Consul patches js-yaml, nanoid vulnerabilities

♥

Plus Nomad and go-getter dependency bumps and a policy library cleanup across the week.

61 commits 54 PRs merged 2 releases 6 briefings covered

What shipped: Consul patched a security vulnerability involving js-yaml and nanoid [1], and separately fixed front-end security vulnerabilities for browserlist, postcss, and decode-uri [2]. Consul-k8s added a Helm value to enable tolerations for the CNI DaemonSet [3]. Nomad's API code removed the go-units dependency used for only two constants [4], and Nomad plan diffs now sort names with numeric array indices [5]. The prewritten-terraform-policy-library resolved issues across backup, apigw, kms, rds policies [6], s3 read/write, dynamo, dms policies [7], codebuild, rds, ebs, secretmanager policies [8], and sagemaker, redshift, msk, ssm, ec, es policies [9], plus fixed null errors in eks, redshift, ec2, cf policies [10]. CODEOWNERS updates landed across several Terraform repos [11]. Also: go-getter bumped seven dependencies in the go group [12], go-plugin bumped gRPC [13], and exec2 now reports real RSS and fixes mountinfo permissions [as per previous briefings, but no story provided].

References

[1] fix sec vuln for js-yaml and nanoid ↗ hashicorp/consul
[2] fix sec vuln for browserlist, postcss and decode-uri ↗ hashicorp/consul
[3] Consul CNI DaemonSet Toleration Helm Value Enablement (#5562) ↗ hashicorp/consul-k8s
[4] api: Remove go-units dep used for two consts only. (#28463) ↗ hashicorp/nomad
[5] structs: sort diff names with numeric array indices ↗ hashicorp/nomad
[6] fix: resolve issues in backup, apigw, kms, rds policies ↗ hashicorp/prewritten-terraform-policy-library
[7] fix: modified s3 read/write, dynamo, dms policies ↗ hashicorp/prewritten-terraform-policy-library
[8] fix: resolve issues in codebuild, rds, ebs, secretmanager policies ↗ hashicorp/prewritten-terraform-policy-library
[9] fix: modified sagemaker, redshift, msk, ssm, ec and es policies ↗ hashicorp/prewritten-terraform-policy-library
[10] Fix: eks redshift ec2 cf null errors ↗ hashicorp/prewritten-terraform-policy-library
[11] update CODEOWNERS to reflect team changes ↗ hashicorp/terraform-provider-scaffolding-framework
[12] [chore] : Bump the go group with 7 updates ↗ hashicorp/go-getter
[13] [chore] : Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go group across 1 directory ↗ hashicorp/go-plugin

$ ls hashicorp/week/ # the briefings behind this review

Mon Aug 31 Consul fixes js-yaml and nanoid vulnerabilities Tue Sep 1 Consul CNI tolerations now configurable, Nomad plan diff sorts args numerically Wed Sep 2 Policy library fixes null errors and removes unmanageable checks Thu Sep 3 Consul fixes front-end security vulnerabilities and provider adds S3 Object Lock support Fri Sep 4 Provider SAML Site Auditor support, Consul vulnerability patches Sat Sep 5 Exec2 reports real RSS, fixes mountinfo permissions

← previous week hashicorp wire →