CVE-2023-34092

Advisory

Starwhale 0.5.5 updates its dependency 'vite' to version '4.4.0' to include a fix for a Path Equivalence vulnerability.
https://github.com/star-whale/starwhale/pull/2475

Affected package

Affected versions

Fixed versions

Vulnerability changelog

🧭 What's Changed
* bug(dataset): clear Text._content for datastore (2500) tianweidut
* chore(client): add max_batch_size for update_table in tablewriter (2496) tianweidut
* chore(client): force to limit pydantic version < 2.0.0 (2484) tianweidut
* chore(client): update huggingface dataset string/binary convert logical (2498) tianweidut
* chore(console): add confirm when cancelling or pausing tasks (2495) jialeicui
* chore(console): disable sharing resource in private project (2499) jialeicui
* chore(controller): make view config in eval project scope (2492) jialeicui
* chore(controller): prefer using pod failed reason (2457) jialeicui
* chore(controller): refine docker image building (2503) jialeicui
* chore(controller): refine the exposed links (2504) jialeicui
* controller: add conda config to system setting (2502) anda-ren
* e2e: add artifacts download case to e2e & make local e2e easier (2465) anda-ren
* feat(client): switch to round-robin for blob cache server selection (2481) xuchuan
* feat(console): add datastore result view to job (2486) waynelwz
* feat(console): support auto release (2488) waynelwz
* feat(dataset): support dataset build from huggingface dataset (2476) tianweidut
* fix(client): check if exists when upload built-in runtime in the progress of model copy (2493) goldenxinxing
* fix(console): unstable e2e when check checkbox (2489) waynelwz
* fix(controller): search built-in runtime by model project id (2487) goldenxinxing
* fix(controller): set project id for model BO (2491) goldenxinxing
* fix(controller): task may be running after cancelled (2490) jialeicui
* hotfix(example): fix ag_news example evaluation typo (2505) tianweidut
* update(console): optimize grid viewer support complex data, more user friendly interactive (2479) waynelwz
* update(console): project menu order (2474) waynelwz
* update(console): require_dataset = null as default (2480) waynelwz
* update(console): support init lang by location (2473) waynelwz
* update(console): support job failed reason, add new copy & text component (2472) waynelwz
* update(console): table list content same with viewport to avoid scroll be blocking, add useCached hook (2494) waynelwz
* update: upgrade vite avoid vulnerabilities (2475) waynelwz
⚙️ Who Contributes
anda-ren, goldenxinxing, jialeicui, tianweidut, waynelwz and xuchuan

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34092