptography 5000874 Y cryptography 41.0.4 43.0.1 python Path is /opt/conda/lib/python3.12/site-packages/cryptography-41.0.4.dist-info/METADATA.
GHSA-9hjg-9r4m-mvj7: requests 5004358 Y requests 2.31.0 2.32.4 python Path is opt/conda/lib/python3.12/site-packages/requests-2.31.0.dist-info/METADATA.
GHSA-5rjg-fvgr-3xxf: setuptools 5004129 Y setuptools 69.5.1 78.1.1 python Path is usr/local/python/3.11.9/lib/python3.11/site-packages/setuptools-65.5.0.dist-info/METADATA.
GHSA-g7vv-2v7x-gj9p: tqdm 998612 Y tqdm 4.66.2 4.66.3 python Path is opt/conda/lib/python3.12/site-packages/tqdm-4.66.2.dist-info/METADATA.
GHSA-34jh-p97f-mpxf: urllib3 5000214 Y urllib3 1.26.18 1.26.19 python Path is opt/conda/lib/python3.12/site-packages/urllib3-1.26.18.dist-info/METADATA.
Changelog:

  • Changes in devcontainer.json to update additional dotnet version to 9.
  • Changes in patch-conda local feature

Checklist:

  • All checks are passed.

@AlvaroRausell
AlvaroRausell merged commit d3dedd8 into devcontainers:main Sep 1, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants