CVE-2022-21699

Advisory

Elyra 3.7.0rc0 updates its dependency 'ipython' to v7.16.3 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Fix typo in release script
- Create Component Catalogs Widget - [2532](https://github.com/elyra-ai/elyra/pull/2532)
- Convert bytes and bytearray types to string for Component def attr - [2602](https://github.com/elyra-ai/elyra/pull/2602)
- Relax component YAML validation req's for certain fields - [2600](https://github.com/elyra-ai/elyra/pull/2600)
- Enable display of custom component definitions - [2564](https://github.com/elyra-ai/elyra/pull/2564)
- Temporary fix to metadata editor display bug - [2593](https://github.com/elyra-ai/elyra/pull/2593)
- Support KFP pipeline run monitoring for 'elyra-pipeline submit' cmd - [2584](https://github.com/elyra-ai/elyra/pull/2584)
- Make component cache event-driven to allow out-of-proc updates - [2522](https://github.com/elyra-ai/elyra/pull/2522)
- Add support for 'export' command to elyra-pipeline CLI - [2582](https://github.com/elyra-ai/elyra/pull/2582)
- Add troubleshooting information for 'component not found' errors - [2591](https://github.com/elyra-ai/elyra/pull/2591)
- Update Jinja2 dependencies - [2589](https://github.com/elyra-ai/elyra/pull/2589)
- Bump minimist from 1.2.5 to 1.2.6 - [2587](https://github.com/elyra-ai/elyra/pull/2587)
- Enable CodeQL checks in CI workflows - [2570](https://github.com/elyra-ai/elyra/pull/2570)
- Update python dependencies to address security issues - [2583](https://github.com/elyra-ai/elyra/pull/2583)
- Prevent error popups during KFP component parse - [2561](https://github.com/elyra-ai/elyra/pull/2561)
- Add support for elyra-metadata 'create' and 'update' commands - [2578](https://github.com/elyra-ai/elyra/pull/2578)
- Add unit tests for script editor package - [2576](https://github.com/elyra-ai/elyra/pull/2576)
- Update to latest container images to refresh runtime images - [2555](https://github.com/elyra-ai/elyra/pull/2555)
- Add a new extension - Code Viewer - [2553](https://github.com/elyra-ai/elyra/pull/2553)
- Update docs for configuring Apache airflow - [2569](https://github.com/elyra-ai/elyra/pull/2569)
- Update CLI export command and documentation - [2574](https://github.com/elyra-ai/elyra/pull/2574)
- Fix broken link to runtime image topic - [2568](https://github.com/elyra-ai/elyra/pull/2568)
- Address Metadata UI inconsistencies - [2559](https://github.com/elyra-ai/elyra/pull/2559)
- Bump tf version in container image - [2558](https://github.com/elyra-ai/elyra/pull/2558)
- Remove dependency on jupyter_server test utils - [2557](https://github.com/elyra-ai/elyra/pull/2557)
- Update docs that describes how to create custom runtime images - [2547](https://github.com/elyra-ai/elyra/pull/2547)
- Fix error handling when replace used w/o schemaspace - [2540](https://github.com/elyra-ai/elyra/pull/2540)
- Add/update empty metadata instance list message - [2537](https://github.com/elyra-ai/elyra/pull/2537)
- Add setting to specify node double click behavior - [2517](https://github.com/elyra-ai/elyra/pull/2517)
- Update to JupyterLab release 3.3.0 - [2519](https://github.com/elyra-ai/elyra/pull/2519)
- Remove references to deprecated 'elyra-examples-airflow-catalog' package - [2529](https://github.com/elyra-ai/elyra/pull/2529)
- Sanitize KFP input/output params in kwargs - [2533](https://github.com/elyra-ai/elyra/pull/2533)
- Update Makefile python and pip calls to use python3 - [2536](https://github.com/elyra-ai/elyra/pull/2536)
- Simplify integration tests for runtime configs - [2530](https://github.com/elyra-ai/elyra/pull/2530)
- Add a refresh button the header of Metadata Widget - [2531](https://github.com/elyra-ai/elyra/pull/2531)
- Move release template into elyra repo - [2521](https://github.com/elyra-ai/elyra/pull/2521)
- Rename test file from application.spec.ts to services.spec.ts - [2523](https://github.com/elyra-ai/elyra/pull/2523)
- Use well-defined EntryData return values in Airflow catalog connectors - [2520](https://github.com/elyra-ai/elyra/pull/2520)
- Update built-in connectors to use new connector API - [2518](https://github.com/elyra-ai/elyra/pull/2518)
- Allow pipelines to be opened withe the JSON widget - [2511](https://github.com/elyra-ai/elyra/pull/2511)
- Add script editor output integration tests - [2507](https://github.com/elyra-ai/elyra/pull/2507)
- Support well-defined return values for catalog connectors - [2492](https://github.com/elyra-ai/elyra/pull/2492)
- Pin doc link to current release in elyra-pipeline cli - [2506](https://github.com/elyra-ai/elyra/pull/2506)
- Update to use JupyterLab 3.3.0rc0 - [2495](https://github.com/elyra-ai/elyra/pull/2495)
- Fix invalid KFP component URL references - [2503](https://github.com/elyra-ai/elyra/pull/2503)
- Update help link in VPE - [2505](https://github.com/elyra-ai/elyra/pull/2505)
- Update build to use prebuilt extensions - [2447](https://github.com/elyra-ai/elyra/pull/2447)
- Add integration tests related to output console - [2499](https://github.com/elyra-ai/elyra/pull/2499)
- Update examples for verification step and first issue label - [2496](https://github.com/elyra-ai/elyra/pull/2496)
- Add support for cli metadata export - [2448](https://github.com/elyra-ai/elyra/pull/2448)
- Remove support for component-registries schemaspace - [2497](https://github.com/elyra-ai/elyra/pull/2497)
- Bump kfp-tekton dependency - [2480](https://github.com/elyra-ai/elyra/pull/2480)
- Bump version requirement for nbformat, ipython, and traitlets - [2493](https://github.com/elyra-ai/elyra/pull/2493)
- Fix typo in git release configuration file (release.yml) - [2490](https://github.com/elyra-ai/elyra/pull/2490)
- Update some dependencies to avoid security vulnerabilities - [2487](https://github.com/elyra-ai/elyra/pull/2487)
- Fix submit file as pipeline dialog message - [2489](https://github.com/elyra-ai/elyra/pull/2489)
- Add support for custom requirements in Elyra container image build - [2478](https://github.com/elyra-ai/elyra/pull/2478)
- Document how to configure custom Airflow components for use in pipelines - [2485](https://github.com/elyra-ai/elyra/pull/2485)
- Create git release configuration configuration file - [2483](https://github.com/elyra-ai/elyra/pull/2483)
- Replace invalid characters in airflow parent node references - [2468](https://github.com/elyra-ai/elyra/pull/2468)
- Add a link to most recent blog to the documentation - [2486](https://github.com/elyra-ai/elyra/pull/2486)
- Fix templates for safe rendering of comments, pipeline & prop description - [2467](https://github.com/elyra-ai/elyra/pull/2467)
- Deprecate python 3.6 usage and include 3.10 in testing - [2479](https://github.com/elyra-ai/elyra/pull/2479)
- Associate user doc to pipeline custom component - [2474](https://github.com/elyra-ai/elyra/pull/2474)
- Add eslint rule for type-safe equality operators - [2475](https://github.com/elyra-ai/elyra/pull/2475)
- Bump follow-redirects from 1.14.7 to 1.14.8 - [2477](https://github.com/elyra-ai/elyra/pull/2477)
- Fix properties template for KFP inputvalue types - [2473](https://github.com/elyra-ai/elyra/pull/2473)
- Restore tag variable, update release script - [2465](https://github.com/elyra-ai/elyra/pull/2465)
- Sort runtime tiles alphabetically in launcher - [2449](https://github.com/elyra-ai/elyra/pull/2449)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21699