Merge pull request #14 from Granulate/handle_final_vulnerabilities

Handle high and med vulnerabilities
Granulate · Feb 29, 2024 · 1f8be54 · 1f8be54
2 parents 7211e29 + a5fde2e
commit 1f8be54
Show file tree

Hide file tree

Showing 11 changed files with 32 additions and 29 deletions.
diff --git a/deploy/https_nginx.conf b/deploy/https_nginx.conf
@@ -14,7 +14,7 @@ http {
     }
 
     # HTTPS server
-    limit_req_zone $binary_remote_addr zone=ratelimit:10m rate=1r/s;
+#     limit_req_zone $binary_remote_addr zone=ratelimit:10m rate=10r/s;
 
     server {
         listen 443 ssl;
@@ -42,7 +42,7 @@ http {
             auth_basic "Username and password is required";
             auth_basic_user_file /etc/nginx/.htpasswd;
             proxy_pass http://webapp;
-            limit_req zone=ratelimit;
+#             limit_req zone=ratelimit;
         }
     }
 }
diff --git a/src/gprofiler-dev/postgres_requirements.txt b/src/gprofiler-dev/postgres_requirements.txt
@@ -4,4 +4,4 @@
 # This software and the related documents are provided as is, with no express or implied warranties, other than those that are expressly stated in the License.
 
 psycopg2-binary==2.9.9
-pydantic[email]==1.8.2
+pydantic[email]==1.10.14
diff --git a/src/gprofiler-dev/requirements.txt b/src/gprofiler-dev/requirements.txt
@@ -3,12 +3,12 @@
 # This software and the related documents are Intel copyrighted materials, and your use of them is governed by the express license under which they were provided to you ("License"). Unless the License provides otherwise, you may not use, modify, copy, publish, distribute, disclose or transmit this software or the related documents without Intel's prior written permission.
 # This software and the related documents are provided as is, with no express or implied warranties, other than those that are expressly stated in the License.
 
-boto3==1.17.24
-botocore==1.20.24
-terminaltables==3.1.0
-requests~=2.27.0
-python-json-logger==2.0.1
-psutil==5.8.0
+boto3==1.34.25
+botocore==1.34.25
+terminaltables==3.1.10
+requests~=2.31.0
+python-json-logger==2.0.7
+psutil==5.9.8
 backoff==1.10.0
 monotonic==1.6
-simplejson==3.17.6
+simplejson==3.19.2
diff --git a/src/gprofiler/Dockerfile b/src/gprofiler/Dockerfile
@@ -14,7 +14,7 @@ RUN yarn --cwd /frontend/ install
 COPY gprofiler/frontend /frontend
 RUN yarn build
 
-FROM python:3.10-bullseye
+FROM python:3.12-bullseye
 
 WORKDIR /usr/src/app
 EXPOSE 80

diff --git a/src/gprofiler/README.md b/src/gprofiler/README.md
@@ -2,7 +2,7 @@
 
 ## Running the backend locally
 ### Pre-requisites
-- Python 3.10 or higher is installed on your machine.
+- Python 3.12 or higher is installed on your machine.
 - Running `deploy/docker-compose.yml` without the webapp service - that way you will be covered with all the dependencies, like databases and other services.
 
 Now we need to install the dependencies:

diff --git a/src/gprofiler/frontend/index.html b/src/gprofiler/frontend/index.html
@@ -5,7 +5,7 @@
         <link rel="shortcut icon" href="/favicon.ico" />
         <meta name="viewport" content="minimum-scale=1, initial-scale=1, width=device-width, shrink-to-fit=no" />
         <meta name="theme-color" content="#000000" />
-        <link rel="manifest" href="/manifest.json" />
+        <link rel="manifest" href="/manifest.json" crossorigin="use-credentials"/>
         <title>gProfiler</title>
     </head>
     <body style="background-color: #f0f2f5">

diff --git a/src/gprofiler/frontend/yarn.lock b/src/gprofiler/frontend/yarn.lock
@@ -2133,9 +2133,9 @@ find-root@^1.1.0:
   resolved "https://registry.yarnpkg.com/find-root/-/find-root-1.1.0.tgz#abcfc8ba76f708c42a97b3d685b7e9450bfb9ce4"
   integrity sha512-NKfW6bec6GfKc0SGx1e07QZY9PE99u0Bft/0rzSD5k3sO/vwkVUpDUKVm5Gpp5Ue3YfShPFTX2070tDs5kB9Ng==
 
-"flame-chart-js@ssh://[email protected]:Granulate/gflame.git":
+flame-chart-js@Granulate/flame-chart-js.git:
   version "3.1.0"
-  resolved "ssh://git@github.com:Granulate/gflame.git#cbead371f4f88843a37e91830edcbb5a3abcf20c"
+  resolved "https://codeload.github.com/Granulate/flame-chart-js/tar.gz/cbead371f4f88843a37e91830edcbb5a3abcf20c"
   dependencies:
     color "^3.1.3"
     events "^3.2.0"

diff --git a/src/gprofiler/requirements.txt b/src/gprofiler/requirements.txt
@@ -4,11 +4,12 @@
 # This software and the related documents are provided as is, with no express or implied warranties, other than those that are expressly stated in the License.
 
 gprofiler_dev[postgres]
-PyYAML==6.0
-jsonschema==4.6.0
-cachetools==5.2.0
+PyYAML==6.0.1
+jsonschema==4.21.1
+cachetools==5.3.2
 pyhumps==3.8.0
 cmp-version==3.0.0
-setproctitle==1.2.3
-fastapi[all]==0.78.0
-gunicorn==20.1.0
+setproctitle==1.3.3
+fastapi==0.109.0
+uvicorn==0.27.0
+gunicorn==21.2.0
diff --git a/src/gprofiler_flamedb_rest/common/go.mod b/src/gprofiler_flamedb_rest/common/go.mod
@@ -26,8 +26,8 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
 	golang.org/x/arch v0.3.0 // indirect
-	golang.org/x/crypto v0.9.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/crypto v0.17.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/sys v0.8.0 // indirect
 	golang.org/x/text v0.9.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect

diff --git a/src/gprofiler_logging/Dockerfile b/src/gprofiler_logging/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.10
+FROM python:3.12
 
 WORKDIR /app
 EXPOSE 80

diff --git a/src/gprofiler_logging/requirements.txt b/src/gprofiler_logging/requirements.txt
@@ -3,9 +3,11 @@
 # This software and the related documents are Intel copyrighted materials, and your use of them is governed by the express license under which they were provided to you ("License"). Unless the License provides otherwise, you may not use, modify, copy, publish, distribute, disclose or transmit this software or the related documents without Intel's prior written permission.
 # This software and the related documents are provided as is, with no express or implied warranties, other than those that are expressly stated in the License.
 
-fastapi[all]==0.99.0
-aiofiles==0.5.0
-python-json-logger==2.0.1
-orjson==3.6.3
-cachetools==4.2.4
+pydantic[email]==1.10.14
+fastapi==0.109.0
+uvicorn==0.27.0
+aiofiles==23.2.1
+python-json-logger==2.0.7
+orjson==3.9.15
+cachetools==5.3.2
 types-orjson==3.6.2