Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump log4net from 2.0.3 to 2.0.10 in /sdk/mgmtcommon/ClientRuntime.Log4Net #21964

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 18, 2021

Bumps log4net from 2.0.3 to 2.0.10.

Release notes

Sourced from log4net's releases.

Address CVE-2018-1285 and improve netstandard 2.0 support

Apache log4net 2.0.10 improves netstandard2.0 support thanks to community member @​NicholasNoise.

Bug Fixes

  • [LOG4NET-575] Addresses CVE-2018-1285 by cherry-picking the fix from Dominik Psenner, reported by Karthik Balasundaram, as it already existed in the the develop branch
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [log4net](https://github.com/apache/logging-log4net) from 2.0.3 to 2.0.10.
- [Release notes](https://github.com/apache/logging-log4net/releases)
- [Changelog](https://github.com/apache/logging-log4net/blob/master/ReleaseInstructions.txt)
- [Commits](https://github.com/apache/logging-log4net/commits/rel/2.0.10)

---
updated-dependencies:
- dependency-name: log4net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from AlexGhiondea as a code owner June 18, 2021 16:10
@ghost ghost added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Jun 18, 2021
@ghost
Copy link

ghost commented Jun 18, 2021

Thank you for your contribution @dependabot[bot]! We will review the pull request and get back to you soon.

@ghost ghost added the Community Contribution Community members are working on the issue label Jun 18, 2021
@check-enforcer
Copy link

This pull request is protected by Check Enforcer.

What is Check Enforcer?

Check Enforcer helps ensure all pull requests are covered by at least one check-run (typically an Azure Pipeline). When all check-runs associated with this pull request pass then Check Enforcer itself will pass.

Why am I getting this message?

You are getting this message because Check Enforcer did not detect any check-runs being associated with this pull request within five minutes. This may indicate that your pull request is not covered by any pipelines and so Check Enforcer is correctly blocking the pull request being merged.

What should I do now?

If the check-enforcer check-run is not passing and all other check-runs associated with this PR are passing (excluding license-cla) then you could try telling Check Enforcer to evaluate your pull request again. You can do this by adding a comment to this pull request as follows:
/check-enforcer evaluate
Typically evaulation only takes a few seconds. If you know that your pull request is not covered by a pipeline and this is expected you can override Check Enforcer using the following command:
/check-enforcer override
Note that using the override command triggers alerts so that follow-up investigations can occur (PRs still need to be approved as normal).

What if I am onboarding a new service?

Often, new services do not have validation pipelines associated with them. In order to bootstrap pipelines for a new service, please perform following steps:

For data-plane/track 2 SDKs Issue the following command as a pull request comment:

/azp run prepare-pipelines
This will run a pipeline that analyzes the source tree and creates the pipelines necessary to build and validate your pull request. Once the pipeline has been created you can trigger the pipeline using the following comment:
/azp run net - [service] - ci

For track 1 management-plane SDKs

Please open a separate PR and to your service SDK path in this file. Once that PR has been merged, you can re-run the pipeline to trigger the verification.

@jsquire
Copy link
Member

jsquire commented Jun 19, 2021

@pakrym: From history, it looks like you may have the best understanding of the implications of this update. Would you mind offering your thoughts?

@pakrym
Copy link
Contributor

pakrym commented Jun 21, 2021

This seems fine, don't think it would hurt anything.

@jsquire
Copy link
Member

jsquire commented Jun 21, 2021

/check-enforcer override

@jsquire jsquire merged commit c11b128 into main Jun 21, 2021
@jsquire jsquire deleted the dependabot/nuget/sdk/mgmtcommon/ClientRuntime.Log4Net/log4net-2.0.10 branch June 21, 2021 16:07
azure-sdk pushed a commit to azure-sdk/azure-sdk-for-net that referenced this pull request Jan 16, 2023
Dev search microsoft.search 2022 09 01 (Azure#21964)

* Adds base for updating Microsoft.Search from version stable/2020-08-01 to version 2022-09-01

* Updates readme

* Updates API version in new specs and examples

* Add missing private endpoint connection properties (Azure#21629)

* add missing private endpoint connection properties

* fix errors

* Adding delegated identities to data plane

* Revert "Adding delegated identities to data plane"

This reverts commit def1bd3ba296458c19b8f04cb1a7a5b800d002f9.

* Fix Lint ProvisioningStateValidation Error

* Applying prettier changes
npm run prettier -- --write

Co-authored-by: Enrique Jaimes <enjaimes@microsoft.com>

* Satumkur/new api ver 20220901 (Azure#21922)

* semantic updates

* Add Dataplane RBAC related changes + examples

* Prettier fixes

* Fix LintDiff errors

* Update SearchUpdateServiceDisableLocalAuth.json

update erroneous api version param

Co-authored-by: Samartha Tumkur Vani <satumkur@microsoft.com>
Co-authored-by: Enrique Jaimes <enjaimes@microsoft.com>

* Add CMK Enforcement policy support (Azure#21996)

* Add CMK Enforcement policy support

* Update api-version

* Remove unused properties

* Remove bypass property

Co-authored-by: satumkurmsft <72990508+satumkurmsft@users.noreply.github.com>
Co-authored-by: Matt <57731498+mattmsft@users.noreply.github.com>
Co-authored-by: Samartha Tumkur Vani <satumkur@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
AutoRest Runtime Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants