CVE-2023-49080

Advisory

Mage-ai version 0.9.65 updates its jupyter-server dependency to 2.11.2 from the previous 1.23.5 in response to the security vulnerability CVE-2023-49080.
https://github.com/mage-ai/mage-ai/pull/4444/commits/6fd7c487c4accb1af62438b07b876d732d3c301a

Affected package

Affected versions

Fixed versions

Vulnerability changelog

<div align="center">
<img src="https://media.giphy.com/media/v1.Y2lkPTc5MGI3NjExNGs2enJlbXV1MmJkamlkcTluY3RuZ3g5cmFiMDkyd2E0emRpa3gwZiZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/QUKqSLmE7vmZP2PkZk/giphy.gif" width="50%" />
</div>

<!-- Release notes generated using configuration in .github/release.yml at release/0.9.65 -->

What's Changed
🎉 Exciting New Features
🔔 Telegram notification
<div align="center">
<img src="https://github.com/mage-ai/mage-ai/assets/80284865/ca7b240f-1e07-4c0a-8c61-0b3809fefc33" width="600"/>
</div>

<br/>

Support for setting up Telegram notification channel for alerts is now available.
Check out the [doc](https://docs.mage.ai/integrations/observability/alerting-telegram) for details

_by luthfir-rahman in https://github.com/mage-ai/mage-ai/pull/4632_

🔄 Runtime variables and concurrency config in Backfills
Backfills support configuring global variables override and concurrency limit is now available.
<div align="center">
<img src="https://github.com/mage-ai/mage-ai/assets/80284865/c359d942-3dbe-4cd4-ba07-3ef636f5d9cc" width="600"/>
</div>

<br/>

_by dy46 in https://github.com/mage-ai/mage-ai/pull/4618_

☁️ Export raw files to S3 and GCS
Using S3 and GCS data exporter templates, you can now directly upload raw files in addition to dataframes.

python
bucket_name = 'test-bucket'
object_key = 'test_file_copy.csv'

S3.with_config(ConfigFileLoader(config_path, config_profile)).export(
'/home/src/test_file.csv',
bucket_name,
object_key,
)
GoogleCloudStorage.with_config(ConfigFileLoader(config_path, config_profile)).export(
'/home/src/test_file.csv',
bucket_name,
object_key,
)

_by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4607_

🐛 Bug Fixes
* Luthfir/discord notification by luthfir-rahman in https://github.com/mage-ai/mage-ai/pull/4590
* [xy] Support exporting to mysql with selected columns. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4605
* [xy] Update the port check to use specified host. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4606
* [xy] Set default host when checking port. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4610
* [dy] Refactor duplicate git code by dy46 in https://github.com/mage-ai/mage-ai/pull/4611
* [jk] Fix unclickable minimized windows by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4613
* [dy] Attempt to resolve network issues by dy46 in https://github.com/mage-ai/mage-ai/pull/4620
* [jk] Fix block caching when renaming/detaching blocks by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4626
* [jk] Update tag and block cache when cloning pipeline by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4627
* [jk] Various bugfixes for pipeline search and filter by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4631
* [xy] Use milliseconds in parquet by default. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4634
* Fixed MongoDB reading input by Luishfs in https://github.com/mage-ai/mage-ai/pull/4639
* Fixed random input inside singer destinations by Luishfs in https://github.com/mage-ai/mage-ai/pull/4642
* [jk] Fix double scrollbars and draggable height by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4643
* [jk] UI bugfixes on Version Control page by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4644
* [dy] Fix unit test logging by dy46 in https://github.com/mage-ai/mage-ai/pull/4630
* [dy] Add DB locking by dy46 in https://github.com/mage-ai/mage-ai/pull/4629
* [jk] Bugfixes for Overview Dashboard by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4659
* [jk] Bugfix for save block shortcut by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4667
* Fixed postgreSQL reserved words by Luishfs in https://github.com/mage-ai/mage-ai/pull/4640
* [dy] Minor workspace fixes by dy46 in https://github.com/mage-ai/mage-ai/pull/4658
* [jk] Sync block contents for replica block when minimizing by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4672
* Incorrect spelling for the word level in documentation by Sa1tyBiscuit in https://github.com/mage-ai/mage-ai/pull/4635

💅 Enhancements & Polish
* [xy] Support filtering google sheets by sheet names by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4604
* [xy] Combine schedulers. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4614
* [xy] Separate scheduler logs and pipeline logs. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4621
* [xy] Update initial load of log_based replication to use incremental sync by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4623
* [jk] Redirect to login page immediately by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4662
* [jk] Clean up chart block widths in Pipeline Editor by johnson-mage in https://github.com/mage-ai/mage-ai/pull/4665
* [xy] Support extra connection arguments in mysql source and destination. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4668
* [xy] Fix image build by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4671
* Add DEFAULT_EXECUTOR_TYPE by danieldiamond in https://github.com/mage-ai/mage-ai/pull/4597
* [dy] Filter out sensitive config by dy46 in https://github.com/mage-ai/mage-ai/pull/4594
* mage_ai/io MSSQL connection: add support for DATETIMEOFFSET by hugabora in https://github.com/mage-ai/mage-ai/pull/4619
* [xy] Bump up more versions to resolve vulnerabilities. by wangxiaoyou1993 in https://github.com/mage-ai/mage-ai/pull/4444


New Contributors
* danieldiamond made their first contribution in https://github.com/mage-ai/mage-ai/pull/4597
* carillpower made their first contribution in https://github.com/mage-ai/mage-ai/pull/4625
* Sa1tyBiscuit made their first contribution in https://github.com/mage-ai/mage-ai/pull/4635

**Full Changelog**: https://github.com/mage-ai/mage-ai/compare/0.9.64...0.9.65

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49080
• https://github.com/mage-ai/mage-ai/pull/4444/commits/6fd7c487c4accb1af62438b07b876d732d3c301a#diff-4d7c51b1efe9043e44439a949dfd92e5827321b34082903477fd04876edb7552R22