Security updates November 2023 (#3797)

microsoft · Nov 30, 2023 · 5489c9d · 5489c9d
1 parent d5cd77b
commit 5489c9d
Show file tree

Hide file tree

Showing 14 changed files with 3,593 additions and 3,064 deletions.
diff --git a/.github/scripts/yarn.lock b/.github/scripts/yarn.lock
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,7 +7,7 @@ To resolve the Airlock import issue described in ([#3767](https://github.com/mic
 FEATURES:
 
 ENHANCEMENTS:
-
+* Security updates aligning to Dependabot, MS Defender for Cloud and Synk ([#3796](https://github.com/microsoft/AzureTRE/issues/3796))
 BUG FIXES:
 * Fix issue where updates fail as read only is not configured consistently on schema fields ([#3691](https://github.com/microsoft/AzureTRE/issues/3691))
 * When geting avaialble address spaces allow those allocated to deleted workspaces to be reassigned ([#3691](https://github.com/microsoft/AzureTRE/issues/3691))

diff --git a/api_app/_version.py b/api_app/_version.py
@@ -1 +1 @@
-__version__ = "0.16.8"
+__version__ = "0.16.9"
diff --git a/api_app/requirements.txt b/api_app/requirements.txt
@@ -1,6 +1,6 @@
 # API
 azure-core==1.29.5
-aiohttp==3.8.6
+aiohttp==3.9.0
 azure-cosmos==4.5.1
 azure-identity==1.14.1
 azure-mgmt-cosmosdb==9.3.0

diff --git a/cli/requirements.txt b/cli/requirements.txt
@@ -8,4 +8,4 @@ pygments==2.16.1
 PyJWT==2.8.0
 azure-cli-core==2.50.0
 azure-identity==1.14.1
-aiohttp==3.8.6
+aiohttp==3.9.0
diff --git a/cli/setup.py b/cli/setup.py
@@ -49,7 +49,7 @@
         "PyJWT==2.8.0",
         "azure-cli-core==2.50.0",
         "azure-identity==1.14.1",
-        "aiohttp==3.8.6"
+        "aiohttp==3.9.0"
     ],
 
     namespace_packages=[],

diff --git a/resource_processor/_version.py b/resource_processor/_version.py
@@ -1 +1 @@
-__version__ = "0.7.0"
+__version__ = "0.7.1"
diff --git a/resource_processor/vmss_porter/requirements.txt b/resource_processor/vmss_porter/requirements.txt
@@ -2,5 +2,5 @@ azure-servicebus==7.11.3
 opencensus-ext-azure==1.1.11
 opencensus-ext-logging==0.1.1
 azure-identity==1.14.1
-aiohttp==3.8.6
+aiohttp==3.9.0
 azure-cli-core==2.50.0
diff --git a/templates/shared_services/certs/terraform/staticweb.tf b/templates/shared_services/certs/terraform/staticweb.tf
@@ -1,13 +1,14 @@
 # See https://microsoft.github.io/AzureTRE/tre-developers/letsencrypt/
 resource "azurerm_storage_account" "staticweb" {
-  name                      = local.staticweb_storage_name
-  resource_group_name       = data.azurerm_resource_group.rg.name
-  location                  = data.azurerm_resource_group.rg.location
-  account_kind              = "StorageV2"
-  account_tier              = "Standard"
-  account_replication_type  = "LRS"
-  enable_https_traffic_only = true
-  tags                      = local.tre_shared_service_tags
+  name                            = local.staticweb_storage_name
+  resource_group_name             = data.azurerm_resource_group.rg.name
+  location                        = data.azurerm_resource_group.rg.location
+  account_kind                    = "StorageV2"
+  account_tier                    = "Standard"
+  account_replication_type        = "LRS"
+  enable_https_traffic_only       = true
+  allow_nested_items_to_be_public = false
+  tags                            = local.tre_shared_service_tags
 
   static_website {
     index_document     = "index.html"

diff --git a/templates/workspace_services/guacamole/guacamole-server/docker/version.txt b/templates/workspace_services/guacamole/guacamole-server/docker/version.txt
@@ -1 +1 @@
-__version__ = "0.8.1"
+__version__ = "0.8.2"
diff --git a/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/pom.xml b/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/pom.xml
@@ -48,7 +48,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-security-keyvault-secrets</artifactId>
-            <version>4.6.3</version>
+            <version>4.7.2</version>
         </dependency>
         <dependency>
             <groupId>com.azure</groupId>

diff --git a/templates/workspaces/base/terraform/storage.tf b/templates/workspaces/base/terraform/storage.tf
@@ -1,11 +1,12 @@
 resource "azurerm_storage_account" "stg" {
-  name                     = local.storage_name
-  resource_group_name      = azurerm_resource_group.ws.name
-  location                 = azurerm_resource_group.ws.location
-  account_tier             = "Standard"
-  account_replication_type = "GRS"
-  is_hns_enabled           = true
-  tags                     = local.tre_workspace_tags
+  name                            = local.storage_name
+  resource_group_name             = azurerm_resource_group.ws.name
+  location                        = azurerm_resource_group.ws.location
+  account_tier                    = "Standard"
+  account_replication_type        = "GRS"
+  allow_nested_items_to_be_public = false
+  is_hns_enabled                  = true
+  tags                            = local.tre_workspace_tags
 
   lifecycle { ignore_changes = [tags] }
 }

diff --git a/ui/app/package.json b/ui/app/package.json
@@ -1,6 +1,6 @@
 {
   "name": "tre-ui",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "private": true,
   "dependencies": {
     "@azure/msal-browser": "^2.35.0",

diff --git a/ui/app/yarn.lock b/ui/app/yarn.lock